Merge branch 'main' into desktopInstallButton

folder and file fixes (#6461 )
Fix Tauri artifact copy path so installers upload (smoke + release) (#6466 )
2026-09-03 05:10:16 +03:00 · 2026-05-28 15:57:43 +01:00 · 2026-05-28 15:57:35 +01:00 · 2026-05-28 15:57:01 +01:00 · 2026-05-28 14:16:15 +00:00 · 2026-05-28 13:06:27 +01:00
2356 changed files with 72033 additions and 13116 deletions
@@ -34,8 +34,8 @@ frontend/playwright-report/
 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
-frontend/src-tauri/target/
-frontend/src-tauri/dist/
+frontend/editor/src-tauri/target/
+frontend/editor/src-tauri/dist/

 # IDE and editor
 .idea/
@@ -22,7 +22,7 @@ runs:
  steps:
    - name: Generate a GitHub App Token
      id: generate-token
-      uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      with:
        app-id: ${{ inputs.app-id }}
        private-key: ${{ inputs.private-key }}
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.10.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.10.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
@@ -8,7 +8,6 @@ openapi: &openapi

 docker-base: &docker-base
  - docker/base/Dockerfile
-  - ".github/workflows/push-docker-base.yml"

 docker: &docker
  - docker/embedded/Dockerfile
@@ -39,6 +38,8 @@ project: &project
  - frontend/**
  - docker/**
  - scripts/RestartHelper.java
+  - scripts/db-migration/**
+  - .github/workflows/db-migration-test.yml

 frontend: &frontend
  - frontend/**
@@ -58,12 +59,12 @@ frontend: &frontend
 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
 tauri: &tauri
-  - frontend/src-tauri/**
-  - frontend/src/desktop/**
-  - frontend/tsconfig.desktop.json
+  - frontend/editor/src-tauri/**
+  - frontend/editor/src/desktop/**
+  - frontend/editor/tsconfig.desktop.vite.json
  - frontend/package.json
  - frontend/package-lock.json
-  - frontend/vite.config.ts
+  - frontend/editor/vite.config.ts
  - .github/workflows/tauri-build.yml

 # Files that affect the AI engine (Python tool models, fixers, tests). Gate
@@ -78,7 +79,7 @@ licenses-frontend: &licenses-frontend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - "frontend/package.json"
  - "frontend/package-lock.json"
-  - "frontend/scripts/generate-licenses.js"
+  - "frontend/editor/scripts/generate-licenses.js"

 licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -88,8 +89,8 @@ licenses-backend: &licenses-backend
 # Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
  - app/proprietary/**
-  - frontend/src/proprietary/**
-  - frontend/src/core/tests/enterprise/**
+  - frontend/editor/src/proprietary/**
+  - frontend/editor/src/core/tests/enterprise/**
  - testing/compose/docker-compose-keycloak-oauth.yml
  - testing/compose/docker-compose-keycloak-saml.yml
  - testing/compose/keycloak-realm-oauth.json
@@ -25,6 +25,8 @@ updates:
      - "/docker/frontend"
      - "/docker/base"
      - "/docker/engine"
+      - "/docker/unoserver"
+      - "/engine"
    schedule:
      interval: "weekly"
    cooldown:
@@ -126,9 +128,9 @@ updates:

  - package-ecosystem: cargo
    directories:
-      - /frontend/src-tauri
-      - /frontend/src-tauri/thumbnail-handler
-      - /frontend/src-tauri/provisioner
+      - /frontend/editor/src-tauri
+      - /frontend/editor/src-tauri/thumbnail-handler
+      - /frontend/editor/src-tauri/provisioner
    schedule:
      interval: "weekly"
    cooldown:
@@ -51,7 +51,7 @@ labels:

  - label: 'Translation'
    files:
-      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'frontend/editor/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
      - 'scripts/ignore_translation.toml'
      - 'scripts/remove_translation_keys.sh'
      - 'scripts/replace_translation_line.sh'
@@ -69,8 +69,8 @@ labels:

  - label: 'Tauri'
    files:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src-tauri/.*'
+      - 'frontend/editor/src-tauri/**'
+      - 'frontend/editor/src-tauri/.*'

  - label: 'engine'
    files:
@@ -13,7 +13,7 @@ Usage:
 """

 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-GB/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml

 import argparse
 import glob
@@ -308,7 +308,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
        report.append("## ❌ Overall Check Status: **_Failed_**")
        report.append("")
        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-GB/translation.toml)"
        )
    else:
        report.append("## ✅ Overall Check Status: **_Success_**")
@@ -23,9 +23,13 @@ permissions:
  pull-requests: write

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  check-pr:
    if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    outputs:
      should_deploy: ${{ steps.decide.outputs.should_deploy }}
      is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -35,7 +39,7 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -97,8 +101,8 @@ jobs:
          echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT

  deploy-v2-pr:
-    needs: check-pr
-    runs-on: ubuntu-latest
+    needs: [pick, check-pr]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
    # Concurrency control - only one deployment per PR at a time
    concurrency:
@@ -108,10 +112,14 @@ jobs:
      contents: read
      issues: write
      pull-requests: write
+      id-token: write
+    env:
+      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -179,7 +187,12 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0 # Fetch full history for commit hash detection

+      - name: Set up Depot CLI
+        if: env.USE_DEPOT == 'true'
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
+
      - name: Set up Docker Buildx
+        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -224,8 +237,20 @@ jobs:
            echo "Image needs to be built"
          fi

-      - name: Build and push V2 image
-        if: steps.check-image.outputs.exists == 'false'
+      - name: Build and push V2 image (Depot)
+        if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push V2 image (Docker fork fallback)
+        if: env.USE_DEPOT != 'true' && steps.check-image.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -262,6 +287,7 @@ jobs:
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
+                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
              environment:
                DISABLE_ADDITIONAL_FEATURES: "false"
                SECURITY_ENABLELOGIN: "true"
@@ -284,7 +310,7 @@ jobs:

          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}
+            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}

            # Move docker-compose file to correct location
            mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml
@@ -351,7 +377,8 @@ jobs:

  cleanup-v2-deployment:
    if: github.event.action == 'closed'
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    permissions:
      contents: read
      issues: write
@@ -359,7 +386,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -34,8 +34,12 @@ permissions:
  pull-requests: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  check-comment:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    permissions:
      issues: write
    if: |
@@ -70,7 +74,7 @@ jobs:
      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -175,15 +179,19 @@ jobs:
            }

  deploy-pr:
-    needs: check-comment
-    runs-on: ubuntu-latest
+    needs: [pick, check-comment]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    permissions:
      issues: write
      pull-requests: write
+      id-token: write
+    env:
+      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -232,7 +240,12 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_PDF_DESKTOP_UI: false

+      - name: Set up Depot CLI
+        if: env.USE_DEPOT == 'true'
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
+
      - name: Set up Docker Buildx
+        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
@@ -241,7 +254,22 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push PR-specific image
+      - name: Build and push PR-specific image (Depot)
+        if: env.USE_DEPOT == 'true'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
+          build-args: |
+            VERSION_TAG=alpha
+            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
+          platforms: linux/amd64
+
+      - name: Build and push PR-specific image (Docker fork fallback)
+        if: env.USE_DEPOT != 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -255,8 +283,19 @@ jobs:
            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
          platforms: linux/amd64

-      - name: Build and push engine image
-        if: needs.check-comment.outputs.enable_prototypes == 'true'
+      - name: Build and push engine image (Depot)
+        if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: ./engine
+          file: ./engine/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          platforms: linux/amd64
+
+      - name: Build and push engine image (Docker fork fallback)
+        if: env.USE_DEPOT != 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: ./engine
@@ -471,10 +510,11 @@ jobs:

  handle-label-commands:
    if: ${{ github.event.issue.pull_request != null }}
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -0,0 +1,70 @@
+name: _runner-pick
+
+# Tiny reusable workflow that classifies the trigger as either a "fork PR
+# from an untrusted contributor" or a "trusted commit" so downstream jobs
+# can pick a runner class without each one duplicating the 200-char gate
+# expression in their own `runs-on:`.
+#
+# Caller pattern:
+#
+#   jobs:
+#     pick:
+#       uses: ./.github/workflows/_runner-pick.yml
+#
+#     real-work:
+#       needs: pick
+#       runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
+#       steps: [...]
+#
+# Output:
+#   is_fork: "true" when the trigger is a pull_request from a fork or an
+#            untrusted author_association, "false" otherwise.
+
+on:
+  workflow_call:
+    outputs:
+      is_fork:
+        description: '"true" if the trigger is an untrusted fork PR.'
+        value: ${{ jobs.pick.outputs.is_fork }}
+
+permissions:
+  contents: read
+
+jobs:
+  pick:
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    outputs:
+      is_fork: ${{ steps.decide.outputs.is_fork }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Classify the trigger
+        id: decide
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_REPO_FORK: ${{ github.event.pull_request.head.repo.fork }}
+          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
+        run: |
+          set -eu
+          if [ -z "${PR_NUMBER:-}" ]; then
+            # Not a pull_request event at all (push, schedule, workflow_dispatch,
+            # workflow_call from a non-PR trigger) -> trusted by default.
+            echo "is_fork=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if [ "${HEAD_REPO_FORK}" = "true" ]; then
+            echo "is_fork=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          case "${AUTHOR_ASSOC}" in
+            OWNER|MEMBER|COLLABORATOR)
+              echo "is_fork=false" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "is_fork=true" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
@@ -17,14 +17,16 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
@@ -19,7 +19,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
+        uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -26,7 +26,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -70,12 +70,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Update stirling-pdf-desktop PKGBUILD
        env:
@@ -106,7 +106,7 @@ jobs:

      - name: Publish stirling-pdf-desktop to AUR
        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
+        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
        with:
          pkgname: stirling-pdf-desktop
          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
@@ -16,7 +16,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -1,7 +1,7 @@
 name: Backend build, format check, and coverage

-# Reusable workflow called from build.yml. Runs the full backend build matrix
-# (JDK 21/25 × spring-security on/off), Spotless formatting check, JUnit, and
+# Reusable workflow called from build.yml. Runs the backend build matrix
+# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
 on:
  workflow_call:
@@ -13,16 +13,22 @@ permissions:
  pull-requests: write

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  build:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    strategy:
      fail-fast: false
      matrix:
-        jdk-version: [21, 25]
+        jdk-version: [25]
        spring-security: [true, false]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -35,7 +41,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/wrapper
@@ -17,11 +17,23 @@ name: Enterprise E2E (Playwright)

 on:
  workflow_call:
+    inputs:
+      depot_cores:
+        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
+        required: false
+        type: string
+        default: "8"
  push:
    branches: ["main"]
  schedule:
    - cron: "0 4 * * *"
  workflow_dispatch:
+    inputs:
+      depot_cores:
+        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
+        required: false
+        type: string
+        default: "8"

 # No `concurrency:` block here on purpose. When this workflow is called via
 # workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
@@ -35,16 +47,21 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  playwright-e2e-enterprise:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
    timeout-minutes: 45
    env:
      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
      PREMIUM_ENABLED: "true"
      SYSTEM_ENABLEANALYTICS: "false"
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -63,7 +80,15 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
+        run: task e2e:install -- chromium
+      - name: Build frontend (needed for playwright's vite preview webServer)
+        # Enterprise tests target :8080 (Spring Boot's bundled frontend), but
+        # playwright's webServer config still launches `vite preview --port 5173`
+        # before any test run, which needs dist/ to exist. VITE_BUILD_FOR_PREVIEW
+        # forces absolute asset paths so vite preview can serve deep SPA routes.
+        env:
+          VITE_BUILD_FOR_PREVIEW: "1"
+        run: task frontend:build

      - name: Resolve kubernetes.docker.internal to localhost
        # The compose stacks set KC_HOSTNAME=kubernetes.docker.internal so
@@ -140,7 +165,7 @@ jobs:
          wait_for_backend
      - name: Run enterprise OAuth Playwright tests
        id: oauth-tests
-        run: task frontend:test:e2e -- --project=enterprise --grep "OAuth"
+        run: task e2e:enterprise -- --grep "OAuth"
      - name: Stop backend + tear down OAuth Keycloak
        if: always()
        run: |
@@ -213,7 +238,7 @@ jobs:
          wait_for_backend
      - name: Run enterprise SAML Playwright tests
        id: saml-tests
-        run: task frontend:test:e2e -- --project=enterprise --grep "SAML"
+        run: task e2e:enterprise -- --grep "SAML"
      - name: Stop backend + tear down SAML Keycloak
        if: always()
        run: |
@@ -243,7 +268,7 @@ jobs:
          wait_for_backend
      - name: Run enterprise feature Playwright tests
        id: feature-tests
-        run: task frontend:test:e2e -- --project=enterprise --grep "Enterprise license"
+        run: task e2e:enterprise -- --grep "Enterprise license"
      - name: Print backend log on failure
        if: failure()
        run: |
@@ -260,5 +285,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/playwright-report/
+          path: frontend/editor/playwright-report/
          retention-days: 7
@@ -46,7 +46,7 @@ jobs:
      proprietary: ${{ steps.changes.outputs.proprietary }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -68,6 +68,18 @@ jobs:
    uses: ./.github/workflows/backend-build.yml
    secrets: inherit

+  db-migration-test:
+    # Boots the current bootJar against H2 fixtures captured from past
+    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
+    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
+    # the `project` filter so doc-only PRs skip this ~5-minute job.
+    if: needs.files-changed.outputs.project == 'true'
+    needs: [files-changed]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/db-migration-test.yml
+    secrets: inherit
+
  check-generateOpenApiDocs:
    if: needs.files-changed.outputs.openapi == 'true'
    needs: [files-changed]
@@ -135,6 +147,7 @@ jobs:
    permissions:
      contents: read
      packages: read
+      id-token: write
    uses: ./.github/workflows/test-build-docker.yml
    secrets: inherit
    with:
@@ -183,6 +196,7 @@ jobs:
    needs:
      - files-changed
      - build
+      - db-migration-test
      - check-generateOpenApiDocs
      - frontend-validation
      - playwright-e2e
@@ -197,11 +211,17 @@ jobs:
      - dependency-review
    runs-on: ubuntu-latest
    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
      - name: Verify every required job passed (or was legitimately skipped)
        env:
          RESULTS: |
            files-changed=${{ needs.files-changed.result }}
            build=${{ needs.build.result }}
+            db-migration-test=${{ needs.db-migration-test.result }}
            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
            frontend-validation=${{ needs.frontend-validation.result }}
            playwright-e2e=${{ needs.playwright-e2e.result }}
@@ -11,9 +11,11 @@ permissions:
 jobs:
  check-licence:
    runs-on: ubuntu-latest
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -27,7 +29,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/wrapper
@@ -10,11 +10,17 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  check-generate-openapi-docs:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -28,7 +34,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/wrapper
@@ -6,7 +6,7 @@ on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
-      - "frontend/public/locales/*/translation.toml"
+      - "frontend/editor/public/locales/*/translation.toml"
      - ".github/scripts/check_language_toml.py"
      - ".github/workflows/check_toml.yml"

@@ -27,7 +27,7 @@ jobs:
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -76,7 +76,7 @@ jobs:
            exit 1
          fi
          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
@@ -166,12 +166,12 @@ jobs:

            // Determine reference file
            let referenceFilePath;
-            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
+            if (changedFiles.includes("frontend/editor/public/locales/en-GB/translation.toml")) {
              console.log("Using PR branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "frontend/editor/public/locales/en-GB/translation.toml",
                ref: branch,
              });

@@ -183,7 +183,7 @@ jobs:
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: repoOwner,
                repo: repoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "frontend/editor/public/locales/en-GB/translation.toml",
                ref: "main",
              });

@@ -0,0 +1,93 @@
+name: DB migration smoke test
+
+# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
+# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
+# Catches schema changes that would break existing user databases under
+# Hibernate's `ddl-auto=update` upgrade path.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
+  migration-test:
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
+    timeout-minutes: 30
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: 25
+          distribution: temurin
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      # No `-PnoSpotless` here yet because the upstream cache layer matches the
+      # backend build's; reuse keeps cold-cache cost identical.
+      - name: Build Stirling-PDF JAR
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
+
+      - name: Locate built JAR
+        id: jar
+        run: |
+          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
+              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
+          if [[ -z "$jar" ]]; then
+            echo "::error::No JAR under app/core/build/libs"
+            ls -lah app/core/build/libs || true
+            exit 1
+          fi
+          # Absolute path - the migration script pushd's into a temp workdir
+          # before invoking java, which would dangle a relative path.
+          jar=$(realpath "$jar")
+          echo "path=$jar" >> "$GITHUB_OUTPUT"
+          echo "Built JAR: $jar"
+
+      - name: Run migration smoke test
+        env:
+          STIRLING_JAR: ${{ steps.jar.outputs.path }}
+        run: bash scripts/db-migration/run-migration-test.sh
+
+      - name: Upload app logs on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: db-migration-app-logs
+          # Path matches the preserved workdir in run-migration-test.sh -
+          # only failing fixtures leave a directory behind.
+          path: /tmp/stirling-migration-failed-*/app.log
+          retention-days: 7
+          if-no-files-found: warn
@@ -14,13 +14,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

      - name: "Checkout Repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Dependency Review"
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          config-file: "./.github/config/dependency-review-config.yml"
@@ -10,22 +10,37 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  deploy-v2-on-push:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    concurrency:
      group: deploy-v2-push-V2
      cancel-in-progress: true
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

+      - name: Set up Depot CLI
+        if: env.USE_DEPOT == 'true'
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
+
      - name: Set up Docker Buildx
+        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get commit hashes for frontend and backend
@@ -90,8 +105,22 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push frontend image
-        if: steps.check-frontend.outputs.exists == 'false'
+      - name: Build and push frontend image (Depot)
+        if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./docker/frontend/Dockerfile
+          push: true
+          tags: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push frontend image (Docker fork fallback)
+        if: env.USE_DEPOT != 'true' && steps.check-frontend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -105,8 +134,22 @@ jobs:
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

-      - name: Build and push backend image
-        if: steps.check-backend.outputs.exists == 'false'
+      - name: Build and push backend image (Depot)
+        if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./docker/backend/Dockerfile
+          push: true
+          tags: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push backend image (Docker fork fallback)
+        if: env.USE_DEPOT != 'true' && steps.check-backend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -11,21 +11,32 @@ on:
        required: false
        type: string
        default: "false"
+      depot_cores:
+        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 4 because bench showed 16 was within noise of 4."
+        required: false
+        type: string
+        default: "4"

 permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  docker-compose-tests:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') }}
    permissions:
      actions: write
      contents: read
      checks: write
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -39,7 +50,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/wrapper
@@ -5,17 +5,27 @@ name: Playwright E2E (live backend)
 # server.
 on:
  workflow_call:
+    inputs:
+      depot_cores:
+        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
+        required: false
+        type: string
+        default: "8"

 permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  playwright-e2e-live:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
    timeout-minutes: 30
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -34,63 +44,31 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
-      - name: Start Spring Boot backend (background)
+        run: task e2e:install -- chromium
+      - name: Build frontend (production bundle for vite preview)
        env:
-          # Suppress the analytics opt-in modal that fires on first admin login when
-          # enableAnalytics is null (see Onboarding.tsx). The modal renders a Mantine
-          # overlay that intercepts pointer events on every tool page until dismissed,
-          # which causes every "click run button" assertion in the live suite to fail.
-          SYSTEM_ENABLEANALYTICS: "false"
-        # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
-        # The live-setup project's bootstrap spec performs the real first-login
-        # flow against the backend's default admin/stirling user, exercising the
-        # forced-password-change UI and leaving the DB at admin/adminadmin for
-        # the rest of the live suite. This is both real coverage of the first-
-        # login flow and a stronger seed than env-var-driven user creation.
-        run: |
-          nohup ./gradlew :stirling-pdf:bootRun > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-      - name: Wait for backend to become ready
-        run: |
-          start=$SECONDS
-          # 300 iterations × 2s = 10 minute ceiling
-          for i in $(seq 1 300); do
-            if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then
-              echo "Backend up after $((SECONDS - start))s"
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "Backend did not become ready in $((SECONDS - start))s"
-          tail -200 /tmp/backend.log || true
-          exit 1
+          VITE_BUILD_FOR_PREVIEW: "1"
+        run: task frontend:build
      - name: Run live E2E tests (chromium)
        id: live-tests
-        run: task frontend:test:e2e -- --project=live
+        run: task e2e:live
      - name: Print backend log on failure
        if: failure() && steps.live-tests.conclusion == 'failure'
        run: |
          echo "::group::Spring Boot backend log (last 500 lines)"
-          tail -500 /tmp/backend.log || echo "no backend log found"
+          tail -500 .test-state/playwright/backend.log || echo "no backend log found"
          echo "::endgroup::"
-      - name: Stop backend
-        if: always()
-        run: |
-          if [ -f /tmp/backend.pid ]; then
-            kill "$(cat /tmp/backend.pid)" 2>/dev/null || true
-          fi
      - name: Upload backend log
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: backend-log-live-${{ github.run_id }}
-          path: /tmp/backend.log
+          path: .test-state/playwright/backend.log
          retention-days: 7
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-live-${{ github.run_id }}
-          path: frontend/playwright-report/
+          path: frontend/editor/playwright-report/
          retention-days: 7
@@ -5,16 +5,26 @@ name: Playwright E2E (stubbed)
 # mocks API responses in the browser.
 on:
  workflow_call:
+    inputs:
+      depot_cores:
+        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 8 to match the other playwright workflows; bench showed flat scaling above 8."
+        required: false
+        type: string
+        default: "8"

 permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  playwright-e2e:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -28,13 +38,17 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: task frontend:test:e2e:install -- chromium
+        run: task e2e:install -- chromium
+      - name: Build frontend (production bundle for vite preview)
+        env:
+          VITE_BUILD_FOR_PREVIEW: "1"
+        run: task frontend:build
      - name: Run stubbed E2E tests (chromium)
-        run: task frontend:test:e2e -- --project=stubbed --workers=3
+        run: task e2e:stubbed -- --workers=3
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/playwright-report/
+          path: frontend/editor/playwright-report/
          retention-days: 7
@@ -19,16 +19,20 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  files-changed:
    name: detect what files changed
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    timeout-minutes: 3
    outputs:
      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -44,15 +48,15 @@ jobs:
  generate-frontend-license-report:
    if: needs.files-changed.outputs.licenses-frontend == 'true'
    name: Generate Frontend License Report
-    needs: files-changed
-    runs-on: ubuntu-latest
+    needs: [pick, files-changed]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -114,23 +118,23 @@ jobs:
        env:
          PR_IS_FORK: "true"
        run: |
-          node base/frontend/scripts/generate-licenses.js \
-            --input frontend/src/assets/3rdPartyLicenses.json
+          node base/frontend/editor/scripts/generate-licenses.js \
+            --input frontend/editor/src/assets/3rdPartyLicenses.json

