Add controller endpoints for the DocParse editor tools

.devcontainer/devcontainer.json

@@ -119,6 +119,8 @@
             "extensions": [
                 "elagil.pre-commit-helper", // Support for pre-commit hooks to enforce code quality
                 "josevseb.google-java-format-for-vs-code", // Google Java code formatter to follow the Google Java Style Guide
+                "ms-python.black-formatter", // Python code formatter using Black
+                "ms-python.flake8", // Flake8 linter for Python to enforce code quality
                 "ms-python.python", // Official Microsoft Python extension with IntelliSense, debugging, and Jupyter support
                 "ms-vscode-remote.vscode-remote-extensionpack", // Remote Development Pack for SSH, WSL, and Containers
                 // "Oracle.oracle-java", // Oracle Java extension with additional features for Java development

.dockerignore

@@ -96,14 +96,6 @@ configs/
 __pycache__/
 **/__pycache__/
 
-# Python virtualenvs. Large, platform-specific, and their symlinks break the build.
-.venv/
-**/.venv/
-venv/
-**/venv/
-*.egg-info/
-**/*.egg-info/
-
 # Local env
 .env
 .env.*

.editorconfig

@@ -22,15 +22,26 @@ indent_size = 4
 
 [*.html]
 indent_size = 2
+insert_final_newline = false
+trim_trailing_whitespace = false
 
-[{*.js,*.jsx,*.mjs,*.ts,*.tsx,*.mts}]
+[{*.js,*.jsx,*.mjs,*.ts,*.tsx}]
 indent_size = 2
 
 [*.css]
+# CSS files typically use an indent size of 2 spaces for better readability and alignment with community standards.
 indent_size = 2
 
 [*.{yml,yaml}]
+# YAML files use an indent size of 2 spaces to maintain consistency with common YAML formatting practices.
+indent_size = 2
+insert_final_newline = false
+trim_trailing_whitespace = false
+
+[*.json]
+# JSON files use an indent size of 2 spaces, which is the standard for JSON formatting.
 indent_size = 2
 
-[*.{json,jsonc}]
+[*.jsonc]
+# JSONC (JSON with comments) files also follow the standard JSON formatting with an indent size of 2 spaces.
 indent_size = 2

.github/CODEOWNERS

@@ -1,28 +1,18 @@
-# Review ownership is assigned to teams where possible.
-# Teams can only contain org members, so outside collaborators are listed by hand.
-#
-#   @Stirling-Tools/maintainers          - Frooodle, jbrunton96, ConnorYoh
-#   @Stirling-Tools/backend-reviewers    - Frooodle, jbrunton96, ConnorYoh
-#   @Stirling-Tools/frontend-reviewers   - Frooodle, jbrunton96, ConnorYoh, reecebrowne, EthanHealy01
-#   @Stirling-Tools/devops-reviewers     - Frooodle, jbrunton96, ConnorYoh
-#   @Stirling-Tools/all                  - all of the above
-#
-# Outside collaborators (need Write access to count as owners): @Ludy87 @balazs-szucs
-
-# Default owners for everything
-* @Stirling-Tools/maintainers @Ludy87
+# All PRs must be approved by Frooodle or Ludy87
+* @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
 
 # Backend
-/app/** @Stirling-Tools/backend-reviewers @Ludy87 @balazs-szucs
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs
 
-# V2 frontend
-/frontend/** @Stirling-Tools/frontend-reviewers @balazs-szucs
-/app/core/src/main/resources/static/** @Stirling-Tools/frontend-reviewers @Ludy87 @balazs-szucs
+#V2 frontend
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
 
-# V2 docker
-/docker/backend/** @Stirling-Tools/devops-reviewers @Ludy87
-/docker/frontend/** @Stirling-Tools/frontend-reviewers @Stirling-Tools/devops-reviewers @Ludy87
-/docker/compose/** @Stirling-Tools/frontend-reviewers @Stirling-Tools/devops-reviewers @Ludy87
+#V2 docker
+/docker/backend/** @Frooodle @Ludy87 @DarioGii
+/docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
 
-# GHA (all users)
-/.github/** @Stirling-Tools/all @Ludy87 @balazs-szucs
+
+#GHA (All users)
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs

.github/ISSUE_TEMPLATE/1-bug.yml

@@ -98,13 +98,6 @@ body:
       description: |
         If you have any additional information that might help us understand and resolve the issue, provide it here.
 
-  - type: textarea
-    id: sample-files
-    attributes:
-      label: Sample Files
-      description: |
-        If possible, attach the PDF or other input files needed to reproduce the issue. Remove any sensitive information before sharing.
-
   - type: markdown
     attributes:
       value: |

.github/ISSUE_TEMPLATE/2-feature.yml

@@ -67,13 +67,6 @@ body:
       description: |
         If you have any additional information, comments, or resources you think would support or be relevant to your feature request, include them here.
 