      - name: Copy postprocessed artifacts back (fork PRs)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        run: |
-          mkdir -p frontend/src/assets
-          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
+          mkdir -p frontend/editor/src/assets
+          if [ -f "base/frontend/editor/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/editor/src/assets/3rdPartyLicenses.json frontend/editor/src/assets/3rdPartyLicenses.json
          fi
-          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
-            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
+          if [ -f "base/frontend/editor/src/assets/license-warnings.json" ]; then
+            cp base/frontend/editor/src/assets/license-warnings.json frontend/editor/src/assets/license-warnings.json
          fi

      - name: Check for license warnings
        run: |
-          if [ -f "frontend/src/assets/license-warnings.json" ]; then
+          if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
          else
            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
@@ -178,10 +182,10 @@ jobs:
            echo ""
            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/src/assets/license-warnings.json" ]; then
+              if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
                echo ""
                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
+                jq -r '.warnings[] | "- \(.message)"' frontend/editor/src/assets/license-warnings.json || true
              fi
            else
              echo "✅ **Passed** – no license warnings detected."
@@ -207,7 +211,7 @@ jobs:
              const fs = require('fs');
              let warningDetails = '';
              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
+                const warnings = JSON.parse(fs.readFileSync('frontend/editor/src/assets/license-warnings.json', 'utf8'));
                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
              } catch (e) {
                warningDetails = 'Unable to read warning details';
@@ -247,7 +251,7 @@ jobs:
      - name: Commit changes (Push only)
        if: github.event_name == 'push'
        run: |
-          git add frontend/src/assets/3rdPartyLicenses.json
+          git add frontend/editor/src/assets/3rdPartyLicenses.json
          # Note: Do NOT commit license-warnings.json - it's only for PR review
          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV

@@ -265,7 +269,7 @@ jobs:

          The following licenses may require review for corporate compatibility:

-          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
+          $(cat frontend/editor/src/assets/license-warnings.json | jq -r '.warnings[].message')

          Please review these licenses to ensure they are acceptable for your use case."
          fi
@@ -307,16 +311,18 @@ jobs:

  generate-backend-license-report:
    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: files-changed
+    needs: [pick, files-changed]
    name: Generate Backend License Report
-    runs-on: ubuntu-latest
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -11,11 +11,15 @@ permissions:
  pull-requests: write

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  frontend-validation:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -85,9 +89,29 @@ jobs:
          echo "to see what still needs fixing manually."
          echo "============================================"
          exit 1
+      - name: Remove frontend check comment on success
+        if: steps.frontend-check.outcome == 'success' && github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const marker = '<!-- frontend-check -->';
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.deleteComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+              });
+            }
      - name: Upload frontend build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-build
-          path: frontend/dist/
+          path: frontend/editor/dist/
          retention-days: 3
@@ -15,7 +15,7 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -36,15 +36,19 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  determine-matrix:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -57,7 +61,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/caches
@@ -90,26 +94,28 @@ jobs:
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            case "${{ github.event.inputs.platform }}" in
              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}]}' >> $GITHUB_OUTPUT
                ;;
              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}]}' >> $GITHUB_OUTPUT
                ;;
              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
                ;;
              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
                ;;
            esac
          else
            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
          fi

  build-jars:
-    needs: determine-matrix
-    runs-on: ubuntu-latest
+    needs: [pick, determine-matrix]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    strategy:
      matrix:
        variant:
@@ -127,7 +133,7 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -189,9 +195,10 @@ jobs:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit
          allowed-endpoints: >
@@ -218,7 +225,23 @@ jobs:
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      # x86_64 JDK is set up first so the aarch64 step below can leave its
+      # JAVA_HOME as the active one. The macOS universal JRE build needs
+      # jmods from both arches; the x64 path is captured into the env
+      # before the second setup-java overwrites JAVA_HOME.
+      - name: Set up x86_64 JDK 25 (macOS universal JRE)
+        if: matrix.platform == 'macos-15'
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+          architecture: "x64"
+
+      - name: Capture x86_64 JAVA_HOME
+        if: matrix.platform == 'macos-15'
+        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -234,13 +257,23 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

+      # Build the universal JRE before desktop:prepare so the jlink:runtime
+      # task short-circuits on its `test -d runtime/jre` status check.
+      - name: Build universal macOS JRE
+        if: matrix.platform == 'macos-15'
+        env:
+          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
+          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
+        run: task desktop:jlink:universal-mac
+
      - name: Prepare desktop build
-        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
+          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
+        run: task desktop:prepare

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
@@ -321,7 +354,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -342,7 +375,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -394,7 +427,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -407,7 +440,11 @@ jobs:
          }
          EOF
          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json
+          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
+
+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh

      - name: Import release GPG signing key (Linux)
        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -455,7 +492,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend
+          projectPath: ./frontend/editor
          tauriScript: npx tauri
          args: ${{ matrix.args }}

@@ -481,7 +518,7 @@ jobs:
          $allSigned = $true

          # Check MSI installer (outer wrapper - what users download)
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $msiFiles = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*.msi" -Recurse -File
          if ($msiFiles.Count -eq 0) {
            Write-Host "[ERROR] No MSI found under target/"
            exit 1
@@ -549,21 +586,23 @@ jobs:
        if: always() && steps.digicert-setup.conclusion != 'failure'
        shell: bash
        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
+          # Absolute dist path so the cd below can't break the copy targets.
+          DIST="$GITHUB_WORKSPACE/dist"
+          mkdir -p "$DIST"
+          cd ./frontend/editor/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
            # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "$DIST/Stirling-PDF-${{ matrix.name }}.app" \;
          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
@@ -576,13 +615,13 @@ jobs:

  create-release:
    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-    needs: [determine-matrix, build, build-jars]
-    runs-on: ubuntu-latest
+    needs: [pick, determine-matrix, build, build-jars]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    permissions:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -614,7 +653,7 @@ jobs:
        run: ls -R ./artifacts

      - name: Upload binaries to Release
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
@@ -13,12 +13,16 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  playwright-all-browsers:
    name: Playwright (chromium + firefox + webkit)
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -35,15 +39,15 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install all Playwright browsers
-        run: task frontend:test:e2e:install
+        run: task e2e:install

      - name: Run E2E tests (all browsers)
-        run: task frontend:test:e2e
+        run: task e2e:cross-browser

      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/playwright-report/
+          path: frontend/editor/playwright-report/
          retention-days: 14
@@ -2,7 +2,7 @@ name: Update Package Manager Manifests

 on:
  release:
-    types: [ released ]
+    types: [released]
  workflow_dispatch:
    inputs:
      version:
@@ -22,14 +22,13 @@ jobs:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.info.outputs.version }}
-      dmg_arm64_sha256: ${{ steps.hashes.outputs.dmg_arm64_sha256 }}
-      dmg_x86_64_sha256: ${{ steps.hashes.outputs.dmg_x86_64_sha256 }}
+      dmg_sha256: ${{ steps.hashes.outputs.dmg_sha256 }}
      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -63,17 +62,15 @@ jobs:
            sha256sum "$file" | awk '{print $1}'
          }

-          DMG_ARM64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-aarch64.dmg")
-          DMG_X64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-x86_64.dmg")
+          DMG_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-universal.dmg")
          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")

-          echo "dmg_arm64_sha256=$DMG_ARM64_SHA" >> "$GITHUB_OUTPUT"
-          echo "dmg_x86_64_sha256=$DMG_X64_SHA"  >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA"              >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA"              >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA"              >> "$GITHUB_OUTPUT"
+          echo "dmg_sha256=$DMG_SHA" >> "$GITHUB_OUTPUT"
+          echo "msi_sha256=$MSI_SHA" >> "$GITHUB_OUTPUT"
+          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
+          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"

  update-homebrew-and-scoop:
    needs: get-release-info
@@ -82,33 +79,32 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: Stirling-Tools/homebrew-stirling-pdf
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap

+      # Stirling-PDF now ships a single universal DMG, so the Cask should
+      # have one sha256 line rather than separate on_arm/on_intel blocks.
+      # We rewrite every `sha256 "..."` in the Cask to the same value so
+      # the workflow keeps working through the Cask migration: pre-migration
+      # both arch blocks get the universal SHA (still correct, since both
+      # would resolve to the same DMG), post-migration the lone sha256 line
+      # is updated.
      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
        env:
          VERSION: ${{ needs.get-release-info.outputs.version }}
-          ARM64_SHA: ${{ needs.get-release-info.outputs.dmg_arm64_sha256 }}
-          X64_SHA: ${{ needs.get-release-info.outputs.dmg_x86_64_sha256 }}
+          DMG_SHA: ${{ needs.get-release-info.outputs.dmg_sha256 }}
        run: |
          CASK="tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$CASK"
-          awk -v arm="$ARM64_SHA" -v x64="$X64_SHA" '
-            /on_arm/     { in_arm=1 }
-            /on_intel/   { in_arm=0; in_intel=1 }
-            /end/        { in_arm=0; in_intel=0 }
-            in_arm  && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" arm "\"") }
-            in_intel && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" x64 "\"") }
-            { print }
-          ' "$CASK" > tmp && mv tmp "$CASK"
+          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$CASK"
+          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${DMG_SHA}\"/g" "$CASK"

      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
        env:
@@ -116,8 +112,8 @@ jobs:
          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
        run: |
          FORMULA="tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \".*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
+          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$FORMULA"
+          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"

      - name: Update Scoop stirling-pdf.json
        env:
@@ -19,7 +19,7 @@ jobs:
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -43,7 +43,7 @@ jobs:
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -100,7 +100,7 @@ jobs:
          sbom: true

      - name: Install cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"

@@ -2,6 +2,22 @@ name: Push Docker Image with VersionNumber

 on:
  workflow_dispatch:
+    inputs:
+      build_main_app:
+        description: "Build & push the main Stirling-PDF image (latest, fat, ultra-lite)."
+        required: false
+        type: boolean
+        default: true
+      build_unoserver:
+        description: "Build & push the standalone stirling-unoserver image."
+        required: false
+        type: boolean
+        default: true
+      force_unoserver_rebuild:
+        description: "Rebuild stirling-unoserver even if its source hash is unchanged."
+        required: false
+        type: boolean
+        default: false
  push:
    branches:
      - master
@@ -31,9 +47,13 @@ jobs:
    permissions:
      packages: write
      id-token: write
+    # On push events these stay 'true'; on workflow_dispatch they follow the inputs.
+    env:
+      RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
+      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -46,7 +66,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependencies
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/caches
@@ -76,13 +96,13 @@ jobs:

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"

@@ -108,6 +128,7 @@ jobs:

      - name: Generate tags for latest
        id: meta
+        if: env.RUN_MAIN_APP == 'true'
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
@@ -122,6 +143,8 @@ jobs:

      - name: Build and push Unified Dockerfile (latest variant)
        id: build-push-latest
+        # Empty-tag guard: build-push-action errors when asked to push with no tags.
+        if: env.RUN_MAIN_APP == 'true' && steps.meta.outputs.tags != ''
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -140,7 +163,7 @@ jobs:
          sbom: true

      - name: Sign regular images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
        env:
          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
@@ -156,7 +179,7 @@ jobs:
      - name: Generate tags for latest-fat
        id: meta-fat
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -170,7 +193,7 @@ jobs:
      - name: Build and push Unified Dockerfile (fat variant)
        id: build-push-fat
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-fat.outputs.tags != ''
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -186,7 +209,7 @@ jobs:
          sbom: true

      - name: Sign fat images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
        env:
          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
          TAGS: ${{ steps.meta-fat.outputs.tags }}
@@ -200,7 +223,7 @@ jobs:
      - name: Generate tags for ultra-lite
        id: meta-lite
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -214,7 +237,7 @@ jobs:
      - name: Build and push Unified Dockerfile (ultra-lite variant)
        id: build-push-lite
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-lite.outputs.tags != ''
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -230,7 +253,7 @@ jobs:
          sbom: true

      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
        env:
          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
          TAGS: ${{ steps.meta-lite.outputs.tags }}
@@ -240,3 +263,136 @@ jobs:
          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
          done
+
+      # Standalone unoserver image — versioned independently via
+      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
+      # only when the version is new. main/testMain: republish :alpha only
+      # when the source hash differs from the published image's annotation.
+      - name: Read unoserver image version
+        id: unoserverVersion
+        if: env.RUN_UNOSERVER == 'true'
+        run: |
+          version=$(tr -d '[:space:]' < docker/unoserver/VERSION)
+          if [ -z "$version" ]; then
+            echo "docker/unoserver/VERSION is empty"; exit 1
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "Unoserver image version (from file): ${version}"
+
+      - name: Compute unoserver image source hash
+        id: unoserverHash
+        if: env.RUN_UNOSERVER == 'true'
+        run: |
+          set -eu
+          hash=$(cat \
+            docker/unoserver/Dockerfile \
+            docker/unoserver/entrypoint.sh \
+            docker/unoserver/healthcheck.sh \
+            docker/unoserver/VERSION \
+            | sha256sum | cut -d' ' -f1)
+          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
+          echo "Unoserver source hash: ${hash}"
+
+      - name: Decide whether to publish unoserver image
+        id: unoserverDecision
+        if: env.RUN_UNOSERVER == 'true'
+        env:
+          UNOSERVER_VERSION: ${{ steps.unoserverVersion.outputs.version }}
+          UNOSERVER_HASH: ${{ steps.unoserverHash.outputs.hash }}
+          UNOSERVER_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-unoserver
+          UNOSERVER_HASH_ANNOTATION: org.stirlingpdf.unoserver-source-hash
+          FORCE_REBUILD: ${{ inputs.force_unoserver_rebuild }}
+          GH_REF: ${{ github.ref }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -eu
+          mode="skip"
+          tags=""
+
+          read_published_hash() {
+            local ref="$1"
+            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
+              | jq -r --arg key "$UNOSERVER_HASH_ANNOTATION" \
+                  '.annotations[$key] // empty' \
+              2>/dev/null || true
+          }
+
+          # Manual dispatch from any branch routes to the :alpha publish path.
+          EFFECTIVE_REF="$GH_REF"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            EFFECTIVE_REF="refs/heads/testMain"
+          fi
+
+          case "$EFFECTIVE_REF" in
+            refs/heads/master|refs/heads/V2-master)
+              if [ "${FORCE_REBUILD}" = "true" ]; then
+                echo "force_unoserver_rebuild=true — building stable regardless"
+                mode="stable"
+                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
+              elif docker manifest inspect "${UNOSERVER_IMAGE}:${UNOSERVER_VERSION}" >/dev/null 2>&1; then
+                echo "stirling-unoserver:${UNOSERVER_VERSION} already on GHCR — skipping"
+              else
+                echo "stirling-unoserver:${UNOSERVER_VERSION} is new — will publish"
+                mode="stable"
+                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
+              fi
+              ;;
+            refs/heads/main|refs/heads/testMain)
+              published_hash=$(read_published_hash "${UNOSERVER_IMAGE}:alpha")
+              if [ "${FORCE_REBUILD}" = "true" ]; then
+                echo "force_unoserver_rebuild=true — rebuilding :alpha regardless"
+                mode="alpha"
+                tags="${UNOSERVER_IMAGE}:alpha"
+              elif [ -n "$published_hash" ] && [ "$published_hash" = "$UNOSERVER_HASH" ]; then
+                echo "Published :alpha source hash matches (${published_hash}) — skipping"
+              else
+                if [ -z "$published_hash" ]; then
+                  echo ":alpha has no source-hash annotation (first publish or pre-tracking image) — will publish"
+                else
+                  echo "Source hash changed (was ${published_hash}, now ${UNOSERVER_HASH}) — will publish"
+                fi
+                mode="alpha"
+                tags="${UNOSERVER_IMAGE}:alpha"
+              fi
+              ;;
+            *)
+              echo "Branch ${GH_REF} does not publish unoserver image"
+              ;;
+          esac
+          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
+          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push unoserver image
+        id: build-push-unoserver
+        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode != 'skip'
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/unoserver/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-unoserver
+          cache-to: type=gha,mode=max,scope=stirling-unoserver
+          tags: ${{ steps.unoserverDecision.outputs.tags }}
+          # Manifest annotation read by the decision step above to detect drift.
+          annotations: |
+            index:org.stirlingpdf.unoserver-source-hash=${{ steps.unoserverHash.outputs.hash }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign unoserver image
+        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode == 'stable'
+        env:
+          DIGEST: ${{ steps.build-push-unoserver.outputs.digest }}
+          TAGS: ${{ steps.unoserverDecision.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
+            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+            done
+          else
+            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
+          fi
@@ -18,7 +18,7 @@ jobs:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -35,7 +35,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.5
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.29.5
        with:
          sarif_file: results.sarif
@@ -17,7 +17,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -22,12 +22,18 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    env:
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -11,7 +11,7 @@ on:
      - "app/core/build.gradle"
      - "app/proprietary/build.gradle"
      - "README.md"
-      - "frontend/public/locales/*/translation.toml"
+      - "frontend/editor/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
      - "scripts/ignore_translation.toml"

@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -62,7 +62,7 @@ jobs:

      - name: Sync translation TOML files
        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-GB/translation.toml" --branch main

      - name: pre-commit run
        run: |
@@ -70,7 +70,7 @@ jobs:

      - name: Commit translation files
        run: |
-          git add frontend/public/locales/*/translation.toml
+          git add frontend/editor/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

      - name: Sync README.md
@@ -100,7 +100,7 @@ jobs:
            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:

            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
+            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
            - Ensured consistency and synchronization across all supported language files.
            - Highlighted any missing or incomplete translations.
            - **Format**: TOML
@@ -125,5 +125,5 @@ jobs:
          sign-commits: true
          add-paths: |
            README.md
-            frontend/public/locales/*/translation.toml
+            frontend/editor/public/locales/*/translation.toml
            scripts/ignore_translation.toml
@@ -1,9 +1,13 @@
 name: Build Tauri Applications

-# Multi-OS Tauri desktop bundle build matrix (Windows / macOS arm+intel /
+# Multi-OS Tauri desktop bundle build matrix (Windows / macOS universal /
 # Linux). Called from build.yml on PRs that touch desktop sources (gated
 # via the `tauri` filter in .github/config/.files.yaml). Also runnable
 # on demand via workflow_dispatch with a per-platform selector.
+#
+# Note: editing this file is itself enough to make the `tauri` path filter
+# match, which is how non-desktop PRs (e.g. backend-only fixes) opt into a
+# desktop smoke build.
 on:
  workflow_call:
    inputs:
@@ -37,7 +41,7 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -47,18 +51,15 @@ jobs:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          PLATFORM: ${{ inputs.platform }}
        run: |
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
-          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
-          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'
+          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
+          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
+          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'

-          # Resolve requested platform — populated by either workflow_dispatch
-          # or workflow_call inputs; both paths default to "all".
          case "$PLATFORM" in
            windows) ENTRIES=("$WINDOWS") ;;
-            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
+            macos)   ENTRIES=("$MACOS") ;;
            linux)   ENTRIES=("$LINUX") ;;
-            *)       ENTRIES=("$WINDOWS" "$MACOS_ARM" "$MACOS_INTEL" "$LINUX") ;;
+            *)       ENTRIES=("$WINDOWS" "$MACOS" "$LINUX") ;;
          esac

          # Drop macOS entries when Apple certificate secret is unavailable
@@ -85,9 +86,10 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -111,7 +113,19 @@ jobs:
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up x86_64 JDK 25 (macOS universal JRE)
+        if: matrix.platform == 'macos-15'
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+          architecture: "x64"
+
+      - name: Capture x86_64 JAVA_HOME
+        if: matrix.platform == 'macos-15'
+        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -126,13 +140,25 @@ jobs:

      - name: Setup Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+
+      - name: Build universal macOS JRE
+        if: matrix.platform == 'macos-15'
+        env:
+          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
+          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
+        run: task desktop:jlink:universal-mac
+
      - name: Prepare desktop build
-        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
+          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
+        run: task desktop:prepare
+
+      - name: Run Tauri/Cargo tests
+        run: task desktop:test

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
@@ -213,7 +239,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -234,7 +260,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -245,8 +271,12 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+
      - name: Check DMG creation dependencies (macOS only)
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        if: matrix.platform == 'macos-15'
        run: |
          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
@@ -275,7 +305,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -333,7 +363,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend
+          projectPath: ./frontend/editor
          tauriScript: npx tauri
          # Linux: build deb+rpm only here. AppImage runs in its own
          # continue-on-error step below so its persistent linuxdeploy
@@ -358,7 +388,7 @@ jobs:
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
          CI: true
        with:
-          projectPath: ./frontend
+          projectPath: ./frontend/editor
          tauriScript: npx tauri
          args: --bundles appimage

@@ -373,10 +403,10 @@ jobs:
          fi

      - name: Verify notarization (macOS only)
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        if: matrix.platform == 'macos-15'
        run: |
          echo "🔍 Verifying notarization status..."
-          cd ./frontend/src-tauri/target
+          cd ./frontend/editor/src-tauri/target
          DMG_FILE=$(find . -name "*.dmg" | head -1)
          if [ -n "$DMG_FILE" ]; then
            echo "Found DMG: $DMG_FILE"
@@ -390,20 +420,22 @@ jobs:
      - name: Rename artifacts
        shell: bash
        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
+          # Absolute dist path so the cd below can't break the copy targets.
+          DIST="$GITHUB_WORKSPACE/dist"
+          mkdir -p "$DIST"
+          cd ./frontend/editor/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
            # Only ship the MSI installer. The loose exe and WiX toolset exes
            # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      # Verify the MSI AND the inner exe extracted from it are signed.
@@ -481,7 +513,7 @@ jobs:
      - name: Verify build artifacts
        shell: bash
        run: |
-          cd ./frontend/src-tauri/target
+          cd ./frontend/editor/src-tauri/target