-  - type: textarea
-    id: sample-files
-    attributes:
-      label: Example Files
-      description: |
-        If the feature request depends on specific PDFs or other example files, attach them here when available. Remove any sensitive information before sharing.
-
   - type: checkboxes
     id: search-confirmation
     attributes:

.github/actions/java/action.yml

@@ -1,147 +0,0 @@
-name: Local Java
-description: Configure the JDK already installed on the GitHub Actions runner
-inputs:
-  java-version:
-    description: JDK major version
-    required: false
-    default: "25"
-  distribution:
-    description: Java distribution to use
-    required: false
-    default: temurin
-  architecture:
-    description: Target architecture (x64 or arm64)
-    required: false
-    default: ""
-runs:
-  using: composite
-  steps:
-    - name: Configure preinstalled JDK
-      shell: bash
-      env:
-        JAVA_VERSION: ${{ inputs.java-version }}
-        JAVA_DISTRIBUTION: ${{ inputs.distribution }}
-        JAVA_ARCHITECTURE: ${{ inputs.architecture }}
-        RUNNER_ARCHITECTURE: ${{ runner.arch }}
-        RUNNER_OS_NAME: ${{ runner.os }}
-        TEMURIN_VERSION: 25.0.4+7
-        TEMURIN_RELEASE_TAG: jdk-25.0.4%2B7
-        TEMURIN_X64_ARCHIVE: OpenJDK25U-jdk_x64_mac_hotspot_25.0.4_7.tar.gz
-        TEMURIN_X64_SHA256: a5ac9c46dad47ac06df35e36d096913195d8da1f3f71918828bcc2cfe33869b7
-        TEMURIN_ARM64_ARCHIVE: OpenJDK25U-jdk_aarch64_mac_hotspot_25.0.4_7.tar.gz
-        TEMURIN_ARM64_SHA256: 5a101c54abf5a9f16c0f70d8c38ba99e6567c1ba213378f0bb04497284f051bd
-      run: |
-        set -euo pipefail
-        if [ "${JAVA_VERSION}" != "25" ]; then
-          echo "This repository requires JDK 25; received ${JAVA_VERSION}" >&2
-          exit 1
-        fi
-
-        distribution="$(printf '%s' "${JAVA_DISTRIBUTION}" | tr '[:upper:]' '[:lower:]')"
-        case "${distribution}" in
-          temurin|microsoft) ;;
-          *)
-            echo "Unsupported Java distribution: ${JAVA_DISTRIBUTION}. Supported: temurin, microsoft" >&2
-            exit 1
-            ;;
-        esac
-
-        java_home_is_valid() {
-          candidate="$1"
-          [ -x "${candidate}/bin/java" ] || return 1
-          version_output="$(${candidate}/bin/java -version 2>&1)"
-          printf '%s\n' "${version_output}" | grep -Eq "version \"${JAVA_VERSION}(\\.|\")" || return 1
-          case "${distribution}" in
-            temurin) printf '%s\n' "${version_output}" | grep -Eiq "Temurin|Eclipse Adoptium" ;;
-            microsoft) printf '%s\n' "${version_output}" | grep -Eiq "Microsoft" ;;
-          esac
-        }
-
-        architecture="${JAVA_ARCHITECTURE}"
-        if [ -z "${architecture}" ]; then
-          architecture="${RUNNER_ARCHITECTURE}"
-        fi
-        normalized_architecture="$(printf '%s' "${architecture}" | tr '[:lower:]' '[:upper:]')"
-        case "${normalized_architecture}" in
-          X64|AMD64|X86_64) architecture=X64 ;;
-          ARM64|AARCH64) architecture=ARM64 ;;
-          *) echo "Unsupported runner architecture: ${architecture}" >&2; exit 1 ;;
-        esac
-
-        runner_architecture="$(printf '%s' "${RUNNER_ARCHITECTURE}" | tr '[:lower:]' '[:upper:]')"
-        if [ "${RUNNER_OS_NAME}" = "macOS" ] && [ -n "${JAVA_HOME:-}" ]; then
-          runner_java_binary="${JAVA_HOME}/bin/java"
-          if [ "${runner_architecture}" = "ARM64" ] && file "${runner_java_binary}" | grep -q "arm64"; then
-            echo "JAVA_HOME_${JAVA_VERSION}_ARM64=${JAVA_HOME}" >> "${GITHUB_ENV}"
-          elif [ "${runner_architecture}" = "X64" ] && file "${runner_java_binary}" | grep -q "x86_64"; then
-            echo "JAVA_HOME_${JAVA_VERSION}_X64=${JAVA_HOME}" >> "${GITHUB_ENV}"
-          fi
-        fi
-