          # Check for expected artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
@@ -491,7 +523,7 @@ jobs:
              echo "❌ No Windows executable found"
              exit 1
            fi
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
            echo "Checking for macOS artifacts..."
            find . -name "*.dmg" | head -5
            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
@@ -512,7 +544,7 @@ jobs:
      - name: Test artifact sizes
        shell: bash
        run: |
-          cd ./frontend/src-tauri/target
+          cd ./frontend/editor/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
@@ -533,7 +565,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -556,8 +588,7 @@ jobs:
            // Map of expected artifact names to display info
            const artifactMap = {
              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
-              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
+              'Stirling-PDF-macos-universal': { icon: '🍎', platform: 'macOS Universal', files: '.dmg' },
              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
            };

@@ -625,7 +656,7 @@ jobs:
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -12,11 +12,19 @@ on:
        required: false
        type: string
        default: "false"
+      depot_cores:
+        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
+        required: false
+        type: string
+        default: "8"

 permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  # TODO: extract a pre-matrix `prepare` job that runs once and produces
  # shared artifacts for the three matrix entries below to consume:
  #   1. `task backend:build` — currently runs 3× in parallel with
@@ -32,7 +40,14 @@ jobs:
  # spring-security=true matrix entry if `task backend:build` and
  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
  test-build-docker-images:
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    strategy:
      fail-fast: false
      matrix:
@@ -48,7 +63,7 @@ jobs:
            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -80,7 +95,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/wrapper
@@ -105,10 +120,16 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true
          STIRLING_PDF_DESKTOP_UI: false

+      - name: Set up Depot CLI
+        if: env.USE_DEPOT == 'true'
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
+
      - name: Set up QEMU
+        if: env.USE_DEPOT != 'true'
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
+        if: env.USE_DEPOT != 'true'
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

@@ -134,7 +155,22 @@ jobs:
            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
          fi

-      - name: Build ${{ matrix.docker-rev }}
+      - name: Build ${{ matrix.docker-rev }} (Depot)
+        if: env.USE_DEPOT == 'true'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./${{ matrix.docker-rev }}
+          push: false
+          platforms: ${{ steps.build-params.outputs.platforms }}
+          build-args: |
+            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
+          provenance: true
+          sbom: true
+
+      - name: Build ${{ matrix.docker-rev }} (Docker fork fallback)
+        if: env.USE_DEPOT != 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -160,3 +196,86 @@ jobs:
            build/reports/problems/
          retention-days: 3
          if-no-files-found: warn
+
+  test-build-unoserver-image:
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Depot CLI
+        if: env.USE_DEPOT == 'true'
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
+
+      - name: Set up QEMU
+        if: env.USE_DEPOT != 'true'
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+
+      - name: Set up Docker Buildx
+        if: env.USE_DEPOT != 'true'
+        id: buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Build docker/unoserver/Dockerfile (Depot)
+        if: env.USE_DEPOT == 'true'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./docker/unoserver/Dockerfile
+          push: false
+          load: true
+          platforms: linux/amd64
+          tags: stirling-unoserver:pr-test
+          provenance: false
+          sbom: false
+
+      - name: Build docker/unoserver/Dockerfile (Docker fork fallback)
+        if: env.USE_DEPOT != 'true'
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/unoserver/Dockerfile
+          push: false
+          load: true
+          cache-from: type=gha,scope=stirling-unoserver
+          cache-to: type=gha,mode=max,scope=stirling-unoserver
+          platforms: linux/amd64
+          tags: stirling-unoserver:pr-test
+          provenance: false
+          sbom: false
+
+      - name: Smoke test the built image
+        run: |
+          set -eu
+          docker run -d --name unoserver-smoke \
+            -e UNOSERVER_RECYCLE_INTERVAL_SECONDS=0 \
+            stirling-unoserver:pr-test
+          deadline=$((SECONDS + 60))
+          while [ $SECONDS -lt $deadline ]; do
+            status=$(docker inspect -f '{{.State.Health.Status}}' unoserver-smoke 2>/dev/null || echo "starting")
+            if [ "$status" = "healthy" ]; then
+              echo "unoserver became healthy"
+              docker logs unoserver-smoke | tail -30
+              docker rm -f unoserver-smoke
+              exit 0
+            fi
+            sleep 3
+          done
+          echo "unoserver did not become healthy in time"
+          docker logs unoserver-smoke || true
+          docker rm -f unoserver-smoke || true
+          exit 1
@@ -20,12 +20,22 @@ permissions:
  contents: read

 jobs:
+  pick:
+    uses: ./.github/workflows/_runner-pick.yml
+
  deploy:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -51,7 +61,12 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

+      - name: Set up Depot CLI
+        if: env.USE_DEPOT == 'true'
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
+
      - name: Set up Docker Buildx
+        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -66,7 +81,20 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push test image
+      - name: Build and push test image (Depot)
+        if: env.USE_DEPOT == 'true'
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
+        with:
+          project: ${{ vars.DEPOT_PROJECT_ID }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64
+
+      - name: Build and push test image (Docker fork fallback)
+        if: env.USE_DEPOT != 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -125,13 +153,14 @@ jobs:
  files-changed:
    if: always()
    name: detect what files changed
-    runs-on: ubuntu-latest
+    needs: pick
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    timeout-minutes: 3
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -145,12 +174,11 @@ jobs:

  test:
    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [deploy, files-changed]
-    runs-on: ubuntu-latest
-
+    needs: [pick, deploy, files-changed]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -180,13 +208,13 @@ jobs:
          FORCE_COLOR: "3"

  cleanup:
-    needs: [deploy, test]
-    runs-on: ubuntu-latest
+    needs: [pick, deploy, test]
+    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
    if: always()

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
        with:
          egress-policy: audit

@@ -23,6 +23,10 @@ customFiles/
 configs/
 watchedFolders/
 clientWebUI/
+# Scratch dir used by local fixture-regeneration runs (see
+# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
+# Holds downloaded JARs and disposable workdirs. Never committed.
+.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
@@ -32,6 +36,7 @@ exampleYmlFiles/stirling/
 /testing/cucumber/junit/
 /testing/cucumber/report.html
 /testing/.failed_tests
+/.test-state/
 SwaggerDoc.json

 # Runtime storage for uploaded files and user data (not Java source code)
@@ -156,7 +161,7 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/src-tauri/provisioner/target
+frontend/editor/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -264,5 +269,14 @@ docs/type3/signatures/
 # Type3 sample PDFs (development only)
 **/type3/samples/

+**/application-dev-local.properties
+
 # Claude
 .claude/
+
+# Playwright MCP screenshots / traces
+.playwright-mcp/
+*.playwright-mcp.png
+
+# Local screenshot artifacts from *-screenshots.spec.ts
+frontend/screenshots/
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.11
+    rev: v0.15.14
    hooks:
      - id: ruff
        args:
@@ -20,7 +20,7 @@ repos:
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
-        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/editor/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.0
    hooks:
@@ -38,7 +38,7 @@ repos:
    rev: v0.24.4
    hooks:
      - id: toml-sort-fix
-        files: frontend/public/locales/.*\.toml$
+        files: frontend/editor/public/locales/.*\.toml$
        args: ['--in-place', '--all', '--ignore-case']
  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
  #   rev: v16.21.1
@@ -1,5 +1,20 @@
 version: '3'

+# Gradle invocation strategy:
+#   - Linux/macOS: `./gradlew` runs the POSIX shell wrapper natively.
+#   - Windows:     `cmd /c ".\gradlew.bat ..."` invokes the .bat wrapper through
+#                  cmd.exe so it inherits the user's Windows-side `JAVA_HOME`
+#                  and PATH. Routing through `bash gradlew` on Windows ends up
+#                  under WSL or Git-Bash, neither of which inherits
+#                  Adoptium/Temurin's default Windows-only Java env - gradlew
+#                  then errors with "JAVA_HOME is not set and no 'java' command
+#                  could be found".
+#
+#                  The entire `.\gradlew.bat ...` payload is double-quoted so
+#                  the leading `.\` survives mvdan/sh's POSIX backslash
+#                  stripping; cmd.exe also requires `.\` (not bare `gradlew.bat`)
+#                  because modern Windows excludes cwd from cmd's search path.
+
 tasks:
  dev:
    desc: "Start backend dev server"
@@ -10,15 +25,43 @@ tasks:
    env:
      SERVER_PORT: '{{.PORT}}'
    cmds:
-      - cmd: '{{if .AIENGINE_URL}}set "AIENGINE_URL={{.AIENGINE_URL}}" && set "AIENGINE_ENABLED=true" && {{end}}cmd /c gradlew.bat :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
        platforms: [windows]
      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
        platforms: [linux, darwin]

+  dev:bundled:
+    desc: "Clean + bootRun with frontend bundled into the backend (single :8080 server)"
+    ignore_error: true
+    cmds:
+      - cmd: cmd /c ".\gradlew.bat clean bootRun -PbuildWithFrontend=true"
+        platforms: [windows]
+      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
+        platforms: [linux, darwin]
+
+  dev:saas:
+    desc: "Start backend in SaaS flavor against Supabase"
+    # `dotenv:` reads from the root Taskfile's directory (".") because this
+    # subtaskfile is included with `dir: .`.
+    dotenv: ['app/.env.saas.local', 'app/.env.saas']
+    ignore_error: true
+    vars:
+      PORT: '{{.PORT | default "8080"}}'
+      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
+      PROFILES: '{{.PROFILES | default "dev"}}'
+    env:
+      SERVER_PORT: '{{.PORT}}'
+      STIRLING_FLAVOR: saas
+    cmds:
+      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
+        platforms: [windows]
+      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
+        platforms: [linux, darwin]
+
  build:
    desc: "Full backend build"
    cmds:
-      - cmd: cmd /c gradlew.bat clean build
+      - cmd: cmd /c ".\gradlew.bat clean build"
        platforms: [windows]
      - cmd: ./gradlew clean build
        platforms: [linux, darwin]
@@ -26,7 +69,7 @@ tasks:
  build:fast:
    desc: "Build without tests"
    cmds:
-      - cmd: cmd /c gradlew.bat clean build -x test
+      - cmd: cmd /c ".\gradlew.bat clean build -x test"
        platforms: [windows]
      - cmd: ./gradlew clean build -x test
        platforms: [linux, darwin]
@@ -34,7 +77,7 @@ tasks:
  build:ci:
    desc: "Build for CI (formatting checked separately)"
    cmds:
-      - cmd: cmd /c gradlew.bat build -PnoSpotless
+      - cmd: cmd /c ".\gradlew.bat build -PnoSpotless"
        platforms: [windows]
      - cmd: ./gradlew build -PnoSpotless
        platforms: [linux, darwin]
@@ -42,7 +85,7 @@ tasks:
  test:
    desc: "Run backend tests"
    cmds:
-      - cmd: cmd /c gradlew.bat test
+      - cmd: cmd /c ".\gradlew.bat test"
        platforms: [windows]
      - cmd: ./gradlew test
        platforms: [linux, darwin]
@@ -50,7 +93,7 @@ tasks:
  format:
    desc: "Auto-fix code formatting"
    cmds:
-      - cmd: cmd /c gradlew.bat spotlessApply
+      - cmd: cmd /c ".\gradlew.bat spotlessApply"
        platforms: [windows]
      - cmd: ./gradlew spotlessApply
        platforms: [linux, darwin]
@@ -58,7 +101,7 @@ tasks:
  format:check:
    desc: "Check code formatting"
    cmds:
-      - cmd: cmd /c gradlew.bat spotlessCheck
+      - cmd: cmd /c ".\gradlew.bat spotlessCheck"
        platforms: [windows]
      - cmd: ./gradlew spotlessCheck
        platforms: [linux, darwin]
@@ -71,7 +114,7 @@ tasks:
  swagger:
    desc: "Generate OpenAPI docs"
    cmds:
-      - cmd: cmd /c gradlew.bat :stirling-pdf:copySwaggerDoc
+      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
        platforms: [windows]
      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
        platforms: [linux, darwin]
@@ -92,7 +135,7 @@ tasks:
    desc: "Print project version"
    silent: true
    cmds:
-      - cmd: cmd /c gradlew.bat printVersion --quiet | tail -1
+      - cmd: cmd /c ".\gradlew.bat printVersion --quiet" | tail -1
        platforms: [windows]
      - cmd: ./gradlew printVersion --quiet | tail -1
        platforms: [linux, darwin]
@@ -100,7 +143,7 @@ tasks:
  licenses:check:
    desc: "Check dependency licenses"
    cmds:
-      - cmd: cmd /c gradlew.bat checkLicense --no-parallel
+      - cmd: cmd /c ".\gradlew.bat checkLicense --no-parallel"
        platforms: [windows]
      - cmd: ./gradlew checkLicense --no-parallel
        platforms: [linux, darwin]
@@ -108,7 +151,7 @@ tasks:
  licenses:generate:
    desc: "Check and generate dependency license report"
    cmds:
-      - cmd: cmd /c gradlew.bat checkLicense generateLicenseReport --no-parallel
+      - cmd: cmd /c ".\gradlew.bat checkLicense generateLicenseReport --no-parallel"
        platforms: [windows]
      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
        platforms: [linux, darwin]
@@ -116,7 +159,7 @@ tasks:
  clean:
    desc: "Clean build artifacts"
    cmds:
-      - cmd: cmd /c gradlew.bat clean
+      - cmd: cmd /c ".\gradlew.bat clean"
        platforms: [windows]
      - cmd: ./gradlew clean
        platforms: [linux, darwin]
@@ -3,6 +3,22 @@ version: '3'
 vars:
  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"

+  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
+  JPDFIUM_PLATFORMS:
+    sh: |
+      if [ -n "${JPDFIUM_PLATFORMS:-}" ]; then
+          echo "$JPDFIUM_PLATFORMS"
+      else
+          case "{{OS}}-{{ARCH}}" in
+              darwin-arm64)  echo "darwin-arm64";;
+              darwin-amd64)  echo "darwin-x64";;
+              linux-amd64)   echo "linux-x64";;
+              linux-arm64)   echo "linux-arm64";;
+              windows-amd64) echo "windows-x64";;
+              *)             echo "all";;
+          esac
+      fi
+
 tasks:
  prepare:
    desc: "Prepare desktop build dependencies"
@@ -15,6 +31,7 @@ tasks:
  provisioner:
    desc: "Build installer provisioner"
    platforms: [windows]
+    dir: editor
    cmds:
      - node scripts/build-provisioner.mjs

@@ -22,41 +39,55 @@ tasks:
    desc: "Start Tauri desktop dev mode"
    deps: [prepare]
    ignore_error: true
+    dir: editor
    cmds:
      - npx tauri dev --no-watch

  build:
    desc: "Build Tauri desktop app (production)"
    deps: [prepare]
+    dir: editor
    cmds:
      - npx tauri build

  build:dev:
    desc: "Build Tauri desktop app (dev, no bundling)"
    deps: [prepare]
+    dir: editor
    cmds:
      - npx tauri build --no-bundle

  build:dev:mac:
    desc: "Build Tauri desktop .app bundle (macOS)"
    deps: [prepare]
+    dir: editor
    cmds:
      - npx tauri build --bundles app

  build:dev:windows:
    desc: "Build Tauri desktop NSIS installer (Windows)"
    deps: [prepare]
+    dir: editor
    cmds:
      - npx tauri build --bundles nsis

  build:dev:linux:
    desc: "Build Tauri desktop AppImage (Linux)"
    deps: [prepare]
+    dir: editor
    cmds:
      - npx tauri build --bundles appimage

+  test:
+    desc: "Run Tauri/Cargo tests"
+    deps: [prepare]
+    dir: editor/src-tauri
+    cmds:
+      - cargo test
+
  clean:
    desc: "Clean Tauri/Cargo build artifacts"
+    dir: editor
    cmds:
      - task: jlink:clean
      - cd src-tauri && cargo clean
@@ -71,39 +102,58 @@ tasks:
    deps: [jlink:jar, jlink:runtime]

  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling"
+    desc: "Build backend JAR for Tauri bundling (host-OS natives only by default)"
    run: once
    dir: ..
    env:
      DISABLE_ADDITIONAL_FEATURES: "true"
    cmds:
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon
+      - echo "Building bootJar with JPDFium natives for {{.JPDFIUM_PLATFORMS}}"
+      - cmd: cmd /c gradlew.bat bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon
+      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
        platforms: [linux, darwin]
-      - mkdir -p frontend/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
+      - mkdir -p frontend/editor/src-tauri/libs
+      - cp app/core/build/libs/stirling-pdf-*.jar frontend/editor/src-tauri/libs/
    status:
-      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar
+      - test -f frontend/editor/src-tauri/libs/stirling-pdf-*.jar

  jlink:runtime:
    desc: "Create custom JRE with jlink"
    deps: [jlink:jar]
+    dir: editor/src-tauri
    cmds:
-      - rm -rf src-tauri/runtime/jre
-      - mkdir -p src-tauri/runtime
+      - rm -rf runtime/jre
+      - mkdir -p runtime
      - >-
        jlink
        --add-modules {{.JLINK_MODULES}}
        --strip-debug
-        --compress=2
+        --compress=zip-6
        --no-header-files
        --no-man-pages
-        --output src-tauri/runtime/jre
+        --output runtime/jre
    status:
-      - test -d src-tauri/runtime/jre
+      - test -d editor/src-tauri/runtime/jre

  jlink:clean:
    desc: "Remove JLink runtime and bundled JARs"
+    dir: editor/src-tauri
    cmds:
-      - rm -rf src-tauri/libs src-tauri/runtime
+      - rm -rf libs runtime
+
+  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
+  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
+  # jlink under Rosetta on Apple Silicon, so it is opt-in and not part of
+  # the default desktop:build flow. Requires AARCH64_JAVA_HOME and
+  # X64_JAVA_HOME to point at matching JDK installations with jmods/.
+  jlink:universal-mac:
+    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
+    deps: [jlink:jar]
+    platforms: [darwin]
+    dir: editor
+    env:
+      JLINK_MODULES: "{{.JLINK_MODULES}}"
+      OUTPUT_DIR: src-tauri/runtime/jre
+    cmds:
+      - scripts/build-universal-mac-jre.sh
@@ -55,3 +55,9 @@ tasks:
    desc: "Tail docker compose logs"
    cmds:
      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
+
+  test:
+    desc: "Run full Docker integration test suite (builds all variants and tests them)"
+    ignore_error: true
+    cmds:
+      - bash testing/test.sh {{.CLI_ARGS}}
@@ -0,0 +1,204 @@
+version: '3'
+
+tasks:
+  install:
+    desc: "Install Playwright browsers"
+    dir: frontend/editor
+    deps: [ ':frontend:install' ]
+    cmds:
+      - npx playwright install {{.CLI_ARGS}} --with-deps
+
+  stubbed:
+    desc: "Run stubbed E2E tests"
+    dir: frontend/editor
+    deps: [ ':frontend:prepare' ]
+    cmds:
+      - npx playwright test --project=stubbed {{.CLI_ARGS}}
+
+  live:
+    desc: "Run live E2E tests"
+    summary: |
+      Auto-spawns a Spring Boot backend with isolated state under
+      .test-state/playwright/ (purged on every run) so the suite doesn't
+      touch your local DB, settings.yml, backups or customFiles. The
+      backend is stopped automatically when the runner exits.
+
+      Pass extra Playwright flags via -- :
+        task e2e:live -- --headed --grep merge
+    deps:
+      - live:backend
+      - live:runner
+
+  live:backend:
+    internal: true
+    ignore_error: true
+    vars:
+      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
+    env:
+      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
+      # Suppress the analytics opt-in modal that fires on first admin login.
+      # It renders a Mantine overlay that intercepts pointer events and blocks
+      # FirstLoginSlide from rendering, so the bootstrap spec times out waiting
+      # for the password-change prompt.
+      SYSTEM_ENABLEANALYTICS: "false"
+      # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
+      # The live-setup project's bootstrap spec performs the real first-login
+      # flow against the backend's default admin/stirling user, exercising the
+      # forced-password-change UI and leaving the DB at admin/adminadmin for
+      # the rest of the live suite. This is both real coverage of the first-
+      # login flow and a stronger seed than env-var-driven user creation.
+    cmds:
+      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) doesn't
+      # support `&` + `$!` + `wait` reliably (gradle was never actually
+      # backgrounded, so `$!` recorded a stale PID and the runner saw an
+      # immediate "backend died"). Real bash backgrounds gradle properly and
+      # gives us a stable PID to clean up.
+      - |
+        bash -c '
+          set -e
+          rm -rf "{{.BASE_DIR}}"
+          mkdir -p "{{.BASE_DIR}}"
+          # Background gradle and record its PID so the runner can clean up
+          # the exact process tree (wrapper + forked Spring Boot JVM) without
+          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
+          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
+          # synchronised.
+          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
+          GRADLE_PID=$!
+          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
+          wait $GRADLE_PID
+        '
+
+  live:runner:
+    internal: true
+    deps: [ ':frontend:prepare' ]
+    dir: frontend/editor
+    vars:
+      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
+    cmds:
+      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) only
+      # supports `EXIT`/`ERR` in `trap`, not `INT`/`TERM`. CLI_ARGS are
+      # passed positionally so quoted args like --grep "foo bar" survive.
+      - |
+        bash -c '
+          set +e
+          # bootRun forks a separate Spring Boot JVM as a child of the gradle
+          # wrapper; killing only the wrapper leaves that JVM orphaned holding
+          # :8080. Walk the recorded PID'"'"'s process tree via pgrep so we kill
+          # every descendant, then lsof as a last-resort backstop.
+          kill_tree() {
+            local pid=$1
+            for child in $(pgrep -P "$pid" 2>/dev/null); do
+              kill_tree "$child"
+            done
+            kill "$pid" 2>/dev/null || true
+          }
+          cleanup() {
+            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
+              echo "Stopping backend..."
+              kill_tree "$(cat "{{.BASE_DIR}}/backend.pid")"
+              sleep 1
+              lsof -ti:8080 2>/dev/null | xargs kill 2>/dev/null || true
+              echo "Backend stopped"
+            fi
+          }
+          # Trap so cleanup runs on every exit path: tests pass, tests fail,
+          # backend never starts, user Ctrl-Cs. Without this the gradle JVM
+          # is left orphaned holding :8080 whenever the wait loop times out.
+          trap cleanup EXIT INT TERM
+
+          echo "Waiting for backend on :8080 (up to 10min; first compile can be slow)..."
+          WAITED=0
+          while [ $WAITED -lt 600 ]; do
+            if curl -sf http://localhost:8080/api/v1/info/status 2>/dev/null | grep -q UP; then
+              echo "Backend ready, starting Playwright"
+              break
+            fi
+            # Bail early if the backend already died: no point waiting 10min.
+            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
+              BACKEND_PID=$(cat "{{.BASE_DIR}}/backend.pid")
+              if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
+                echo "Backend process exited before becoming ready; last 100 log lines:"
+                tail -100 "{{.BASE_DIR}}/backend.log" 2>/dev/null || true
+                exit 1
+              fi
+            fi
+            sleep 2
+            WAITED=$((WAITED + 2))
+          done
+          if [ $WAITED -ge 600 ]; then
+            echo "Backend did not become ready within 10min, aborting"
+            exit 1
+          fi
+
+          npx playwright test --project=live "$@"
+        ' bash {{.CLI_ARGS}}
+
+  enterprise:
+    desc: "Run enterprise E2E tests"
+    summary: |
+      Requires an already-running keycloak compose stack on :8080. Bring one
+      up first with:
+        task e2e:oauth:up
+        task e2e:saml:up
+    dir: frontend/editor
+    deps: [ ':frontend:prepare' ]
+    cmds:
+      - npx playwright test --project=enterprise {{.CLI_ARGS}}
+
+  cross-browser:
+    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
+    dir: frontend/editor
+    deps: [ ':frontend:prepare' ]
+    cmds:
+      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
+
+  check:
+    desc: "Run all E2E tests not requiring Docker"
+    cmds:
+      - task: stubbed
+      - task: live
+
+  check:all:
+    desc: "Run all E2E tests"
+    summary: |
+      Includes the enterprise project, which requires a keycloak compose
+      stack on :8080. Bring one up first with:
+        task e2e:oauth:up
+        task e2e:saml:up
+    cmds:
+      - task: stubbed
+      - task: live
+      - task: enterprise
+
+  oauth:up:
+    desc: "Start the OAuth keycloak test environment"
+    summary: |
+      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
+        task e2e:oauth:up LICENSE_KEY=abc123
+      Pass extra flags via -- :
+        task e2e:oauth:up -- --auto --nobuild
+    ignore_error: true
+    cmds:
+      - bash testing/compose/start-oauth-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
+
+  oauth:down:
+    desc: "Stop the OAuth keycloak test environment"
+    cmds:
+      - docker compose -f testing/compose/docker-compose-keycloak-oauth.yml down -v
+
+  saml:up:
+    desc: "Start the SAML keycloak test environment"
+    summary: |
+      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
+        task e2e:saml:up LICENSE_KEY=abc123
+      Pass extra flags via -- :
+        task e2e:saml:up -- --auto --with-storage --nobuild --language sv-SE
+    ignore_error: true
+    cmds:
+      - bash testing/compose/start-saml-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
+
+  saml:down:
+    desc: "Stop the SAML keycloak test environment"
+    cmds:
+      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
@@ -86,8 +86,9 @@ tasks:
  fix:
    desc: "Auto-fix lint + format"
    cmds:
+      - task: format  # Can auto-fix some things that `lint:fix` can't like line length violations
      - task: lint:fix
-      - task: format
+      - task: format  # Ensure that after lint fixing that the code is still formatted correctly

  check:
    desc: "Full engine quality gate"
@@ -1,5 +1,10 @@
 version: '3'

+# Tasks operate from the workspace root (frontend/). Editor commands pass
+# `editor` as the vite project root (positional after `build` / before the
+# mode flag) or use `--project editor/...` for tsc — so the editor lives
+# under frontend/editor/ without each task needing a cd.
+
 tasks:
  install:
    desc: "Install dependencies"
@@ -21,19 +26,19 @@ tasks:
    vars:
      MODE: '{{.MODE | default ""}}'
    cmds:
-      - npx tsx scripts/setup-env.ts{{if .MODE}} --{{.MODE}}{{end}}
+      - npx tsx editor/scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
    sources:
-      - scripts/setup-env.ts
+      - editor/scripts/setup-env.mts
    generates:
-      - .env.local
-      - .env{{if .MODE}}.{{.MODE}}{{end}}.local
+      - editor/.env.local
+      - editor/.env{{if .MODE}}.{{.MODE}}{{end}}.local

  prepare:icons:
    internal: true
    run: once
    deps: [install]
    cmds:
-      - node scripts/generate-icons.js
+      - node editor/scripts/generate-icons.js

  prepare:
    desc: "Set up dev environment"
@@ -60,7 +65,7 @@ tasks:
    env:
      BACKEND_URL: '{{.BACKEND_URL}}'
    cmds:
-      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
+      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}

  dev:
    desc: "Start frontend dev server"
@@ -115,19 +120,19 @@ tasks:
    desc: "Production build (default mode)"
    deps: [prepare]
    cmds:
-      - npx vite build
+      - npx vite build editor

  build:core:
    desc: "Build for core mode"
    deps: [prepare]
    cmds:
-      - npx vite build --mode core
+      - npx vite build editor --mode core

  build:proprietary:
    desc: "Build for proprietary mode"
    deps: [prepare]
    cmds:
-      - npx vite build --mode proprietary
+      - npx vite build editor --mode proprietary

  build:saas:
    desc: "Build for SaaS mode"
@@ -135,7 +140,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx vite build --mode saas
+      - npx vite build editor --mode saas

  build:desktop:
    desc: "Build for desktop mode"
@@ -143,13 +148,13 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx vite build --mode desktop
+      - npx vite build editor --mode desktop

  build:prototypes:
    desc: "Build for prototypes mode"
    deps: [prepare]
    cmds:
-      - npx vite build --mode prototypes
+      - npx vite build editor --mode prototypes

  # ============================================================
  # Code quality
@@ -160,7 +165,7 @@ tasks:
    deps: [install]
    cmds:
      - npx eslint --max-warnings=0
-      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1
+      - npx dpdm editor/src --circular --no-warning --no-tree --exit-code circular:1

  lint:fix:
    desc: "Auto-fix lint issues"
@@ -195,13 +200,13 @@ tasks:
    desc: "Typecheck core build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project src/core/tsconfig.json
+      - npx tsc --noEmit --project editor/src/core/tsconfig.json

  typecheck:proprietary:
    desc: "Typecheck proprietary build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project src/proprietary/tsconfig.json
+      - npx tsc --noEmit --project editor/src/proprietary/tsconfig.json

  typecheck:saas:
    desc: "Typecheck SaaS build variant"
@@ -209,7 +214,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx tsc --noEmit --project src/saas/tsconfig.json
+      - npx tsc --noEmit --project editor/src/saas/tsconfig.json

  typecheck:desktop:
    desc: "Typecheck desktop build variant"
@@ -217,19 +222,19 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx tsc --noEmit --project src/desktop/tsconfig.json
+      - npx tsc --noEmit --project editor/src/desktop/tsconfig.json

  typecheck:scripts:
    desc: "Typecheck scripts"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project scripts/tsconfig.json
+      - npx tsc --noEmit --project editor/scripts/tsconfig.json

  typecheck:prototypes:
    desc: "Typecheck prototypes build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project src/prototypes/tsconfig.json
+      - npx tsc --noEmit --project editor/src/prototypes/tsconfig.json

  typecheck:all:
    desc: "Typecheck all build variants"
@@ -270,31 +275,19 @@ tasks:
    desc: "Run tests"
    deps: [install]
    cmds:
-      - npx vitest run
+      - npx vitest run --root editor

  test:watch:
    desc: "Run tests in watch mode"
    deps: [install]
    cmds:
-      - npx vitest --watch
+      - npx vitest --watch --root editor

  test:coverage:
    desc: "Run tests with coverage"
    deps: [install]
    cmds:
-      - npx vitest --coverage
-
-  test:e2e:
-    desc: "Run E2E tests"
-    deps: [prepare]
-    cmds:
-      - npx playwright test {{.CLI_ARGS}}
-
-  test:e2e:install:
-    desc: "Install E2E test browsers"
-    deps: [install]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
+      - npx vitest --coverage --root editor

  # ============================================================
  # Code Generation
@@ -304,4 +297,4 @@ tasks:
    desc: "Generate frontend license report"
    deps: [install]
    cmds:
-      - node scripts/generate-licenses.js
+      - node editor/scripts/generate-licenses.js
@@ -10,14 +10,14 @@ When adding tools, follow this systematic approach using the established pattern

 Create these files in the correct directories:
 ```
-frontend/src/hooks/tools/[toolName]/
+frontend/editor/src/hooks/tools/[toolName]/
  ├── use[ToolName]Parameters.ts     # Parameter definitions and validation
  └── use[ToolName]Operation.ts      # Tool operation logic using useToolOperation

-frontend/src/components/tools/[toolName]/
+frontend/editor/src/components/tools/[toolName]/
  └── [ToolName]Settings.tsx         # Settings UI component (if needed)

-frontend/src/tools/
+frontend/editor/src/tools/
  └── [ToolName].tsx                 # Main tool component
 ```

@@ -128,7 +128,7 @@ export default [ToolName] as ToolComponent;
 ## 3. Register Tool in System
 Update these files to register your new tool:

-**Tool Registry** (`frontend/src/data/useTranslatedToolRegistry.tsx`):
+**Tool Registry** (`frontend/editor/src/data/useTranslatedToolRegistry.tsx`):
 1. Add imports at the top:
 ```typescript
 import [ToolName] from "../tools/[ToolName]";
@@ -155,7 +155,7 @@ import [ToolName]Settings from "../components/tools/[toolName]/[ToolName]Setting
 ## 4. Add Tooltips (Optional but Recommended)
 Create user-friendly tooltips to help non-technical users understand your tool. **Use simple, clear language - avoid technical jargon:**

-**Tooltip Hook** (`frontend/src/components/tooltips/use[ToolName]Tips.ts`):
+**Tooltip Hook** (`frontend/editor/src/components/tooltips/use[ToolName]Tips.ts`):
 ```typescript
 import { useTranslation } from 'react-i18next';
 import { TooltipContent } from '../../types/tips';
@@ -202,7 +202,7 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.

-**File to update:** `frontend/public/locales/en-GB/translation.toml`
+**File to update:** `frontend/editor/public/locales/en-GB/translation.toml`

 **Required Translation Keys**:
 ```toml
@@ -139,9 +139,9 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie

 #### Environment Variables
 - All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/.env` — core, proprietary, and shared vars
-  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
+  - `frontend/editor/.env` — core, proprietary, and shared vars
+  - `frontend/editor/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
+  - `frontend/editor/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
 - These files are committed to Git and must not contain private keys
 - Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
 - Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
@@ -152,7 +152,7 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 #### Import Paths - CRITICAL
 **ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.

-For a broader explanation of the frontend layering and override architecture, see [frontend/DeveloperGuide.md](frontend/DeveloperGuide.md).
+For a broader explanation of the frontend layering and override architecture, see [frontend/editor/DeveloperGuide.md](frontend/editor/DeveloperGuide.md).

 ```typescript
 // ✅ CORRECT - Use @app/* for all imports
@@ -183,26 +183,26 @@ Use this pattern for desktop-specific or proprietary-specific features WITHOUT r
 **Example - Desktop-specific footer:**

 ```typescript
-// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
-interface RightRailFooterExtensionsProps {
+// core/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (stub)
+interface WorkbenchBarFooterExtensionsProps {
  className?: string;
 }

-export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
+export function WorkbenchBarFooterExtensions(_props: WorkbenchBarFooterExtensionsProps) {
  return null; // Stub - does nothing in web builds
 }
 ```

 ```tsx
-// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
+// desktop/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (real implementation)
 import { Box } from '@mantine/core';
 import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';

-interface RightRailFooterExtensionsProps {
+interface WorkbenchBarFooterExtensionsProps {
  className?: string;
 }

-export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
+export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterExtensionsProps) {
  return (
    <Box className={className}>
      <BackendHealthIndicator />
@@ -212,15 +212,15 @@ export function RightRailFooterExtensions({ className }: RightRailFooterExtensio
 ```

 ```tsx
-// core/components/shared/RightRail.tsx (usage - works in ALL builds)
-import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
+// core/components/shared/WorkbenchBar.tsx (usage - works in ALL builds)
+import { WorkbenchBarFooterExtensions } from '@app/components/workbenchBar/WorkbenchBarFooterExtensions';

-export function RightRail() {
+export function WorkbenchBar() {
  return (
    <div>
      {/* In web builds: renders nothing (stub returns null) */}
      {/* In desktop builds: renders BackendHealthIndicator */}
-      <RightRailFooterExtensions className="right-rail-footer" />
+      <WorkbenchBarFooterExtensions className="workbench-bar-footer" />
    </div>
  );
 }
@@ -243,7 +243,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `frontend/src/core/contexts/FileContext.tsx`
+**Location**: `frontend/editor/src/core/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -268,7 +268,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -356,7 +356,7 @@ return useToolOperation({
 ### Frontend Directory Structure
 The frontend is organized with a clear separation of concerns:

- **`frontend/src/core/`**: Main application code (shared, production-ready components)
+- **`frontend/editor/src/core/`**: Main application code (shared, production-ready components)
  - **`core/components/`**: React components organized by feature
    - `core/components/tools/`: Individual PDF tool implementations
    - `core/components/viewer/`: PDF viewer components
@@ -374,17 +374,17 @@ The frontend is organized with a clear separation of concerns:
  - **`core/data/`**: Static data (tool taxonomy, etc.)
  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)

- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/src/proprietary/`**: Proprietary/licensed features
- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/public/`**: Static assets served directly
+- **`frontend/editor/src/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/editor/src/proprietary/`**: Proprietary/licensed features
+- **`frontend/editor/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/editor/public/`**: Static assets served directly
  - `public/locales/`: Translation JSON files

 ### Component Architecture
- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/editor/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
+  - Frontend: JSON files in `frontend/editor/public/locales/` (converted from .properties)
  - Conversion Script: `scripts/convert_properties_to_json.py`

 ### Configuration Modes
@@ -409,7 +409,7 @@ The frontend is organized with a clear separation of concerns:
 4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
 5. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
+   - Frontend: Update JSON files in `frontend/editor/public/locales/` or use conversion script
 6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status
@@ -427,11 +427,11 @@ The frontend is organized with a clear separation of concerns:
 ## Translation Rules

 - **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
- Translation files are located in `frontend/public/locales/`
+- Translation files are located in `frontend/editor/public/locales/`

 ## Important Notes

- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
+- **Java Version**: Requires JDK 25.
 - **Lombok**: Used extensively - ensure IDE plugin is installed
 - **File Persistence**:
  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
@@ -458,3 +458,26 @@ The frontend is organized with a clear separation of concerns:
 - Confirm approach before making structural changes
 - Request guidance on preferences (cross-platform vs specific tools, etc.)
 - Verify understanding of requirements before proceeding
+
+
+## Stack reality check (don't trust LLM training data) <!-- bleeding-edge-stack-note -->
+
+This codebase is on bleeding-edge versions of its core JVM stack: **Spring Boot 4.0.6**,
+**Jackson 3 (`tools.jackson`)**, **JDK 21/25 source/target with JDK 25 toolchain**.
+All three are *post*-2024 releases and your training corpus is overwhelmingly Spring Boot 2/3 and
+Jackson 2 patterns — those patterns will compile, run differently, or hallucinate APIs that no
+longer exist.
+
+Before writing or editing Spring / Jackson / JDK code:
+
+1. Open an existing module in `app/core/` or `app/common/` and grep for the actual imports being
+   used — `import tools.jackson...` not `import com.fasterxml.jackson...`, and the new
+   `org.springframework.boot` 4.x package layout.
+2. If you're not sure whether an API exists in this stack version, **check the source on disk
+   first** (the dependency JARs are downloaded under `~/.gradle/caches/modules-2/`).
+3. Do not silently downgrade a Spring Boot 4 pattern to a Spring Boot 3 equivalent. If something
+   doesn't work, surface it to the human — don't guess.
+
+Same goes for Jackson 3's API surface (renamed `ObjectMapper` builder methods, new
+`tools.jackson.databind` namespace) and JDK 25 preview features. Ground your code in this repo's
+actual imports, not what worked three years ago.
@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:

 **Backend:**
- Spring Boot (Java 21+, JDK 25 recommended)
+- Spring Boot (requires JDK 25)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -45,7 +45,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
- Java JDK 21 or later (JDK 25 recommended)
+- Java JDK 25
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
 - [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
@@ -61,7 +61,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
   cd Stirling-PDF
   ```

-2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.
+2. Install Docker and JDK 25 if not already installed.

 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
   1. Only VSCode
@@ -128,24 +128,26 @@ See [the frontend README](frontend/README.md#tauri) for detailed build instructi
 Stirling-PDF/
 ├── .github/               # GitHub-specific files (workflows, issue templates)
 ├── configs/               # Configuration files used by stirling at runtime (generated at runtime)
-├── frontend/              # React SPA frontend (Stirling 2.0)
-│   ├── src/
-│   │   ├── components/    # React components
-│   │   ├── tools/         # Tool-specific React components
-│   │   ├── hooks/         # Custom React hooks
-│   │   ├── services/      # API and utility services
-│   │   ├── types/         # TypeScript type definitions
-│   │   └── utils/         # Utility functions
-│   ├── src-tauri/         # Tauri desktop app configuration
-│   │   ├── src/           # Rust backend code
-│   │   ├── libs/          # JAR files (generated by build scripts)
-│   │   ├── runtime/       # Bundled JRE (generated by build scripts)
-│   │   ├── Cargo.toml     # Rust dependencies
-│   │   └── tauri.conf.json # Tauri configuration
-│   ├── public/
-│   │   └── locales/       # Internationalization files (JSON)
-│   ├── package.json       # Frontend dependencies
-│   └── vite.config.ts     # Vite configuration
+├── frontend/              # Frontend workspace (Stirling 2.0)
+│   ├── editor/            # PDF editor app (the original React SPA)
+│   │   ├── src/
+│   │   │   ├── components/    # React components
+│   │   │   ├── tools/         # Tool-specific React components
+│   │   │   ├── hooks/         # Custom React hooks
+│   │   │   ├── services/      # API and utility services
+│   │   │   ├── types/         # TypeScript type definitions
+│   │   │   └── utils/         # Utility functions
+│   │   ├── src-tauri/     # Tauri desktop app configuration
+│   │   │   ├── src/           # Rust backend code
+│   │   │   ├── libs/          # JAR files (generated by build scripts)
+│   │   │   ├── runtime/       # Bundled JRE (generated by build scripts)
+│   │   │   ├── Cargo.toml     # Rust dependencies
+│   │   │   └── tauri.conf.json # Tauri configuration
+│   │   ├── public/
+│   │   │   └── locales/       # Internationalization files (JSON)
+│   │   └── vite.config.ts     # Vite configuration
+│   ├── package.json       # Shared workspace dependencies
+│   └── eslint.config.mjs  # Shared lint config
 ├── customFiles/           # Custom static files and templates (generated at runtime used to replace existing files)
 ├── docs/                  # Documentation files
 ├── exampleYmlFiles/       # Example YAML configuration files
@@ -445,7 +447,7 @@ For Stirling 2.0, new features are built as React components:

 1. **Create the React Component:**
   ```typescript
-   // frontend/src/tools/NewTool.tsx
+   // frontend/editor/src/tools/NewTool.tsx
   import { useState } from 'react';
   import { Button, FileInput, Container } from '@mantine/core';

@@ -6,6 +6,8 @@ Portions of this software are licensed as follows:

 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
+* All content that resides under the "app/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
 * All content that resides under the "frontend/src/proprietary/" directory of this repository,
@@ -3,7 +3,7 @@ version: '3'
 output: prefixed

 vars:
-  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts\find-free-port.ps1 -Preferred
+  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts/find-free-port.ps1
  FIND_FREE_PORT_SH: bash scripts/find-free-port.sh

 includes:
@@ -22,6 +22,9 @@ includes:
  desktop:
    taskfile: .taskfiles/desktop.yml
    dir: frontend
+  e2e:
+    taskfile: .taskfiles/e2e.yml
+    dir: .

 tasks:
  # ============================================================
@@ -42,7 +45,7 @@ tasks:
    desc: "Start backend + frontend concurrently on free ports"
    vars:
      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
    deps:
@@ -55,11 +58,28 @@ tasks:
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
          OPEN: "true"

+  dev:saas:
+    desc: "Start SaaS backend + frontend concurrently on free ports"
+    vars:
+      PORTS:
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
+      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
+      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
+    deps:
+      - task: backend:dev:saas
+        vars:
+          PORT: '{{.BACKEND_PORT}}'
+      - task: frontend:dev:saas
+        vars:
+          PORT: '{{.FRONTEND_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+          OPEN: "true"
+
  dev:all:
    desc: "Start backend + frontend + engine concurrently on free ports"
    vars:
      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173,5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
      ENGINE_PORT: '{{index (splitList "\n" .PORTS) 2}}'
@@ -86,7 +86,7 @@ If you're using Tauri's built-in updater feature:

 ## Configuration Files

-### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
+### 1. Tauri Configuration (frontend/editor/src-tauri/tauri.conf.json)

 The Windows signing configuration is already set up:

@@ -0,0 +1,34 @@
+###############################################################################
+# Stirling-PDF SaaS environment defaults.
+#
+# This file is committed and provides non-secret defaults loaded by
+# `task backend:dev:saas`. Put real values for secrets (passwords, project
+# refs, edge function secrets) in `.env.saas.local` - any variable set there
+# takes precedence over what's defined here.
+#
+# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
+###############################################################################
+
+# ---------- Supabase project ----------
+# Project reference (the subdomain part of <ref>.supabase.co). Required.
+# Set in .env.saas.local.
+SAAS_DB_PROJECT_REF=
+
+# Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
+SUPABASE_EDGE_FUNCTION_SECRET=
+
+# ---------- Database (saas profile) ----------
+# Direct JDBC URL to the Supabase Postgres. Required when running the plain
+# `saas` profile (i.e. without `--spring.profiles.include=dev`).
+# Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
+SAAS_DB_URL=
+SAAS_DB_USERNAME=postgres
+SAAS_DB_PASSWORD=
+
+# ---------- Database (dev profile overrides) ----------
+# Used when `--spring.profiles.include=dev` is active. The dev profile
+# defaults the URL/username to the shared dev Supabase project, but the
+# password must still be provided in .env.saas.local.
+SAAS_DEV_DB_URL=
+SAAS_DEV_DB_USERNAME=postgres
+SAAS_DEV_DB_PASSWORD=
@@ -0,0 +1,3 @@
+# Whitelist committed env defaults. `.env.saas.local` (and any other .env*)
+# stays ignored via the root .gitignore.
+!.env.saas
@@ -44,6 +44,10 @@
      "moduleName": ".*",
      "moduleLicense": "The MIT License"
    },
+    {
+      "moduleName": ".*",
+      "moduleLicense": "MIT-0"
+    },
    {
      "moduleName": "com.github.jai-imageio:jai-imageio-core",
      "moduleLicense": "LICENSE.txt"
@@ -51,4 +51,36 @@ dependencies {
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
    api 'jakarta.mail:jakarta.mail-api:2.1.5'
    runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
+
+    // Tabula table extraction — used by the shared PDF parser and directly by downstream modules.
+    // api-scoped so downstream modules (core, proprietary) retain it on their compile classpath.
+    api ('technology.tabula:tabula:1.0.5') {
+        exclude group: 'org.slf4j', module: 'slf4j-simple'
+        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
+        exclude group: 'com.google.code.gson', module: 'gson'
+    }
+
+    api 'com.stirling:jpdfium:1.0.1'
+
+    // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
+    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
+    def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
+    def jpdfiumPlatforms = jpdfiumPlatformsProp == 'all'
+            ? jpdfiumAllPlatforms
+            : jpdfiumPlatformsProp.split(',').collect { it.trim() }.findAll { it }
+    def jpdfiumInvalid = jpdfiumPlatforms.findAll { !jpdfiumAllPlatforms.contains(it) }
+    if (jpdfiumInvalid) {
+        throw new GradleException("Unknown jpdfiumPlatforms value(s): ${jpdfiumInvalid.join(', ')}. " +
+                "Valid: ${jpdfiumAllPlatforms.join(', ')} or 'all'.")
+    }
+    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
+    jpdfiumPlatforms.each { platform ->
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1"
+    }
+
+    // Bucket4j (local in-process token bucket for RateLimitStore default impl)
+    implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0'
+
+    // ArchUnit: enforces module dependency direction (see ArchitectureTest)
+    testImplementation 'com.tngtech.archunit:archunit-junit5:1.4.2'
 }
@@ -0,0 +1,73 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.context.annotation.Primary;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
+ * LineAlignmentTableParser}. The first parser returning a result above {@link
+ * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
+ */
+@Service
+@Primary
+@RequiredArgsConstructor
+@Slf4j
+public class CompositeTableParser implements TableParser {
+
+    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
+    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
+
+    private final TabulaTableParser tabulaParser;
+    private final LineAlignmentTableParser lineAlignmentParser;
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        // Step 1: Tabula lattice mode (ruled/bordered tables).
+        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
+        if (!latticeResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula lattice ({} table(s))",
+                    rawPage.pageNumber(),
+                    latticeResults.size());
+            return latticeResults;
+        }
+
+        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
+        // parseStream is not on the TableParser interface — this intentionally couples to the
+        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
+        List<TableFragment> streamResults =
+                filterConfident(tabulaParser.parseStream(document, rawPage));
+        if (!streamResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula stream ({} table(s))",
+                    rawPage.pageNumber(),
+                    streamResults.size());
+            return streamResults;
+        }
+
+        // Step 3: Geometry-based line-alignment fallback.
+        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
+        if (!lineResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using LineAlignment ({} table(s))",
+                    rawPage.pageNumber(),
+                    lineResults.size());
+            return lineResults;
+        }
+
+        return List.of();
+    }
+
+    private List<TableFragment> filterConfident(List<TableFragment> tables) {
+        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
+    }
+}
@@ -0,0 +1,528 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.TreeMap;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Fallback {@link TableParser} for borderless financial tables using text geometry.
+ *
+ * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
+ * positions, groups vertically proximate anchor lines into table candidates, then scores each group
+ * on column consistency and anchor density (confidence ceiling 0.85).
+ */
+@Service
+@Slf4j
+public class LineAlignmentTableParser implements TableParser {
+
+    /** Width in points of each column position bucket. */
+    static final float COLUMN_BUCKET_PT = 5f;
+
+    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
+    private static final int COLUMN_MATCH_BUCKETS = 2;
+
+    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
+    private static final float MAX_GAP_FACTOR = 2.5f;
+
+    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
+    static final int MIN_TABLE_ROWS = 3;
+
+    /** Minimum confirmed column positions to form a valid table. */
+    static final int MIN_COLUMNS = 2;
+
+    /**
+     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
+     * rows).
+     */
+    private static final double COLUMN_MIN_FREQUENCY = 0.40;
+
+    /**
+     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
+     * percent, nil dashes.
+     */
+    private static final Pattern NUMERIC =
+            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
+
+    /**
+     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
+     * column-gap logic).
+     */
+    static final float ROW_MERGE_TOLERANCE_PT = 2f;
+
+    // ── public API ───────────────────────────────────────────────────────────────────────────────
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        List<RawLine> lines = rawPage.lines();
+        if (lines.size() < MIN_TABLE_ROWS) return List.of();
+
+        float modalSpacing = computeModalSpacing(lines);
+        List<TokenizedLine> tokenized =
+                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
+
+        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
+
+        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
+
+        List<Float> columnGrid = buildColumnGrid(anchors);
+        if (columnGrid.size() < MIN_COLUMNS) {
+            log.debug(
+                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
+                    rawPage.pageNumber(),
+                    MIN_COLUMNS);
+            return List.of();
+        }
+
+        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
+
+        List<TableFragment> results = new ArrayList<>();
+        for (int i = 0; i < groups.size(); i++) {
+            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
+                    .ifPresent(results::add);
+        }
+
+        log.debug(
+                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
+                rawPage.pageNumber(),
+                results.size(),
+                anchors.size(),
+                columnGrid.size());
+        return results;
+    }
+
+    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
+
+    /**
+     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
+     * split by LineBuilder.
+     */
+    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
+        if (tokenized.size() < 2) return tokenized;
+
+        List<TokenizedLine> result = new ArrayList<>();
+        int i = 0;
+
+        while (i < tokenized.size()) {
+            float baseY = tokenized.get(i).line().bounds().y();
+            int j = i + 1;
+            while (j < tokenized.size()
+                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
+                            <= ROW_MERGE_TOLERANCE_PT) {
+                j++;
+            }
+
+            if (j == i + 1) {
+                result.add(tokenized.get(i));
+            } else {
+                result.add(mergeGroup(tokenized.subList(i, j)));
+            }
+            i = j;
+        }
+
+        return result;
+    }
+
+    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
+        List<TextFragment> mergedFragments =
+                group.stream()
+                        .flatMap(tl -> tl.line().fragments().stream())
+                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        Bounds mergedBounds =
+                group.stream()
+                        .map(tl -> tl.line().bounds())
+                        .reduce(Bounds::merge)
+                        .orElse(group.get(0).line().bounds());
+
+        RawLine mergedLine =
+                new RawLine(
+                        group.get(0).line().lineId(),
+                        mergedFragments,
+                        mergedBounds,
+                        group.get(0).line().pageNumber());
+
+        return tokenize(mergedLine);
+    }
+
+    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
+     * fragment.
+     */
+    TokenizedLine tokenize(RawLine line) {
+        List<LineToken> tokens = new ArrayList<>();
+        for (TextFragment frag : line.fragments()) {
+            tokens.addAll(tokensFromFragment(frag));
+        }
+        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
+        return new TokenizedLine(line, tokens, numeric);
+    }
+
+    private List<LineToken> tokensFromFragment(TextFragment frag) {
+        String raw = frag.text();
+        if (raw == null || raw.isBlank()) return List.of();
+
+        float fragX = frag.bounds().x();
+        float fragWidth = frag.bounds().width();
+        int rawLen = raw.length();
+
+        List<LineToken> result = new ArrayList<>();
+        int offset = 0;
+        for (String part : raw.split("\\s+")) {
+            if (part.isEmpty()) {
+                offset++;
+                continue;
+            }
+            int idx = raw.indexOf(part, offset);
+            if (idx < 0) idx = offset;
+
+            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
+            float tokenRight =
+                    rawLen > 0
+                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
+                            : fragX + fragWidth;
+
+            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
+            offset = idx + part.length();
+        }
+        return result;
+    }
+
+    // ── column grid ──────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
+     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
+     */
+    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
+        // bucket → set of line indices that contributed a numeric token to that bucket
+        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
+        for (int i = 0; i < anchors.size(); i++) {
+            for (LineToken t : anchors.get(i).numeric()) {
+                int bucket = bucket(t.right());
+                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
+            }
+        }
+
+        int minHits =
+                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
+
+        // Confirmed buckets → average right-edge for that bucket
+        TreeMap<Integer, Float> confirmed = new TreeMap<>();
+        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
+            // Count distinct lines
+            long distinctLines = entry.getValue().stream().distinct().count();
+            if (distinctLines >= minHits) {
+                double avg =
+                        entry.getValue().stream()
+                                .distinct() // weight each line equally regardless of token count
+                                .mapToDouble(
+                                        lineIdx ->
+                                                avgRightEdgeForBucket(
+                                                        anchors, lineIdx, entry.getKey()))
+                                .average()
+                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
+                confirmed.put(entry.getKey(), (float) avg);
+            }
+        }
+
+        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
+    }
+
+    /**
+     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
+     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
+     */
+    private double avgRightEdgeForBucket(
+            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
+        return anchors.get(lineIdx).numeric().stream()
+                .filter(t -> bucket(t.right()) == targetBucket)
+                .mapToDouble(LineToken::right)
+                .average()
+                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
+    }
+
+    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
+     * MAX_GAP_FACTOR × modal spacing splits groups.
+     */
+    private List<List<TokenizedLine>> groupRows(
+            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
+        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
+
+        List<List<TokenizedLine>> groups = new ArrayList<>();
+        List<TokenizedLine> current = new ArrayList<>();
+
+        for (int i = 0; i < all.size(); i++) {
+            TokenizedLine tl = all.get(i);
+            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
+
+            if (current.isEmpty()) {
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            float gap =
+                    tl.line().bounds().y()
+                            - current.get(current.size() - 1).line().bounds().bottom();
+
+            if (gap > maxGap) {
+                groups.add(current);
+                current = new ArrayList<>();
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            if (fits) {
+                current.add(tl);
+            } else if (!tl.line().text().isBlank()) {
+                // Include non-anchor lines (labels) only if they have text and are within
+                // proximity.
+                current.add(tl);
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+
+        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
+    }
+
+    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
+        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
+                >= MIN_TABLE_ROWS;
+    }
+
+    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
+    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long matches =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) matches / tl.numeric().size() >= 0.60;
+    }
+
+    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long hits =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) hits / tl.numeric().size() < 0.60;
+    }
+
+    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
+
+    private Optional<TableFragment> buildFragment(
+            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
+
+        List<String> warnings = new ArrayList<>();
+        List<List<String>> rawRows = new ArrayList<>();
+        List<TableRow> rows = new ArrayList<>();
+
+        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
+            TokenizedLine tl = group.get(rowIdx);
+            List<String> rawRow = buildRawRow(tl, columnGrid);
+            rawRows.add(Collections.unmodifiableList(rawRow));
+            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
+        }
+
+        // Column count = 1 label column + confirmed numeric columns
+        int colCount = columnGrid.size() + 1;
+        Bounds bounds = computeGroupBounds(group);
+        float confidence = computeConfidence(group, columnGrid, warnings);
+
+        return Optional.of(
+                new TableFragment(
+                        "tbl-la-p" + pageNumber + "-" + tableIndex,
+                        pageNumber,
+                        bounds,
+                        List.of(),
+                        Collections.unmodifiableList(rows),
+                        Collections.unmodifiableList(rawRows),
+                        colCount,
+                        confidence,
+                        Collections.unmodifiableList(warnings),
+                        null));
+    }
+
+    /**
+     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
+     */
+    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
+        String[] cells = new String[columnGrid.size() + 1];
+        Arrays.fill(cells, "");
+
+        // Separate label tokens (those not landing in any confirmed column) from column tokens.
+        List<String> labelParts = new ArrayList<>();
+        for (LineToken token : tl.all()) {
+            int col = nearestColumnIndex(token.right(), columnGrid);
+            if (col >= 0 && token.numeric()) {
+                int cellIdx = col + 1;
+                cells[cellIdx] =
+                        cells[cellIdx].isEmpty()
+                                ? token.text()
+                                : cells[cellIdx] + " " + token.text();
+            } else {
+                labelParts.add(token.text());
+            }
+        }
+        cells[0] = String.join(" ", labelParts).trim();
+        return Arrays.asList(cells);
+    }
+
+    private TableRow buildTableRow(
+            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
+        List<TableCell> cells = new ArrayList<>(rawRow.size());
+
+        // Label cell: use the line's full bounds as an approximation.
+        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
+
+        for (int col = 0; col < columnGrid.size(); col++) {
+            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
+            float right = columnGrid.get(col);
+            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
+            Bounds cellBounds =
+                    new Bounds(
+                            left,
+                            tl.line().bounds().y(),
+                            right - left,
+                            tl.line().bounds().height());
+            cells.add(TableCell.of(col + 1, text, cellBounds));
+        }
+        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
+    }
+
+    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
+
+    /**
+     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
+     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
+     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
+     */
+    private float computeConfidence(
+            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
+        float score = 0.70f;
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        long totalRows = group.size();
+
+        // More columns
+        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
+        score += extraCols * 0.05f;
+
+        // More anchor rows
+        if (anchorCount >= 5) score += 0.05f;
+        if (anchorCount >= 8) score += 0.05f;
+
+        // Inconsistent column matching
+        long inconsistent =
+                group.stream()
+                        .filter(TokenizedLine::isAnchor)
+                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
+                        .count();
+        if (inconsistent > anchorCount * 0.30) {
+            score -= 0.15f;
+            warnings.add(
+                    "Column match inconsistent on "
+                            + inconsistent
+                            + "/"
+                            + anchorCount
+                            + " anchor rows");
+        }
+
+        // Label-heavy
+        long nonAnchor = totalRows - anchorCount;
+        if (nonAnchor > anchorCount) {
+            score -= 0.10f;
+            warnings.add(
+                    "Non-anchor rows ("
+                            + nonAnchor
+                            + ") outnumber anchor rows ("
+                            + anchorCount
+                            + ")");
+        }
+
+        return Math.max(0f, Math.min(0.85f, score));
+    }
+
+    // ── utility ──────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
+     * #COLUMN_MATCH_BUCKETS} buckets.
+     */
+    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
+        int nearest = -1;
+        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
+        for (int i = 0; i < grid.size(); i++) {
+            float dist = Math.abs(rightEdge - grid.get(i));
+            if (dist < minDist) {
+                minDist = dist;
+                nearest = i;
+            }
+        }
+        return nearest;
+    }
+
+    private Bounds computeGroupBounds(List<TokenizedLine> group) {
+        return group.stream()
+                .map(tl -> tl.line().bounds())
+                .reduce(Bounds::merge)
+                .orElse(new Bounds(0, 0, 0, 0));
+    }
+
+    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
+    private float computeModalSpacing(List<RawLine> lines) {
+        if (lines.size() < 2) return 0f;
+        Map<Float, Long> freq = new HashMap<>();
+        for (int i = 1; i < lines.size(); i++) {
+            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
+            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
+        }
+        return freq.entrySet().stream()
+                .max(Map.Entry.comparingByValue())
+                .map(Map.Entry::getKey)
+                .orElse(0f);
+    }
+
+    private static int bucket(float x) {
+        return Math.round(x / COLUMN_BUCKET_PT);
+    }
+
+    // ── private data types ───────────────────────────────────────────────────────────────────────
+
+    /** A word-level token with an approximate right-edge x-position. */
+    record LineToken(String text, float x, float right, boolean numeric) {}
+
+    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
+    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
+        boolean isAnchor() {
+            return numeric.size() >= 2;
+        }
+    }
+}
@@ -0,0 +1,139 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
+ *
+ * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
+ * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
+ * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
+ */
+@Service
+@Slf4j
+public class LineBuilder {
+
+    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
+    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
+
+    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
+    private static final float MIN_BASELINE_TOLERANCE = 2f;
+
+    /**
+     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
+     * two-column gutters.
+     */
+    static final float COLUMN_GAP_RATIO = 0.10f;
+
+    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
+    static final float COLUMN_GAP_MIN_PT = 40f;
+
+    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
+        if (fragments.isEmpty()) return List.of();
+
+        float effectiveWidth = inferEffectiveWidth(fragments);
+        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
+        log.debug(
+                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
+                pageNumber,
+                effectiveWidth,
+                columnGapThreshold);
+
+        // Sort top-to-bottom first, then left-to-right within the same baseline band.
+        List<TextFragment> sorted =
+                fragments.stream()
+                        .sorted(
+                                Comparator.comparingDouble(TextFragment::baseline)
+                                        .thenComparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
+
+        List<RawLine> lines = new ArrayList<>(groups.size());
+        for (int i = 0; i < groups.size(); i++) {
+            List<TextFragment> group =
+                    groups.get(i).stream()