-        java_home_variable="JAVA_HOME_${JAVA_VERSION}_${architecture}"
-        java_home="${!java_home_variable:-}"
-        if [ -z "${java_home}" ] && [ "${RUNNER_OS_NAME}" = "macOS" ]; then
-          if [ "${architecture}" = "${runner_architecture}" ] && [ -n "${JAVA_HOME:-}" ]; then
-            java_home="${JAVA_HOME}"
-          fi
-        fi
-        if [ -z "${java_home}" ] && [ "${RUNNER_OS_NAME}" = "macOS" ] && [ "${architecture}" = "X64" ] && [ "${distribution}" = "temurin" ]; then
-          java_home="$(arch -x86_64 /usr/libexec/java_home -v "${JAVA_VERSION}" 2>/dev/null || true)"
-        fi
-        if [ -n "${java_home}" ] && [ "${RUNNER_OS_NAME}" = "macOS" ]; then
-          java_binary="${java_home}/bin/java"
-          if [ "${architecture}" = "X64" ] && ! file "${java_binary}" | grep -q "x86_64"; then
-            java_home=""
-          elif [ "${architecture}" = "ARM64" ] && ! file "${java_binary}" | grep -q "arm64"; then
-            java_home=""
-          fi
-        fi
-        if [ -n "${java_home}" ] && ! java_home_is_valid "${java_home}"; then
-          echo "Ignoring ${java_home_variable}: it does not provide ${distribution} JDK ${JAVA_VERSION}" >&2
-          java_home=""
-        fi
-        if [ -z "${java_home}" ] && [ "${RUNNER_OS_NAME}" = "macOS" ] && [ "${distribution}" = "temurin" ] && { [ "${architecture}" = "X64" ] || [ "${architecture}" = "ARM64" ]; }; then
-          jdk_version="${TEMURIN_VERSION}"
-          if [ "${architecture}" = "X64" ]; then
-            jdk_archive="${TEMURIN_X64_ARCHIVE}"
-            jdk_sha256="${TEMURIN_X64_SHA256}"
-          else
-            jdk_archive="${TEMURIN_ARM64_ARCHIVE}"
-            jdk_sha256="${TEMURIN_ARM64_SHA256}"
-          fi
-          jdk_root="${RUNNER_TEMP}/stirling-temurin-${jdk_version}-${architecture}"
-          archive_path="${jdk_root}/${jdk_archive}"
-          mkdir -p "${jdk_root}"
-          if [ ! -f "${archive_path}" ]; then
-            curl --fail --location --retry 3 --retry-delay 2 \
-              --output "${archive_path}" \
-              "https://github.com/adoptium/temurin25-binaries/releases/download/${TEMURIN_RELEASE_TAG}/${jdk_archive}"
-          fi
-          printf '%s  %s\n' "${jdk_sha256}" "${archive_path}" | shasum -a 256 -c -
-          if [ ! -x "${jdk_root}/Contents/Home/bin/jlink" ]; then
-            rm -rf "${jdk_root}/Contents"
-            tar -xzf "${archive_path}" -C "${jdk_root}"
-          fi
-          java_home="$(find "${jdk_root}" -type d -path '*/Contents/Home' -print -quit)"
-        fi
-        if [ -z "${java_home}" ]; then
-          echo "JDK ${JAVA_VERSION} (${distribution}, ${architecture}) is not installed on this runner (${java_home_variable} is missing)" >&2
-          exit 1
-        fi
-
-        shell_java_home="${java_home}"
-        if command -v cygpath >/dev/null 2>&1; then
-          shell_java_home="$(cygpath --unix "${java_home}")"
-        fi
-
-        export JAVA_HOME="${shell_java_home}"
-        export PATH="${shell_java_home}/bin:${PATH}"
-        echo "JAVA_HOME_${JAVA_VERSION}_${architecture}=${java_home}" >> "${GITHUB_ENV}"
-        echo "JAVA_HOME=${java_home}" >> "${GITHUB_ENV}"
-        echo "${java_home}/bin" >> "${GITHUB_PATH}"
-        java -version 2>&1 | tee "${RUNNER_TEMP}/java-version.txt"
-        case "${distribution}" in
-          temurin) grep -Eiq "Temurin|Eclipse Adoptium" "${RUNNER_TEMP}/java-version.txt" ;;
-          microsoft) grep -Eiq "Microsoft" "${RUNNER_TEMP}/java-version.txt" ;;
-        esac
-        grep -Eq "version \"${JAVA_VERSION}(\.|\")" "${RUNNER_TEMP}/java-version.txt"

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.3
+pkgver=2.14.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.3
+pkgver=2.14.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')