+                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                            .toList();
+
+            Bounds lineBounds =
+                    group.stream()
+                            .map(TextFragment::bounds)
+                            .reduce(Bounds::merge)
+                            .orElse(new Bounds(0, 0, 0, 0));
+
+            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
+        }
+        return lines;
+    }
+
+    private List<List<TextFragment>> groupByBaseline(
+            List<TextFragment> sorted, float columnGapThreshold) {
+        List<List<TextFragment>> groups = new ArrayList<>();
+        List<TextFragment> current = new ArrayList<>();
+        float currentBaseline = Float.NaN;
+
+        for (TextFragment fragment : sorted) {
+            if (current.isEmpty()) {
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+                continue;
+            }
+
+            float maxFontSize =
+                    Math.max(
+                            fragment.fontSize(),
+                            (float)
+                                    current.stream()
+                                            .mapToDouble(TextFragment::fontSize)
+                                            .max()
+                                            .orElse(0));
+            float tolerance =
+                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
+
+            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
+            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
+
+            if (sameBaseline && !columnGap) {
+                current.add(fragment);
+                // Anchor to the weighted mean baseline so long lines stay stable.
+                currentBaseline =
+                        (currentBaseline * (current.size() - 1) + fragment.baseline())
+                                / current.size();
+            } else {
+                groups.add(current);
+                current = new ArrayList<>();
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+        return groups;
+    }
+
+    /**
+     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
+     * threshold}.
+     */
+    private static boolean hasColumnGap(
+            TextFragment next, List<TextFragment> group, float threshold) {
+        float lastRight = group.get(group.size() - 1).bounds().right();
+        return next.bounds().x() - lastRight > threshold;
+    }
+
+    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
+    private static float inferEffectiveWidth(List<TextFragment> fragments) {
+        double maxRight =
+                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
+        return (float) maxRight * 1.10f;
+    }
+}
@@ -0,0 +1,79 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
+ * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
+ * {@link PDDocument} lifecycle.
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class PdfIngester {
+
+    private final LineBuilder lineBuilder;
+    private final TableParser tableParser;
+
+    public List<ParsedPage> parse(PDDocument document) throws IOException {
+        return parse(document, document.getNumberOfPages());
+    }
+
+    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
+        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
+        List<ParsedPage> pages = new ArrayList<>(pageCount);
+        long fragmentsMs = 0;
+        long tablesMs = 0;
+        long t0 = System.currentTimeMillis();
+
+        for (int p = 1; p <= pageCount; p++) {
+            long ft = System.currentTimeMillis();
+            List<TextFragment> fragments = extractFragments(document, p);
+            fragmentsMs += System.currentTimeMillis() - ft;
+
+            PDPage page = document.getPage(p - 1);
+            PDRectangle mediaBox = page.getMediaBox();
+            List<RawLine> lines = lineBuilder.build(fragments, p);
+            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
+
+            long tt = System.currentTimeMillis();
+            List<TableFragment> tables = tableParser.parse(document, rawPage);
+            tablesMs += System.currentTimeMillis() - tt;
+
+            log.debug(
+                    "Page {}: {} fragments → {} lines, {} table(s)",
+                    p,
+                    fragments.size(),
+                    lines.size(),
+                    tables.size());
+            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
+        }
+
+        log.info(
+                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
+                pageCount,
+                System.currentTimeMillis() - t0,
+                fragmentsMs,
+                tablesMs);
+        return pages;
+    }
+
+    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
+            throws IOException {
+        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
+        stripper.getText(document);
+        return stripper.getFragments();
+    }
+}
@@ -0,0 +1,148 @@
+package stirling.software.SPDF.pdf.parser;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+
+/**
+ * All PDF parser model types and the table-parser contract in one place.
+ *
+ * <p>Import as {@code import static stirling.software.SPDF.pdf.parser.PdfModels.*;} to use all
+ * nested types without qualification.
+ */
+public final class PdfModels {
+
+    private PdfModels() {}
+
+    // ── Geometry ──────────────────────────────────────────────────────────────
+
+    public record Bounds(float x, float y, float width, float height) {
+
+        public float right() {
+            return x + width;
+        }
+
+        public float bottom() {
+            return y + height;
+        }
+
+        public static Bounds merge(Bounds a, Bounds b) {
+            float x = Math.min(a.x, b.x);
+            float y = Math.min(a.y, b.y);
+            return new Bounds(
+                    x, y, Math.max(a.right(), b.right()) - x, Math.max(a.bottom(), b.bottom()) - y);
+        }
+    }
+
+    // ── Text fragments and lines ──────────────────────────────────────────────
+
+    /**
+     * A contiguous run of text from a single PDF content-stream string operation. {@code baseline}
+     * is preserved separately from bounds for line-grouping — characters of different sizes on the
+     * same visual line share a baseline but differ in top Y.
+     */
+    public record TextFragment(
+            String fragmentId,
+            String text,
+            Bounds bounds,
+            float baseline,
+            float fontSize,
+            String fontName,
+            boolean bold) {}
+
+    public record RawLine(
+            String lineId, List<TextFragment> fragments, Bounds bounds, int pageNumber) {
+
+        public String text() {
+            if (fragments.isEmpty()) return "";
+            StringBuilder sb = new StringBuilder();
+            TextFragment prev = null;
+            for (TextFragment f : fragments) {
+                if (prev != null) {
+                    float gap = f.bounds().x() - prev.bounds().right();
+                    float avgCharWidth = prev.bounds().width() / Math.max(prev.text().length(), 1);
+                    if (gap > avgCharWidth * 0.5f) sb.append(' ');
+                }
+                sb.append(f.text());
+                prev = f;
+            }
+            return sb.toString();
+        }
+
+        public float dominantFontSize() {
+            return fragments.stream()
+                    .collect(Collectors.groupingBy(TextFragment::fontSize, Collectors.counting()))
+                    .entrySet()
+                    .stream()
+                    .max(Map.Entry.comparingByValue())
+                    .map(Map.Entry::getKey)
+                    .orElse(0f);
+        }
+
+        public boolean hasBold() {
+            return fragments.stream().anyMatch(TextFragment::bold);
+        }
+    }
+
+    public record RawPage(int pageNumber, float widthPt, float heightPt, List<RawLine> lines) {}
+
+    // ── Table model ───────────────────────────────────────────────────────────
+
+    /**
+     * A single cell within a {@link TableRow}. {@code colSpan} and {@code rowSpan} are always 1 in
+     * v1 — span detection is deferred but the fields keep the schema stable.
+     */
+    public record TableCell(int colIndex, String text, Bounds bounds, int colSpan, int rowSpan) {
+
+        public static TableCell of(int colIndex, String text, Bounds bounds) {
+            return new TableCell(colIndex, text, bounds, 1, 1);
+        }
+    }
+
+    public record TableRow(int rowIndex, List<TableCell> cells) {}
+
+    /**
+     * A table as it appears on a single page. {@code headers} is empty in v1 — all rows are in
+     * {@code rows}. {@code rawRows} preserves exact Tabula text output for diagnostics. {@code
+     * confidence} is a heuristic score in [0.0, 1.0]. {@code continuedFromPage} is null in v1.
+     */
+    public record TableFragment(
+            String tableId,
+            int pageNumber,
+            Bounds bounds,
+            List<TableRow> headers,
+            List<TableRow> rows,
+            List<List<String>> rawRows,
+            int columnCount,
+            float confidence,
+            List<String> warnings,
+            Integer continuedFromPage) {}
+
+    // ── Page output ───────────────────────────────────────────────────────────
+
+    public record ParsedPage(
+            int pageNumber,
+            float widthPt,
+            float heightPt,
+            List<TableFragment> tables,
+            List<RawLine> layoutLines) {}
+
+    // ── Parser contract ───────────────────────────────────────────────────────
+
+    /**
+     * Extracts tables from a single page of a PDF. The caller owns the document lifecycle;
+     * implementations must not close it.
+     */
+    public interface TableParser {
+
+        /**
+         * @param document open PDF; must not be closed by the implementation
+         * @param rawPage page metadata and lines for the page to process
+         * @return zero or more table fragments found on the page, never null
+         */
+        List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException;
+    }
+}
@@ -0,0 +1,256 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import technology.tabula.ObjectExtractor;
+import technology.tabula.Page;
+import technology.tabula.RectangularTextContainer;
+import technology.tabula.Table;
+import technology.tabula.extractors.BasicExtractionAlgorithm;
+import technology.tabula.extractors.ExtractionAlgorithm;
+import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
+
+/**
+ * Primary {@link TableParser} implementation using Tabula's lattice-mode extraction.
+ *
+ * <h3>Algorithm</h3>
+ *
+ * Uses {@link SpreadsheetExtractionAlgorithm} (lattice mode), which detects tables from ruled lines
+ * (horizontal and vertical PDF path operators). This is reliable for tables with visible borders.
+ * Borderless or whitespace-delimited tables will not be detected — that requires stream mode, which
+ * is deferred to a later iteration.
+ *
+ * <h3>Coordinate system</h3>
+ *
+ * Tabula normalises page coordinates so that (0,0) is the top-left corner and Y increases downward,
+ * matching the {@link Bounds} convention used throughout this parser. No coordinate transformation
+ * is needed when mapping Tabula cell bounds to {@link Bounds}.
+ *
+ * <h3>Known limitations</h3>
+ *
+ * <ul>
+ *   <li>Borderless tables are not detected (use stream mode, deferred).
+ *   <li>Colspan and rowspan are not detected; all cells report colSpan=1, rowSpan=1.
+ *   <li>Header rows are not identified; all rows appear in {@code rows}, headers is empty.
+ *   <li>Cross-page table linking is not performed; each page is independent.
+ *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
+ * </ul>
+ */
+@Service
+@Slf4j
+public class TabulaTableParser implements TableParser {
+
+    /** Lattice mode — reliable for tables with visible ruled borders. */
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        return parseWithAlgorithm(
+                document, rawPage, new SpreadsheetExtractionAlgorithm(), "lattice");
+    }
+
+    /**
+     * Convenience overload for callers that only have a page number, not a full {@link RawPage}.
+     */
+    public List<TableFragment> parse(PDDocument document, int pageNumber) throws IOException {
+        return parse(document, new RawPage(pageNumber, 0f, 0f, List.of()));
+    }
+
+    /** Stream mode — whitespace-based column detection for borderless tables. */
+    public List<TableFragment> parseStream(PDDocument document, RawPage rawPage)
+            throws IOException {
+        return parseWithAlgorithm(document, rawPage, new BasicExtractionAlgorithm(), "stream");
+    }
+
+    private List<TableFragment> parseWithAlgorithm(
+            PDDocument document, RawPage rawPage, ExtractionAlgorithm algorithm, String modeName)
+            throws IOException {
+        int pageNumber = rawPage.pageNumber();
+
+        List<Table> tabulaTables;
+        try {
+            // Do NOT use try-with-resources: ObjectExtractor.close() closes the underlying
+            // PDDocument, which we don't own. The extractor holds no resources of its own.
+            ObjectExtractor extractor = new ObjectExtractor(document);
+            Page page = extractor.extract(pageNumber);
+            tabulaTables = new ArrayList<>(algorithm.extract(page));
+        } catch (Exception e) {
+            log.warn(
+                    "Tabula {} extraction failed on page {}: {}",
+                    modeName,
+                    pageNumber,
+                    e.getMessage());
+            return List.of();
+        }
+
+        if (tabulaTables.isEmpty()) {
+            log.debug("Page {}: no tables detected by Tabula ({})", pageNumber, modeName);
+            return List.of();
+        }
+
+        log.debug(
+                "Page {}: Tabula ({}) detected {} table(s)",
+                pageNumber,
+                modeName,
+                tabulaTables.size());
+
+        List<TableFragment> fragments = new ArrayList<>(tabulaTables.size());
+        for (int i = 0; i < tabulaTables.size(); i++) {
+            fragments.add(toFragment(tabulaTables.get(i), pageNumber, i));
+        }
+        return fragments;
+    }
+
+    // ── private helpers ──────────────────────────────────────────────────────────────────────────
+
+    private TableFragment toFragment(Table table, int pageNumber, int tableIndex) {
+        List<List<RectangularTextContainer>> tabulaRows = table.getRows();
+        List<String> warnings = new ArrayList<>();
+
+        List<List<String>> rawRows = buildRawRows(tabulaRows);
+        int colCount = inferColumnCount(rawRows, warnings);
+        List<TableRow> rows = buildRows(tabulaRows, colCount, warnings);
+        float confidence = computeConfidence(rawRows, colCount, warnings);
+        Bounds bounds = tableBounds(table);
+
+        String tableId = "tbl-p" + pageNumber + "-" + tableIndex;
+
+        if (!warnings.isEmpty()) {
+            log.warn("Page {}, table {}: {}", pageNumber, tableIndex, warnings);
+        }
+
+        return new TableFragment(
+                tableId,
+                pageNumber,
+                bounds,
+                List.of(), // headers: deferred to v2
+                rows,
+                rawRows,
+                colCount,
+                confidence,
+                Collections.unmodifiableList(warnings),
+                null); // continuedFromPage: deferred to v2
+    }
+
+    private List<List<String>> buildRawRows(List<List<RectangularTextContainer>> tabulaRows) {
+        List<List<String>> rawRows = new ArrayList<>(tabulaRows.size());
+        for (List<RectangularTextContainer> tabulaRow : tabulaRows) {
+            List<String> cells = new ArrayList<>(tabulaRow.size());
+            for (RectangularTextContainer cell : tabulaRow) {
+                cells.add(normaliseText(cell.getText()));
+            }
+            rawRows.add(Collections.unmodifiableList(cells));
+        }
+        return rawRows;
+    }
+
+    private List<TableRow> buildRows(
+            List<List<RectangularTextContainer>> tabulaRows, int colCount, List<String> warnings) {
+        List<TableRow> rows = new ArrayList<>(tabulaRows.size());
+        for (int rowIdx = 0; rowIdx < tabulaRows.size(); rowIdx++) {
+            List<RectangularTextContainer> tabulaRow = tabulaRows.get(rowIdx);
+            List<TableCell> cells = new ArrayList<>(tabulaRow.size());
+
+            for (int colIdx = 0; colIdx < tabulaRow.size(); colIdx++) {
+                RectangularTextContainer c = tabulaRow.get(colIdx);
+                Bounds cellBounds =
+                        new Bounds(
+                                (float) c.getX(),
+                                (float) c.getY(),
+                                (float) c.getWidth(),
+                                (float) c.getHeight());
+                cells.add(TableCell.of(colIdx, normaliseText(c.getText()), cellBounds));
+            }
+
+            if (tabulaRow.size() != colCount) {
+                warnings.add(
+                        "Row "
+                                + rowIdx
+                                + " has "
+                                + tabulaRow.size()
+                                + " cells; expected "
+                                + colCount);
+            }
+
+            rows.add(new TableRow(rowIdx, Collections.unmodifiableList(cells)));
+        }
+        return rows;
+    }
+
+    /**
+     * The canonical column count for a table is the size of the widest row. Tabula can produce
+     * uneven rows when a cell's ruling lines are partially missing.
+     */
+    private int inferColumnCount(List<List<String>> rawRows, List<String> warnings) {
+        if (rawRows.isEmpty()) return 0;
+        int max = rawRows.stream().mapToInt(List::size).max().orElse(0);
+        int mode =
+                rawRows.stream()
+                        .collect(
+                                java.util.stream.Collectors.groupingBy(
+                                        List::size, java.util.stream.Collectors.counting()))
+                        .entrySet()
+                        .stream()
+                        .max(java.util.Map.Entry.comparingByValue())
+                        .map(java.util.Map.Entry::getKey)
+                        .orElse(0);
+        if (max != mode) {
+            warnings.add("Inconsistent column count: modal=" + mode + " max=" + max);
+        }
+        return mode > 0 ? mode : max;
+    }
+
+    /**
+     * Heuristic confidence score in [0.0, 1.0].
+     *
+     * <ul>
+     *   <li>Starts at 1.0.
+     *   <li>-0.3 if only one column (single-column tables are usually not real tables).
+     *   <li>-0.1 per row with an inconsistent column count, capped at -0.4.
+     *   <li>-0.3 if the empty-cell ratio across all cells exceeds 80%.
+     * </ul>
+     */
+    private float computeConfidence(
+            List<List<String>> rawRows, int colCount, List<String> warnings) {
+        if (rawRows.isEmpty() || colCount == 0) return 0f;
+
+        float score = 1.0f;
+
+        if (colCount == 1) score -= 0.3f;
+
+        long inconsistentRows = rawRows.stream().filter(r -> r.size() != colCount).count();
+        score -= Math.min(inconsistentRows * 0.1f, 0.4f);
+
+        long totalCells = rawRows.stream().mapToLong(List::size).sum();
+        long emptyCells =
+                rawRows.stream().flatMap(Collection::stream).filter(String::isBlank).count();
+        if (totalCells > 0 && (float) emptyCells / totalCells > 0.8f) {
+            score -= 0.3f;
+        }
+
+        return Math.max(0f, Math.min(1f, score));
+    }
+
+    private Bounds tableBounds(Table table) {
+        return new Bounds(
+                (float) table.getX(),
+                (float) table.getY(),
+                (float) table.getWidth(),
+                (float) table.getHeight());
+    }
+
+    private String normaliseText(String raw) {
+        if (raw == null) return "";
+        // Tabula wraps multi-line cell content with \r\n — collapse to a single space.
+        return raw.replace("\r\n", " ").replace("\n", " ").replace("\r", " ").trim();
+    }
+}
@@ -0,0 +1,113 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.text.PDFTextStripper;
+import org.apache.pdfbox.text.TextPosition;
+
+/**
+ * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
+ *
+ * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
+ * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
+ * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
+ */
+class WordExtractingStripper extends PDFTextStripper {
+
+    private final int targetPage;
+    private final List<TextFragment> fragments = new ArrayList<>();
+    private int fragmentIndex = 0;
+
+    WordExtractingStripper(int pageNumber) throws IOException {
+        this.targetPage = pageNumber;
+        setStartPage(pageNumber);
+        setEndPage(pageNumber);
+        setSortByPosition(true);
+    }
+
+    @Override
+    protected void startPage(PDPage page) throws IOException {
+        super.startPage(page);
+        fragments.clear();
+        fragmentIndex = 0;
+    }
+
+    @Override
+    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
+        if (text == null || text.isBlank()) return;
+
+        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
+        // number as its own string operation, so this is the common case).
+        if (text.indexOf(' ') < 0) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
+        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
+        if (textPositions.size() != text.length()) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
+        int start = 0;
+        for (int i = 0; i <= text.length(); i++) {
+            if (i == text.length() || text.charAt(i) == ' ') {
+                if (start < i) {
+                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
+                }
+                start = i + 1;
+            }
+        }
+    }
+
+    private void emitFragment(String text, List<TextPosition> positions) {
+        if (positions.isEmpty()) return;
+
+        float minX = Float.MAX_VALUE;
+        float minY = Float.MAX_VALUE;
+        float maxRight = -Float.MAX_VALUE;
+        float maxBaseline = -Float.MAX_VALUE;
+        TextPosition first = null;
+
+        for (TextPosition tp : positions) {
+            if (tp == null) continue;
+            if (first == null) first = tp;
+
+            float x = tp.getX();
+            // getY() is the baseline; top of character = getY() - getHeight().
+            float top = tp.getY() - tp.getHeight();
+            float right = x + tp.getWidth();
+            float baseline = tp.getY();
+
+            minX = Math.min(minX, x);
+            minY = Math.min(minY, top);
+            maxRight = Math.max(maxRight, right);
+            maxBaseline = Math.max(maxBaseline, baseline);
+        }
+
+        if (first == null) return;
+
+        PDFont font = first.getFont();
+        String fontName = font != null ? font.getName() : "";
+        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
+        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
+        float fontSize = first.getHeight();
+
+        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
+        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
+        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
+    }
+
+    List<TextFragment> getFragments() {
+        return Collections.unmodifiableList(fragments);
+    }
+}
@@ -75,8 +75,8 @@ public @interface AutoJobPostMapping {
    boolean queueable() default false;

    /**
-     * Relative resource weight (1–100) used by the scheduler to prioritise / throttle jobs. Values
-     * below 1 are clamped to&nbsp;1, values above 100 to&nbsp;100.
+     * Relative resource weight (1-100). See {@link
+     * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
     */
-    int resourceWeight() default 50;
+    int resourceWeight() default 1;
 }
@@ -0,0 +1,24 @@
+package stirling.software.common.cluster;
+
+/** Health and identity facade for the active cluster backplane. */
+public interface ClusterBackplane {
+
+    /** Returns {@code true} when the backplane is reachable; used for health endpoints. */
+    boolean isHealthy();
+
+    /** Returns {@code "inprocess"} or {@code "valkey"}. */
+    String backplaneType();
+
+    /** Returns this JVM's stable node id (matches {@code Cluster.resolvedNodeId()}). */
+    String localNodeId();
+
+    /**
+     * Whether this JVM should run the local {@link
+     * stirling.software.common.service.TaskManager#cleanupOldJobs()} loop. Distributed backplanes
+     * own job expiry via their own TTL, so they should override this to return {@code false}.
+     * Defaults to {@code true} so in-process behavior is preserved without an explicit override.
+     */
+    default boolean shouldRunLocalCleanup() {
+        return true;
+    }
+}
@@ -0,0 +1,63 @@
+package stirling.software.common.cluster;
+
+import org.springframework.context.annotation.Configuration;
+
+import jakarta.annotation.PostConstruct;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Cluster;
+
+/**
+ * Validates that cluster mode is internally consistent.
+ *
+ * <p>Cluster settings are bound on the central {@link ApplicationProperties} under {@code
+ * cluster.*}; this class reads {@link ApplicationProperties#getCluster()} and runs guards in {@link
+ * PostConstruct}. When {@code cluster.enabled=false} (the default) all checks are skipped so a
+ * single-instance install needs no new config.
+ */
+@Slf4j
+@Configuration
+@RequiredArgsConstructor
+public class ClusterConfig {
+
+    private final ApplicationProperties applicationProperties;
+
+    @PostConstruct
+    void validate() {
+        Cluster cluster = applicationProperties.getCluster();
+        if (!cluster.isEnabled()) {
+            return;
+        }
+        String backplane = cluster.getBackplane();
+        if ("valkey".equalsIgnoreCase(backplane)) {
+            String url = cluster.getValkey() == null ? null : cluster.getValkey().getUrl();
+            if (url == null || url.isBlank()) {
+                throw new IllegalStateException(
+                        "cluster.enabled=true with backplane=valkey requires"
+                                + " cluster.valkey.url to be set (e.g."
+                                + " redis://valkey:6379).");
+            }
+        } else if ("inprocess".equalsIgnoreCase(backplane)) {
+            // enabled+inprocess only coordinates the local JVM; cross-node lookups will 410.
+            log.warn(
+                    "cluster.enabled=true with backplane=inprocess - only the local"
+                            + " JVM is coordinated. Cross-node lookups and the file proxy will fail."
+                            + " Use backplane=valkey for real multi-node deployments.");
+        } else {
+            // Fail fast on typos like "valky" so Spring doesn't later report a cryptic
+            // "no ClusterBackplane bean" - the operator-facing error names the bad value.
+            throw new IllegalStateException(
+                    "cluster.enabled=true with unknown backplane '"
+                            + backplane
+                            + "'. Valid values: inprocess | valkey.");
+        }
+        log.info(
+                "Cluster mode enabled (backplane={}, nodeRole={}, nodeId={}).",
+                backplane,
+                cluster.resolvedRole(),
+                cluster.resolvedNodeId());
+    }
+}
@@ -0,0 +1,12 @@
+package stirling.software.common.cluster;
+
+import java.time.Instant;
+
+/**
+ * Snapshot of a peer node as recorded in the {@link InstanceRegistry}.
+ *
+ * @param internalAddress {@code host:port} the node listens on for {@code /internal/cluster/**}
+ * @param role one of {@code WEB}, {@code WORKER}, {@code BOTH}
+ */
+public record ClusterNode(
+        String nodeId, String internalAddress, Instant lastHeartbeat, String role) {}
@@ -0,0 +1,21 @@
+package stirling.software.common.cluster;
+
+import java.time.Duration;
+import java.util.Optional;
+
+/** Cluster-wide mutual exclusion primitive; non-reentrant by contract. */
+public interface DistributedLock {
+
+    Optional<LockHandle> tryAcquire(String lockKey, Duration leaseTime);
+
+    interface LockHandle extends AutoCloseable {
+        void release();
+
+        boolean renew(Duration leaseTime);
+
+        @Override
+        default void close() {
+            release();
+        }
+    }
+}
@@ -0,0 +1,45 @@
+package stirling.software.common.cluster;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+/** Low-level storage seam for result/job files. */
+public interface FileStore {
+
+    /** Stored file record. */
+    record Stored(String fileId, long size) {}
+
+    /** Store the given stream and return a generated file id and total bytes written. */
+    Stored store(InputStream in, String originalName) throws IOException;
+
+    /**
+     * Store the file at {@code source} and return a generated file id and total bytes written.
+     *
+     * <p>Default implementation opens {@code source} as a stream and delegates to {@link
+     * #store(InputStream, String)}. Local-disk implementations should override to use a direct
+     * file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on Linux),
+     * which avoids the two-memory-copy hit of streaming a disk-backed upload through the JVM heap.
+     */
+    default Stored store(Path source, String originalName) throws IOException {
+        try (InputStream in = Files.newInputStream(source)) {
+            return store(in, originalName);
+        }
+    }
+
+    /** Open the stored file for streaming reads. Caller closes. */
+    InputStream retrieve(String fileId) throws IOException;
+
+    /** Load the stored file into a byte array. */
+    byte[] retrieveBytes(String fileId) throws IOException;
+
+    /** Size of the stored file in bytes. */
+    long size(String fileId) throws IOException;
+
+    /** Delete the stored file. Returns true if a file was removed. */
+    boolean delete(String fileId);
+
+    /** Whether the file id exists in the store. */
+    boolean exists(String fileId);
+}
@@ -0,0 +1,18 @@
+package stirling.software.common.cluster;
+
+import java.time.Duration;
+import java.util.Collection;
+import java.util.Optional;
+
+/** Maps {@code nodeId} to its internal cluster address, with TTL'd heartbeats. */
+public interface InstanceRegistry {
+
+    /** Register or refresh this node. Idempotent so a wiped backplane self-heals on next tick. */
+    void register(ClusterNode node, Duration heartbeatTtl);
+
+    Optional<ClusterNode> lookup(String nodeId);
+
+    Collection<ClusterNode> activeNodes();
+
+    void deregister(String nodeId);
+}
@@ -0,0 +1,24 @@
+package stirling.software.common.cluster;
+
+import java.time.Duration;
+import java.util.Collection;
+import java.util.Optional;
+
+/** Cluster-visible storage for job status and result metadata, with TTL'd entries. */
+public interface JobStore {
+
+    /** Persist or overwrite a job entry. {@code ttl} sets the lifetime of the entry. */
+    void put(JobStoreEntry entry, Duration ttl);
+
+    Optional<JobStoreEntry> get(String jobId);
+
+    void delete(String jobId);
+
+    boolean exists(String jobId);
+
+    /** Reverse lookup: which job owns this result file id? */
+    Optional<String> findJobIdByFileId(String fileId);
+
+    /** Snapshot of every active entry. Used by admin/stats endpoints; may be O(n). */
+    Collection<JobStoreEntry> all();
+}
@@ -0,0 +1,30 @@
+package stirling.software.common.cluster;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Cluster-visible projection of a job's status and result metadata, as persisted in {@link
+ * JobStore}.
+ *
+ * @param owningNodeId the node id that originally executed the job
+ */
+public record JobStoreEntry(
+        String jobId,
+        JobState state,
+        String owningNodeId,
+        Instant createdAt,
+        Instant completedAt,
+        String error,
+        List<String> fileIds,
+        Map<String, String> resultMeta) {
+
+    /** Lifecycle states for a job as observed by the cluster. */
+    public enum JobState {
+        PENDING,
+        RUNNING,
+        COMPLETE,
+        FAILED
+    }
+}
@@ -0,0 +1,16 @@
+package stirling.software.common.cluster;
+
+import java.time.Duration;
+import java.util.Optional;
+
+/** Short-TTL namespaced key/value cache backed by the cluster backplane. */
+public interface KeyValueCache {
+
+    void put(String namespace, String key, String value, Duration ttl);
+
+    Optional<String> get(String namespace, String key);
+
+    void evict(String namespace, String key);
+
+    void evictNamespace(String namespace);
+}
@@ -0,0 +1,18 @@
+package stirling.software.common.cluster;
+
+import java.time.Duration;
+
+/** Token-bucket rate limiting backed by the cluster backplane. */
+public interface RateLimitStore {
+
+    /**
+     * Attempt to consume one token from the bucket identified by {@code bucketKey}.
+     *
+     * @param bucketKey opaque key identifying the bucket (e.g. {@code api:user:123})
+     * @param capacity bucket capacity
+     * @param refillPeriod time window over which {@code capacity} tokens refill
+     */
+    RateLimitDecision tryConsume(String bucketKey, long capacity, Duration refillPeriod);
+
+    record RateLimitDecision(boolean allowed, long remainingTokens, long nanosToWaitForRefill) {}
+}
@@ -0,0 +1,7 @@
+package stirling.software.common.cluster;
+
+/** Records one increment per sticky-session miss (a 410 Gone for a job owned by another node). */
+@FunctionalInterface
+public interface StickyMissRecorder {
+    void recordStickyMiss();
+}
@@ -0,0 +1,31 @@
+package stirling.software.common.cluster.inprocess;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.cluster.ClusterBackplane;
+import stirling.software.common.model.ApplicationProperties;
+
+@Slf4j
+public class InProcessClusterBackplane implements ClusterBackplane {
+
+    private final ApplicationProperties applicationProperties;
+
+    public InProcessClusterBackplane(ApplicationProperties applicationProperties) {
+        this.applicationProperties = applicationProperties;
+    }
+
+    @Override
+    public boolean isHealthy() {
+        return true;
+    }
+
+    @Override
+    public String backplaneType() {
+        return "inprocess";
+    }
+
+    @Override
+    public String localNodeId() {
+        return applicationProperties.getCluster().resolvedNodeId();
+    }
+}
@@ -0,0 +1,65 @@
+package stirling.software.common.cluster.inprocess;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.cluster.ClusterBackplane;
+import stirling.software.common.cluster.DistributedLock;
+import stirling.software.common.cluster.InstanceRegistry;
+import stirling.software.common.cluster.JobStore;
+import stirling.software.common.cluster.KeyValueCache;
+import stirling.software.common.cluster.RateLimitStore;
+import stirling.software.common.model.ApplicationProperties;
+
+/**
+ * Default cluster backplane wiring: every interface gets an {@code InProcess*} bean. Active when
+ * cluster mode is off or {@code cluster.backplane=inprocess}.
+ */
+@Slf4j
+@Configuration
+@ConditionalOnExpression(
+        "!${cluster.enabled:false} ||"
+                + " '${cluster.backplane:inprocess}'.equalsIgnoreCase('inprocess')")
+public class InProcessClusterConfiguration {
+
+    @Bean
+    @ConditionalOnMissingBean
+    public ClusterBackplane clusterBackplane(ApplicationProperties applicationProperties) {
+        log.info("Cluster backplane: in-process (single node)");
+        return new InProcessClusterBackplane(applicationProperties);
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public JobStore jobStore() {
+        return new InProcessJobStore();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public RateLimitStore rateLimitStore() {
+        return new InProcessRateLimitStore();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public DistributedLock distributedLock() {
+        return new InProcessDistributedLock();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public KeyValueCache keyValueCache() {
+        return new InProcessKeyValueCache();
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public InstanceRegistry instanceRegistry() {
+        return new InProcessInstanceRegistry();
+    }
+}
@@ -0,0 +1,128 @@
+package stirling.software.common.cluster.inprocess;
+
+import java.time.Duration;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicLong;
+
+import stirling.software.common.cluster.DistributedLock;
+
+/**
+ * In-process {@link DistributedLock}, non-reentrant per the interface contract, with lease-expiry
+ * semantics that mirror a SET-NX-EX style distributed backend.
+ *
+ * <p>Each lock state carries a per-acquire {@code ownerToken} and an {@code expiryNanos}; another
+ * caller can take over once the lease has elapsed even if the original holder never called {@link
+ * LockHandle#release()}. This matters mostly for parity with the Valkey-backed implementation
+ * (Redis {@code SETEX} auto-expires the key); within a single JVM a crashed holder takes its lock
+ * state with it, but tests and code that rely on the {@code leaseTime} parameter still need it to
+ * be honored.
+ *
+ * <p>Expiry is lazy: an expired lock state lingers in the map until the next acquire attempt for
+ * the same key replaces it. Per-key cleanup also happens on explicit {@link LockHandle#release()},
+ * so a balanced acquire/release workload keeps the map size bounded.
+ */
+public class InProcessDistributedLock implements DistributedLock {
+
+    private final ConcurrentHashMap<String, LockState> locks = new ConcurrentHashMap<>();
+    private final AtomicLong tokenSeq = new AtomicLong();
+
+    /**
+     * Lease state for a single acquired lock. {@code ownerToken} prevents a former holder from
+     * releasing or renewing a lock now owned by someone else after lease expiry; {@code
+     * expiryNanos} is read/written only inside {@link ConcurrentHashMap#compute} so the bin lock
+     * provides the necessary happens-before guarantee.
+     */
+    private static final class LockState {
+        final long ownerToken;
+        long expiryNanos;
+
+        LockState(long ownerToken, long expiryNanos) {
+            this.ownerToken = ownerToken;
+            this.expiryNanos = expiryNanos;
+        }
+    }
+
+    @Override
+    public Optional<LockHandle> tryAcquire(String lockKey, Duration leaseTime) {
+        long token = tokenSeq.incrementAndGet();
+        long nowNanos = System.nanoTime();
+        long expiryNanos = nowNanos + leaseTime.toNanos();
+        boolean[] acquired = {false};
+        locks.compute(
+                lockKey,
+                (k, existing) -> {
+                    if (existing == null || existing.expiryNanos - nowNanos <= 0L) {
+                        // No lock, or the previous lease has expired - we take it. Subtraction
+                        // form avoids the long-overflow trap that would bite a naive
+                        // expiryNanos <= nowNanos comparison around System.nanoTime() rollover.
+                        acquired[0] = true;
+                        return new LockState(token, expiryNanos);
+                    }
+                    return existing;
+                });
+        if (!acquired[0]) {
+            return Optional.empty();
+        }
+        return Optional.of(new InProcessHandle(lockKey, token));
+    }
+
+    private void releaseInternal(String lockKey, long token) {
+        locks.compute(
+                lockKey,
+                (k, existing) -> {
+                    if (existing == null || existing.ownerToken != token) {
+                        // Already removed, expired-and-replaced, or never ours.
+                        return existing;
+                    }
+                    return null;
+                });
+    }
+
+    private boolean renewInternal(String lockKey, long token, Duration leaseTime) {
+        long nowNanos = System.nanoTime();
+        boolean[] renewed = {false};
+        locks.compute(
+                lockKey,
+                (k, existing) -> {
+                    if (existing == null
+                            || existing.ownerToken != token
+                            || existing.expiryNanos - nowNanos <= 0L) {
+                        // Lock is gone or expired; renewal is a no-op so the caller can detect it.
+                        return existing;
+                    }
+                    existing.expiryNanos = nowNanos + leaseTime.toNanos();
+                    renewed[0] = true;
+                    return existing;
+                });
+        return renewed[0];
+    }
+
+    private final class InProcessHandle implements LockHandle {
+        private final String lockKey;
+        private final long token;
+        private boolean released;
+
+        InProcessHandle(String lockKey, long token) {
+            this.lockKey = lockKey;
+            this.token = token;
+        }
+
+        @Override
+        public synchronized void release() {
+            if (released) {
+                return;
+            }
+            released = true;
+            releaseInternal(lockKey, token);
+        }
+
+        @Override
+        public synchronized boolean renew(Duration leaseTime) {
+            if (released) {
+                return false;
+            }
+            return renewInternal(lockKey, token, leaseTime);
+        }
+    }
+}
@@ -0,0 +1,42 @@
+package stirling.software.common.cluster.inprocess;
+
+import java.time.Duration;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
+
+import stirling.software.common.cluster.ClusterNode;
+import stirling.software.common.cluster.InstanceRegistry;
+
+public class InProcessInstanceRegistry implements InstanceRegistry {
+
+    private final AtomicReference<ClusterNode> self = new AtomicReference<>();
+
+    @Override
+    public void register(ClusterNode node, Duration heartbeatTtl) {
+        self.set(node);
+    }
+
+    @Override
+    public Optional<ClusterNode> lookup(String nodeId) {
+        ClusterNode current = self.get();
+        return current != null && current.nodeId().equals(nodeId)
+                ? Optional.of(current)
+                : Optional.empty();
+    }
+
+    @Override
+    public Collection<ClusterNode> activeNodes() {
+        ClusterNode current = self.get();
+        return current == null ? Collections.emptyList() : Collections.singletonList(current);
+    }
+
+    @Override
+    public void deregister(String nodeId) {
+        ClusterNode current = self.get();
+        if (current != null && current.nodeId().equals(nodeId)) {
+            self.set(null);
+        }
+    }
+}
@@ -0,0 +1,96 @@
+package stirling.software.common.cluster.inprocess;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.cluster.JobStore;
+import stirling.software.common.cluster.JobStoreEntry;
+
+@Slf4j
+public class InProcessJobStore implements JobStore {
+
+    private final ConcurrentHashMap<String, Holder> entries = new ConcurrentHashMap<>();
+
+    @Override
+    public void put(JobStoreEntry entry, Duration ttl) {
+        Instant expiry = ttl == null ? Instant.MAX : Instant.now().plus(ttl);
+        entries.put(entry.jobId(), new Holder(entry, expiry));
+    }
+
+    @Override
+    public Optional<JobStoreEntry> get(String jobId) {
+        Holder h = entries.get(jobId);
+        if (h == null) {
+            return Optional.empty();
+        }
+        if (h.isExpired()) {
+            entries.remove(jobId, h);
+            return Optional.empty();
+        }
+        return Optional.of(h.entry);
+    }
+
+    @Override
+    public void delete(String jobId) {
+        entries.remove(jobId);
+    }
+
+    @Override
+    public boolean exists(String jobId) {
+        return get(jobId).isPresent();
+    }
+
+    @Override
+    public Optional<String> findJobIdByFileId(String fileId) {
+        for (Map.Entry<String, Holder> e : entries.entrySet()) {
+            Holder h = e.getValue();
+            if (h.isExpired()) {
+                continue;
+            }
+            List<String> fileIds = h.entry.fileIds();
+            if (fileIds != null && fileIds.contains(fileId)) {
+                return Optional.of(e.getKey());
+            }
+        }
+        return Optional.empty();
+    }
+
+    @Override
+    public Collection<JobStoreEntry> all() {
+        List<JobStoreEntry> result = new ArrayList<>(entries.size());
+        for (Holder h : entries.values()) {
+            if (!h.isExpired()) {
+                result.add(h.entry);
+            }
+        }
+        return result;
+    }
+
+    /** Drop entries whose TTL has elapsed. Called by the {@code TaskManager} cleanup scheduler. */
+    public int purgeExpired() {
+        int removed = 0;
+        Instant now = Instant.now();
+        for (Map.Entry<String, Holder> e : entries.entrySet()) {
+            if (!e.getValue().expiry.equals(Instant.MAX) && e.getValue().expiry.isBefore(now)) {
+                if (entries.remove(e.getKey(), e.getValue())) {
+                    removed++;
+                }
+            }
+        }
+        return removed;
+    }
+
+    private record Holder(JobStoreEntry entry, Instant expiry) {
+        boolean isExpired() {
+            return !expiry.equals(Instant.MAX) && expiry.isBefore(Instant.now());
+        }
+    }
+}
@@ -0,0 +1,55 @@
+package stirling.software.common.cluster.inprocess;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+
+import stirling.software.common.cluster.KeyValueCache;
+
+public class InProcessKeyValueCache implements KeyValueCache {
+
+    private final ConcurrentHashMap<String, ConcurrentHashMap<String, Expiring>> namespaces =
+            new ConcurrentHashMap<>();
+
+    @Override
+    public void put(String namespace, String key, String value, Duration ttl) {
+        Instant expiry = ttl == null ? Instant.MAX : Instant.now().plus(ttl);
+        namespaces
+                .computeIfAbsent(namespace, n -> new ConcurrentHashMap<>())
+                .put(key, new Expiring(value, expiry));
+    }
+
+    @Override
+    public Optional<String> get(String namespace, String key) {
+        Map<String, Expiring> ns = namespaces.get(namespace);
+        if (ns == null) {
+            return Optional.empty();
+        }
+        Expiring e = ns.get(key);
+        if (e == null) {
+            return Optional.empty();
+        }
+        if (e.expiry.isBefore(Instant.now())) {
+            ns.remove(key, e);
+            return Optional.empty();
+        }
+        return Optional.of(e.value);
+    }
+
+    @Override
+    public void evict(String namespace, String key) {
+        Map<String, Expiring> ns = namespaces.get(namespace);
+        if (ns != null) {
+            ns.remove(key);
+        }
+    }
+
+    @Override
+    public void evictNamespace(String namespace) {
+        namespaces.remove(namespace);
+    }
+
+    private record Expiring(String value, Instant expiry) {}
+}
@@ -0,0 +1,49 @@
+package stirling.software.common.cluster.inprocess;
+
+import java.time.Duration;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import io.github.bucket4j.Bandwidth;
+import io.github.bucket4j.Bucket;
+import io.github.bucket4j.ConsumptionProbe;
+import io.github.bucket4j.local.LocalBucketBuilder;
+
+import stirling.software.common.cluster.RateLimitStore;
+
+/** Bucket4j-backed token bucket implementation of {@link RateLimitStore}. */
+public class InProcessRateLimitStore implements RateLimitStore {
+
+    /** Cap to bound memory; oldest accessed buckets are evicted. */
+    private static final int MAX_BUCKETS = 10_000;
+
+    private final Map<String, Bucket> buckets =
+            Collections.synchronizedMap(
+                    new LinkedHashMap<String, Bucket>(256, 0.75f, true) {
+                        @Override
+                        protected boolean removeEldestEntry(Map.Entry<String, Bucket> eldest) {
+                            return size() > MAX_BUCKETS;
+                        }
+                    });
+
+    @Override
+    public RateLimitDecision tryConsume(String bucketKey, long capacity, Duration refillPeriod) {
+        String compositeKey = bucketKey + "|" + capacity + "|" + refillPeriod.toNanos();
+        Bucket bucket =
+                buckets.computeIfAbsent(compositeKey, k -> buildBucket(capacity, refillPeriod));
+        ConsumptionProbe probe = bucket.tryConsumeAndReturnRemaining(1);
+        return new RateLimitDecision(
+                probe.isConsumed(),
+                probe.getRemainingTokens(),
+                probe.isConsumed() ? 0L : probe.getNanosToWaitForRefill());
+    }
+
+    private static Bucket buildBucket(long capacity, Duration refillPeriod) {
+        Bandwidth limit =
+                Bandwidth.builder().capacity(capacity).refillGreedy(capacity, refillPeriod).build();
+        LocalBucketBuilder builder = Bucket.builder();
+        builder.addLimit(limit);
+        return builder.build();
+    }
+}
@@ -0,0 +1,128 @@
+package stirling.software.common.cluster.inprocess;
+
+import java.io.BufferedInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.UUID;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.cluster.FileStore;
+
+/** Local-disk {@link FileStore} storing files under a base directory keyed by a UUID file id. */
+@Slf4j
+public class LocalDiskFileStore implements FileStore {
+
+    private final String baseDirPath;
+
+    public LocalDiskFileStore(String baseDirPath) {
+        this.baseDirPath = baseDirPath;
+    }
+
+    @Override
+    public Stored store(InputStream in, String originalName) throws IOException {
+        String fileId = UUID.randomUUID().toString();
+        Path filePath = resolve(fileId);
+        Files.createDirectories(filePath.getParent());
+        boolean success = false;
+        try {
+            long size = Files.copy(in, filePath);
+            success = true;
+            return new Stored(fileId, size);
+        } finally {
+            if (!success) {
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
+            }
+        }
+    }
+
+    /**
+     * File-to-file copy. {@link Files#copy(Path, Path, java.nio.file.CopyOption...)} can use {@code
+     * sendfile(2)} on Linux for a zero-copy kernel transfer when source and destination share a
+     * filesystem, avoiding the streaming overhead of pulling the bytes through the JVM heap. Reads
+     * the source size before copying so the post-copy stat is unnecessary.
+     */
+    @Override
+    public Stored store(Path source, String originalName) throws IOException {
+        String fileId = UUID.randomUUID().toString();
+        Path filePath = resolve(fileId);
+        Files.createDirectories(filePath.getParent());
+        long size = Files.size(source);
+        boolean success = false;
+        try {
+            Files.copy(source, filePath);
+            success = true;
+            return new Stored(fileId, size);
+        } finally {
+            if (!success) {
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
+            }
+        }
+    }
+
+    @Override
+    public InputStream retrieve(String fileId) throws IOException {
+        return new BufferedInputStream(Files.newInputStream(resolve(fileId)));
+    }
+
+    @Override
+    public byte[] retrieveBytes(String fileId) throws IOException {
+        Path filePath = resolve(fileId);
+        if (!Files.exists(filePath)) {
+            throw new IOException("File not found with ID: " + fileId);
+        }
+        return Files.readAllBytes(filePath);
+    }
+
+    @Override
+    public long size(String fileId) throws IOException {
+        Path filePath = resolve(fileId);
+        if (!Files.exists(filePath)) {
+            throw new IOException("File not found with ID: " + fileId);
+        }
+        return Files.size(filePath);
+    }
+
+    @Override
+    public boolean delete(String fileId) {
+        try {
+            return Files.deleteIfExists(resolve(fileId));
+        } catch (IOException e) {
+            log.error("Error deleting file with ID: {}", fileId, e);
+            return false;
+        }
+    }
+
+    @Override
+    public boolean exists(String fileId) {
+        return Files.exists(resolve(fileId));
+    }
+
+    public Path resolve(String fileId) {
+        if (fileId.contains("..") || fileId.contains("/") || fileId.contains("\\")) {
+            throw new IllegalArgumentException("Invalid file ID");
+        }
+        Path basePath = Path.of(baseDirPath).normalize().toAbsolutePath();
+        Path resolvedPath = basePath.resolve(fileId).normalize();
+        if (!resolvedPath.startsWith(basePath)) {
+            throw new IllegalArgumentException("File ID resolves to an invalid path");
+        }
+        return resolvedPath;
+    }
+}
@@ -0,0 +1,29 @@
+package stirling.software.common.cluster.inprocess;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import stirling.software.common.cluster.FileStore;
+
+/**
+ * Always-on wiring for the per-node local-disk {@link FileStore}. Active when {@code
+ * cluster.artifactStore=local} (the default; {@code matchIfMissing=true}). The S3 artifact-store
+ * supplies its own bean when {@code cluster.artifactStore=s3}.
+ */
+@Configuration
+@ConditionalOnProperty(
+        prefix = "cluster",
+        name = "artifactStore",
+        havingValue = "local",
+        matchIfMissing = true)
+public class LocalDiskFileStoreConfiguration {
+
+    @Bean
+    @ConditionalOnMissingBean
+    public FileStore fileStore(@Value("${stirling.tempDir:/tmp/stirling-files}") String tempDir) {
+        return new LocalDiskFileStore(tempDir);
+    }
+}
@@ -59,6 +59,18 @@ public class InstallationPathConfig {
    }

    private static String initializeBasePath() {
+        // Allow tests / harnesses to redirect the entire state tree (configs,
+        // backups, customFiles, pipeline, logs) to an isolated location via
+        // -Dstirling.base-path=... or STIRLING_BASE_PATH=... so a Playwright
+        // run never touches a developer's working state.
+        String override = System.getProperty("stirling.base-path");
+        if (override == null || override.isBlank()) {
+            override = System.getenv("STIRLING_BASE_PATH");
+        }
+        if (override != null && !override.isBlank()) {
+            boolean hasTrailingSeparator = override.endsWith("/") || override.endsWith("\\");
+            return hasTrailingSeparator ? override : override + File.separator;
+        }
        return "." + File.separator;
    }

@@ -0,0 +1,22 @@
+package stirling.software.common.enumeration;
+
+/**
+ * Standard resource-weight tiers for {@link
+ * stirling.software.common.annotations.AutoJobPostMapping#resourceWeight()}.
+ */
+public final class ResourceWeight {
+
+    /** Lightweight: rotate, page numbers, extract pages, permissions, etc. */
+    public static final int SMALL_WEIGHT = 1;
+
+    /** Medium: merge, split, multi-tool batch. */
+    public static final int MEDIUM_WEIGHT = 3;
+
+    /** Heavy: compress, OCR (small), conversions, raster. */
+    public static final int LARGE_WEIGHT = 5;
+
+    /** Extra heavy: OCR on large files, full-document re-render, AI-assisted edits. */
+    public static final int XLARGE_WEIGHT = 10;
+
+    private ResourceWeight() {}
+}
@@ -13,6 +13,7 @@ import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
 import java.util.Locale;
+import java.util.UUID;

 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
@@ -76,6 +77,8 @@ public class ApplicationProperties {
    private ProcessExecutor processExecutor = new ProcessExecutor();
    private PdfEditor pdfEditor = new PdfEditor();
    private AiEngine aiEngine = new AiEngine();
+    private InternalApi internalApi = new InternalApi();
+    private Cluster cluster = new Cluster();

    @Bean
    public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -96,7 +99,14 @@ public class ApplicationProperties {
        EncodedResource encodedResource = new EncodedResource(resource);
        PropertySource<?> propertySource =
                new YamlPropertySourceFactory().createPropertySource(null, encodedResource);
-        environment.getPropertySources().addFirst(propertySource);
+
+        boolean saasActive = Arrays.asList(environment.getActiveProfiles()).contains("saas");
+        if (saasActive) {
+            // Saas-pinned values in application-saas.properties must beat settings.yml.
+            environment.getPropertySources().addLast(propertySource);
+        } else {
+            environment.getPropertySources().addFirst(propertySource);
+        }

        log.debug("Loaded properties: {}", propertySource.getSource());

@@ -246,6 +256,119 @@ public class ApplicationProperties {
        private int longRunningTimeoutSeconds = 600;
    }

+    /**
+     * Cluster backplane configuration. All keys live under the top-level {@code cluster.*} prefix
+     * (e.g. env var {@code CLUSTER_ENABLED}). The master switch is {@link #enabled} and defaults to
+     * off; when off the in-process backplane is wired and no other cluster keys are required.
+     */
+    @Data
+    public static class Cluster {
+
+        /** Master switch. When {@code false} (default) the in-process backplane is wired. */
+        private boolean enabled = false;
+
+        /** Backplane implementation selector. Valid values: {@code inprocess} | {@code valkey}. */
+        private String backplane = "inprocess";
+
+        /**
+         * Transient cluster job-artifact store selector. Valid values: {@code local} | {@code s3}.
+         *
+         * <p>This is distinct from {@code storage.provider}, which selects the backend for
+         * persistent user-uploaded files. The two switches exist because the user-facing storage
+         * feature is optional ({@code storage.enabled=false} is common) but every multi-node
+         * cluster still needs a shared artifact store to serve cross-node downloads. Both
+         * implementations share credentials from {@code storage.s3.*} when set to {@code s3}.
+         */
+        private String artifactStore = "local";
+
+        private Valkey valkey = new Valkey();
+        private Node node = new Node();
+
+        private transient String cachedNodeId;
+
+        public NodeRole resolvedRole() {
+            if (node == null || node.getRole() == null) {
+                return NodeRole.BOTH;
+            }
+            String value = node.getRole().trim().toUpperCase(Locale.ROOT);
+            try {
+                return NodeRole.valueOf(value);
+            } catch (IllegalArgumentException ex) {
+                return NodeRole.BOTH;
+            }
+        }
+
+        public synchronized String resolvedNodeId() {
+            if (node != null && node.getId() != null && !node.getId().isBlank()) {
+                return node.getId();
+            }
+            if (cachedNodeId == null) {
+                cachedNodeId = UUID.randomUUID().toString();
+            }
+            return cachedNodeId;
+        }
+
+        public enum NodeRole {
+            WEB,
+            WORKER,
+            BOTH
+        }
+
+        @Data
+        public static class Valkey {
+            /**
+             * {@code redis://host:6379} or {@code rediss://...} for TLS. Required when cluster mode
+             * is on and backplane is valkey.
+             */
+            private String url = "";
+
+            private Tls tls = new Tls();
+
+            @Data
+            public static class Tls {
+                /**
+                 * When {@code true}, skip Valkey/Redis TLS certificate verification (dev/test
+                 * only). Leave {@code false} in production.
+                 */
+                private boolean skipCertVerification = false;
+            }
+        }
+
+        @Data
+        public static class Node {
+            /** Optional explicit node id. Blank = auto-generated UUID at startup. */
+            private String id = "";
+
+            /** {@code web} | {@code worker} | {@code both}. */
+            private String role = "both";
+
+            /**
+             * Internal cluster address advertised in the instance registry (host:port). Blank =
+             * derived at startup.
+             */
+            private String internalAddress = "";
+
+            /** {@code http} | {@code https} - scheme used when peers call this node. */
+            private String scheme = "http";
+
+            /** Heartbeat publish interval for the instance registry, in milliseconds. */
+            private long heartbeatIntervalMs = 5000;
+        }
+    }
+
+    /**
+     * HTTP timeouts for loopback calls to internal Stirling API endpoints, used by the AI workflow
+     * executor and the pipeline processor. A bounded read timeout prevents a hung tool (e.g. an
+     * infinite loop in a PDF processing service) from stalling the entire chat workflow forever.
+     * Tools that legitimately need longer than the read timeout should be invoked through the async
+     * job executor instead of synchronously.
+     */
+    @Data
+    public static class InternalApi {
+        private int connectTimeoutSeconds = 10;
+        private int readTimeoutSeconds = 300;
+    }
+
    @Data
    public static class Legal {
        private String termsAndConditions;
@@ -405,6 +528,16 @@ public class ApplicationProperties {
            private String provider;
            private Client client = new Client();

+            /**
+             * When true, the OAuth2/OIDC login flow logs the full set of ID token and UserInfo
+             * claims at INFO level (and again at ERROR level if the username attribute cannot be
+             * resolved). Used to diagnose provider misconfiguration (for example ADFS not returning
+             * an {@code email} claim). WARNING: writes PII (sub, email, name) to application logs.
+             * Leave disabled in production; enable only while actively troubleshooting and disable
+             * again afterwards.
+             */
+            private Boolean debugLogging = false;
+
            public void setScopes(String scopes) {
                List<String> scopesList =
                        Arrays.stream(scopes.split(",")).map(String::trim).toList();
@@ -655,6 +788,7 @@ public class ApplicationProperties {
        private boolean enabled = false;
        private String provider = "local";
        private Local local = new Local();
+        private S3 s3 = new S3();
        private Quotas quotas = new Quotas();
        private Sharing sharing = new Sharing();
        private Signing signing = new Signing();
@@ -664,6 +798,57 @@ public class ApplicationProperties {
            private String basePath = InstallationPathConfig.getPath() + "storage";
        }

+        @Data
+        public static class S3 {
+            /**
+             * Optional custom endpoint (e.g. {@code https://<account>.r2.cloudflarestorage.com},
+             * {@code https://<project>.supabase.co/storage/v1/s3}, or {@code http://localhost:9000}
+             * for MinIO). Blank = use AWS regional default.
+             */
+            private String endpoint = "";
+
+            private String bucket = "";
+
+            private String region = "us-east-1";
+
+            private String accessKey = "";
+            private String secretKey = "";
+
+            /**
+             * When {@code true} use path-style URLs ({@code <endpoint>/<bucket>/<key>}) instead of
+             * virtual-hosted ({@code <bucket>.<endpoint>/<key>}). MinIO and most S3-compatible
+             * gateways require path-style; AWS S3 prefers virtual-hosted.
+             */
+            private boolean pathStyleAccess = false;
+
+            /**
+             * When {@code false} (default), {@code endpoint} hostnames that resolve to private,
+             * loopback, or link-local addresses are rejected at startup to block SSRF attacks via
+             * the cloud metadata service (e.g. {@code http://169.254.169.254/}). Set to {@code
+             * true} to opt in for MinIO / in-cluster S3 endpoints on private networks.
+             */
+            private boolean allowPrivateEndpoints = false;
+
+            /**
+             * Controls when the SDK adds an {@code x-amz-checksum-*} header on PUT/UploadPart.
+             * Default {@code WHEN_SUPPORTED} (the SDK default since 2.30) makes the SDK send a
+             * CRC32 checksum on every upload - this works on AWS S3, MinIO, current Supabase,
+             * Backblaze B2 (post-July-2025), and modern R2. Set to {@code WHEN_REQUIRED} to
+             * suppress the auto-checksum on vendors that reject unknown {@code x-amz-checksum-*}
+             * headers (older Backblaze B2, some R2 corner cases, GCS S3 endpoint). Invalid values
+             * fall back to {@code WHEN_SUPPORTED}.
+             */
+            private String requestChecksumCalculation = "WHEN_SUPPORTED";
+
+            /**
+             * Controls when the SDK validates returned {@code x-amz-checksum-*} headers on GET
+             * responses. Default {@code WHEN_SUPPORTED}. Set to {@code WHEN_REQUIRED} if your
+             * vendor never returns these headers and you see false-positive checksum-mismatch
+             * errors. Invalid values fall back to {@code WHEN_SUPPORTED}.
+             */
+            private String responseChecksumValidation = "WHEN_SUPPORTED";
+        }
+
        @Data
        public static class Sharing {
            private boolean enabled = false;
@@ -14,7 +14,6 @@ import lombok.NoArgsConstructor;
@Data
@NoArgsConstructor
@EqualsAndHashCode
-@Schema(description = "PDF file input - either upload a file or provide a server-side file ID")
 public class PDFFile {

    @Schema(
@@ -0,0 +1,19 @@
+package stirling.software.common.model.api.general;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import lombok.Data;
+import lombok.EqualsAndHashCode;
+
+@Data
+@EqualsAndHashCode
+public class EditTextOperation {
+
+    @Schema(description = "The literal text to find.", requiredMode = Schema.RequiredMode.REQUIRED)
+    private String find;
+
+    @Schema(
+            description = "The replacement text. May be empty to delete the matched text.",
+            requiredMode = Schema.RequiredMode.REQUIRED)
+    private String replace;
+}
@@ -0,0 +1,26 @@
+package stirling.software.common.model.enumeration;
+
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+
+/** Team invitation status */
+@Getter
+@RequiredArgsConstructor
+public enum InvitationStatus {
+    PENDING("PENDING"),
+    ACCEPTED("ACCEPTED"),
+    REJECTED("REJECTED"),
+    CANCELLED("CANCELLED"),
+    EXPIRED("EXPIRED");
+
+    private final String statusName;
+
+    public static InvitationStatus fromString(String statusName) {
+        for (InvitationStatus status : InvitationStatus.values()) {
+            if (status.getStatusName().equalsIgnoreCase(statusName)) {
+                return status;
+            }
+        }
+        throw new IllegalArgumentException("No InvitationStatus defined for name: " + statusName);
+    }
+}
@@ -16,6 +16,9 @@ public enum Role {
    // Unlimited access
    USER("ROLE_USER", Integer.MAX_VALUE, Integer.MAX_VALUE, "adminUserSettings.user"),

+    // Paid tier; set by Stripe webhooks under saas mode.
+    PRO_USER("ROLE_PRO_USER", Integer.MAX_VALUE, Integer.MAX_VALUE, "adminUserSettings.proUser"),
+
    // 40 API calls Per Day, 40 web calls
    LIMITED_API_USER("ROLE_LIMITED_API_USER", 40, 40, "adminUserSettings.apiUser"),

@@ -0,0 +1,26 @@
+package stirling.software.common.model.enumeration;
+
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+
+/**
+ * Team membership roles LEADER: Can invite/remove members, manage settings, view usage, manage
+ * billing MEMBER: Regular team member with standard access
+ */
+@Getter
+@RequiredArgsConstructor
+public enum TeamRole {
+    LEADER("LEADER"),
+    MEMBER("MEMBER");
+
+    private final String roleName;
+
+    public static TeamRole fromString(String roleName) {
+        for (TeamRole role : TeamRole.values()) {
+            if (role.getRoleName().equalsIgnoreCase(roleName)) {
+                return role;
+            }
+        }
+        throw new IllegalArgumentException("No TeamRole defined for name: " + roleName);
+    }
+}
@@ -1,15 +1,13 @@
 package stirling.software.common.service;

-import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.OutputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.UUID;
+import java.io.PipedInputStream;
+import java.io.PipedOutputStream;
+import java.util.concurrent.Executors;
+import java.util.concurrent.atomic.AtomicReference;

-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
@@ -18,9 +16,11 @@ import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBo
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

+import stirling.software.common.cluster.FileStore;
+
 /**
 * Service for storing and retrieving files with unique file IDs. Used by the AutoJobPostMapping
- * system to handle file references.
+ * system to handle file references. Disk I/O is delegated to the injected {@link FileStore} bean.
 */
@Service
@RequiredArgsConstructor
@@ -30,251 +30,150 @@ public class FileStorage {
    /** Holds the result of a stream-to-disk store operation: the file ID and the bytes written. */
    public record StoredFile(String fileId, long size) {}

-    @Value("${stirling.tempDir:/tmp/stirling-files}")
-    private String tempDirPath;
-
    private final FileOrUploadService fileOrUploadService;
+    private final FileStore fileStore;

-    /**
-     * Store a file and return its unique ID
-     *
-     * @param file The file to store
-     * @return The unique ID assigned to the file
-     * @throws IOException If there is an error storing the file
-     */
    public String storeFile(MultipartFile file) throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-
-        // Ensure the directory exists
-        Files.createDirectories(filePath.getParent());
-
-        // Transfer the file to the storage location
-        file.transferTo(filePath.toFile());
-
-        log.debug("Stored file with ID: {}", fileId);
-        return fileId;
-    }
-
-    /**
-     * Store a byte array as a file and return its unique ID
-     *
-     * @param bytes The byte array to store
-     * @param originalName The original name of the file (for extension)
-     * @return The unique ID assigned to the file
-     * @throws IOException If there is an error storing the file
-     */
-    public String storeBytes(byte[] bytes, String originalName) throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-
-        // Ensure the directory exists
-        Files.createDirectories(filePath.getParent());
-
-        // Write the bytes to the file
-        Files.write(filePath, bytes);
-
-        log.debug("Stored byte array with ID: {}", fileId);
-        return fileId;
-    }
-
-    /**
-     * Retrieve a file by its ID as a MultipartFile
-     *
-     * @param fileId The ID of the file to retrieve
-     * @return The file as a MultipartFile
-     * @throws IOException If the file doesn't exist or can't be read
-     */
-    public MultipartFile retrieveFile(String fileId) throws IOException {
-        Path filePath = getFilePath(fileId);
-
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found with ID: " + fileId);
+        // Fast path: when Spring buffered the multipart to disk (typical for large uploads), the
+        // backing Resource exposes a real File. Hand the Path to the FileStore so it can do a
+        // file-to-file copy (Linux sendfile, no copy through Java heap) rather than streaming
+        // the bytes through an 8K buffer. Falls back to the InputStream path for in-memory
+        // multiparts, exotic Resource impls, and anything that does not back onto a File.
+        Resource res;
+        try {
+            res = file.getResource();
+        } catch (RuntimeException ignored) {
+            res = null;
        }
+        if (res != null && res.isFile()) {
+            try {
+                FileStore.Stored stored =
+                        fileStore.store(res.getFile().toPath(), file.getOriginalFilename());
+                log.debug("Stored file with ID: {} (fast path)", stored.fileId());
+                return stored.fileId();
+            } catch (IOException ex) {
+                // Some Resource impls advertise isFile()=true but throw on getFile(); fall through.
+                log.debug("Resource fast path failed, falling back to stream copy", ex);
+            }
+        }
+        try (InputStream in = file.getInputStream()) {
+            FileStore.Stored stored = fileStore.store(in, file.getOriginalFilename());
+            log.debug("Stored file with ID: {}", stored.fileId());
+            return stored.fileId();
+        }
+    }

-        byte[] fileData = Files.readAllBytes(filePath);
+    public String storeBytes(byte[] bytes, String originalName) throws IOException {
+        FileStore.Stored stored = fileStore.store(new ByteArrayInputStream(bytes), originalName);
+        log.debug("Stored byte array with ID: {}", stored.fileId());
+        return stored.fileId();
+    }
+
+    public MultipartFile retrieveFile(String fileId) throws IOException {
+        byte[] fileData = fileStore.retrieveBytes(fileId);
        return fileOrUploadService.toMockMultipartFile(fileId, fileData);
    }

-    /**
-     * Retrieve a file by its ID as a byte array
-     *
-     * @param fileId The ID of the file to retrieve
-     * @return The file as a byte array
-     * @throws IOException If the file doesn't exist or can't be read
-     */
    public byte[] retrieveBytes(String fileId) throws IOException {
-        Path filePath = getFilePath(fileId);
-
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found with ID: " + fileId);
-        }
-
-        return Files.readAllBytes(filePath);
+        return fileStore.retrieveBytes(fileId);
    }

-    /**
-     * Retrieve a file by its ID as a streaming InputStream. The caller is responsible for closing
-     * the returned stream.
-     *
-     * @param fileId The ID of the file to retrieve
-     * @return A buffered InputStream for the file
-     * @throws IOException If the file doesn't exist or can't be read
-     */
    public InputStream retrieveInputStream(String fileId) throws IOException {
-        Path filePath = getFilePath(fileId);
-        // Let Files.newInputStream throw NoSuchFileException naturally — avoids TOCTOU race
-        // between exists-check and open when another thread may delete concurrently.
-        return new BufferedInputStream(Files.newInputStream(filePath));
+        return fileStore.retrieve(fileId);
    }

-    /**
-     * Store data from an InputStream as a file and return its unique ID and byte count. Streams
-     * directly to disk without buffering the entire content in heap.
-     *
-     * @param inputStream The input stream to read from
-     * @param originalName The original name of the file (unused, kept for API symmetry)
-     * @return A {@link StoredFile} containing the file ID and the number of bytes written
-     * @throws IOException If there is an error storing the file
-     */
    public StoredFile storeInputStream(InputStream inputStream, String originalName)
            throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        long size = Files.copy(inputStream, filePath);
-        log.debug("Stored input stream with ID: {}", fileId);
-        return new StoredFile(fileId, size);
+        FileStore.Stored stored = fileStore.store(inputStream, originalName);
+        log.debug("Stored input stream with ID: {}", stored.fileId());
+        return new StoredFile(stored.fileId(), stored.size());
    }

    public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
            throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        boolean success = false;
-        try (OutputStream os = new BufferedOutputStream(Files.newOutputStream(filePath))) {
-            body.writeTo(os);
-            success = true;
-        } finally {
-            if (!success) {
+        // Hold Throwable not IOException: an unchecked failure (NPE, IllegalState, OOM, etc.)
+        // from the body writer would otherwise close the pipe with EOF and the consumer would
+        // return a truncated file with no error surfaced to the caller.
+        AtomicReference<Throwable> bodyError = new AtomicReference<>();
+        try (PipedOutputStream out = new PipedOutputStream();
+                PipedInputStream in = new PipedInputStream(out, 8192)) {
+            var executor = Executors.newSingleThreadExecutor(Thread.ofVirtual().factory());
+            java.util.concurrent.Future<?> task = null;
+            try {
+                task =
+                        executor.submit(
+                                () -> {
+                                    try {
+                                        body.writeTo(out);
+                                    } catch (Throwable ex) {
+                                        bodyError.set(ex);
+                                    } finally {
+                                        try {
+                                            out.close();
+                                        } catch (IOException ignored) {
+                                            // closed on the consumer side too
+                                        }
+                                    }
+                                });
+                FileStore.Stored stored = fileStore.store(in, originalName);
+                Throwable writerErr = bodyError.get();
+                if (writerErr != null) {
+                    // Body failed mid-write: the FileStore persisted a truncated entry.
+                    // Best-effort delete so we don't leak partial files; never let cleanup
+                    // mask the original writer error.
+                    try {
+                        fileStore.delete(stored.fileId());
+                    } catch (RuntimeException cleanupEx) {
+                        log.warn(
+                                "Failed to delete partial file {} after writer error: {}",
+                                stored.fileId(),
+                                cleanupEx.getMessage());
+                    }
+                    if (writerErr instanceof IOException ioe) {
+                        throw ioe;
+                    }
+                    throw new IOException(
+                            "StreamingResponseBody writer failed: " + writerErr.getMessage(),
+                            writerErr);
+                }
+                log.debug("Stored StreamingResponseBody with ID: {}", stored.fileId());
+                return stored.fileId();
+            } finally {
+                // Interrupt and join the writer task: shutdown() alone returns immediately and a
+                // failed store leaves the writer running, leaking a thread per failed upload.
+                if (task != null && !task.isDone()) {
+                    task.cancel(true);
+                }
+                executor.shutdown();
                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
+                    if (!executor.awaitTermination(5, java.util.concurrent.TimeUnit.SECONDS)) {
+                        executor.shutdownNow();
+                    }
+                } catch (InterruptedException ie) {
+                    executor.shutdownNow();
+                    Thread.currentThread().interrupt();
                }
            }
        }
-        log.debug("Stored StreamingResponseBody with ID: {}", fileId);
-        return fileId;
    }

-    /**
-     * Persist a {@link Resource} body to disk, returning the generated file ID. Used by the async
-     * job pipeline to capture {@code ResponseEntity<Resource>} results produced by controllers.
-     */
    public String storeFromResource(Resource resource, String originalName) throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        boolean success = false;
        try (InputStream in = resource.getInputStream()) {
-            Files.copy(in, filePath);
-            success = true;
-        } finally {
-            if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
-            }
+            FileStore.Stored stored = fileStore.store(in, originalName);
+            log.debug("Stored Resource with ID: {}", stored.fileId());
+            return stored.fileId();
        }
-        log.debug("Stored Resource with ID: {}", fileId);
-        return fileId;
    }

-    /**
-     * Delete a file by its ID
-     *
-     * @param fileId The ID of the file to delete
-     * @return true if the file was deleted, false otherwise
-     */
    public boolean deleteFile(String fileId) {
-        try {
-            Path filePath = getFilePath(fileId);
-            return Files.deleteIfExists(filePath);
-        } catch (IOException e) {
-            log.error("Error deleting file with ID: {}", fileId, e);
-            return false;
-        }
+        return fileStore.delete(fileId);
    }

-    /**
-     * Check if a file exists by its ID
-     *
-     * @param fileId The ID of the file to check
-     * @return true if the file exists, false otherwise
-     */
    public boolean fileExists(String fileId) {
-        Path filePath = getFilePath(fileId);
-        return Files.exists(filePath);
+        return fileStore.exists(fileId);
    }

-    /**
-     * Get the size of a file by its ID without loading the content into memory
-     *
-     * @param fileId The ID of the file
-     * @return The size of the file in bytes
-     * @throws IOException If the file doesn't exist or can't be read
-     */
    public long getFileSize(String fileId) throws IOException {
-        Path filePath = getFilePath(fileId);
-
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found with ID: " + fileId);
-        }
-
-        return Files.size(filePath);
-    }
-
-    /**
-     * Get the path for a file ID
-     *
-     * @param fileId The ID of the file
-     * @return The path to the file
-     * @throws IllegalArgumentException if fileId contains path traversal characters or resolves
-     *     outside base directory
-     */
-    private Path getFilePath(String fileId) {
-        // Validate fileId to prevent path traversal
-        if (fileId.contains("..") || fileId.contains("/") || fileId.contains("\\")) {
-            throw new IllegalArgumentException("Invalid file ID");
-        }
-
-        Path basePath = Path.of(tempDirPath).normalize().toAbsolutePath();
-        Path resolvedPath = basePath.resolve(fileId).normalize();
-
-        // Ensure resolved path is within the base directory
-        if (!resolvedPath.startsWith(basePath)) {
-            throw new IllegalArgumentException("File ID resolves to an invalid path");
-        }
-
-        return resolvedPath;
-    }
-
-    /**
-     * Generate a unique file ID
-     *
-     * @return A unique file ID
-     */
-    private String generateFileId() {
-        return UUID.randomUUID().toString();
+        return fileStore.size(fileId);
    }
 }
--- a/Show More
+++ b/Show More