.github/config/.files.yaml

@@ -1,15 +1,13 @@
-# CI routing infrastructure. Changes to the top-level router (build.yml) or
-# this filter configuration rerun every area's jobs. Every job-gating filter
-# therefore includes *ci, so routing changes exercise the jobs they affect
-# instead of matching only the project filter.
+# CI routing infra. Editing the top-level router (build.yml) or this filter
+# config re-runs every area's jobs, so every job-gating filter below includes
+# *ci. That makes a change to how jobs are dispatched actually exercise those
+# jobs (self-testing), instead of a router edit only matching the project filter.
 ci: &ci
   - .github/workflows/build.yml
-  - .github/workflows/gradle-cache-prime.yml
   - .github/config/.files.yaml
 
 build: &build
   - *ci
-  - buildSrc/**
   - build.gradle
   - gradle/spotless.gradle
   - app/(common|core|proprietary|saas)/build.gradle
@@ -17,22 +15,6 @@ build: &build
   - .taskfiles/backend.yml
   - .github/workflows/check-licence.yml
 
-# Backend build inputs. This is intentionally broader than `build`: Java and
-# backend resource changes must exercise the backend matrix even when Gradle
-# build scripts themselves are unchanged.
-backend: &backend
-  - *ci
-  - *build
-  - gradle/**
-  - gradle.properties
-  - gradlew
-  - gradlew.bat
-  - settings.gradle
-  - app/(common|core|proprietary|saas)/src/(main|test)/java/**
-  - "app/(common|core|proprietary|saas)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
-  - scripts/db-migration/**
-  - .github/workflows/backend-build.yml
-
 openapi: &openapi
   - *ci
   - *build
@@ -42,9 +24,9 @@ openapi: &openapi
 docker-base: &docker-base
   - docker/base/Dockerfile
 
-# Dockerfiles only (base, embedded, and unoserver). The slow multi-architecture
-# (arm64) leg of the PR Docker test build runs only when a Dockerfile changes,
-# rather than for every code PR.
+# Dockerfiles only (base + embedded + unoserver). Gates the slow multi-arch
+# (arm64) leg of the PR docker test build: arm64 is only rebuilt when a
+# Dockerfile itself changes, not on every code PR.
 dockerfiles: &dockerfiles
   - docker/**/Dockerfile*
 
@@ -86,6 +68,7 @@ project: &project
 frontend: &frontend
   - *ci
   - frontend/**
+  - .github/workflows/testdriver.yml
   - testing/**
   - docker/**
   - scripts/translations/*.py
@@ -105,8 +88,8 @@ frontend: &frontend
   - .github/workflows/e2e-stubbed.yml
   - .github/workflows/e2e-live.yml
 
-# Files that affect the Tauri desktop bundle. Changes to any of these files
-# trigger the multi-OS Tauri build job.
+# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
+# job on changes to any of these.
 tauri: &tauri
   - *ci
   - frontend/editor/src-tauri/**
@@ -119,9 +102,9 @@ tauri: &tauri
   - Taskfile.yml
   - .taskfiles/desktop.yml
 
-# Files that affect the AI engine, including its Python tool models, fixers,
-# and tests. The engine validation job also runs when the Java tool surfaces
-# used to generate those models change.
+# Files that affect the AI engine (Python tool models, fixers, tests). Gate
+# the engine validation job on changes to engine sources or to the Java
+# tool surfaces it generates models from.
 engine: &engine
   - *ci
   - engine/**
@@ -131,19 +114,17 @@ engine: &engine
   - .taskfiles/engine.yml
 
 # Files that can make the committed generated API models (frontend tool API
-# types and engine tool models) stale: their Java sources, generators,
-# generated outputs (to catch hand edits), and generation tasks. Broad
-# frontend, Docker, and testing globs are intentionally excluded, so a CSS-only
-# PR does not start the backend to rebuild the specification.
+# types + engine tool models) go stale: the Java tool surfaces they derive from,
+# the generators, the generated files themselves (to catch a hand-edit), and the
+# tasks that drive generation. Deliberately excludes the broad frontend/docker/
+# testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
 generated-models: &generated-models
   - *ci
   - *openapi
   - frontend/editor/scripts/generate-tool-api-types.mts
   - frontend/editor/src/core/types/toolApiTypes.ts
-  - frontend/editor/src/core/types/toolIO.ts
   - engine/scripts/generate_tool_models.py
   - engine/src/stirling/models/tool_models.py
-  - engine/src/stirling/models/tool_io.py
   - .taskfiles/frontend.yml
   - .taskfiles/engine.yml
   - .github/workflows/check-generated-models.yml
@@ -158,8 +139,8 @@ licenses-backend: &licenses-backend
   - ".github/workflows/frontend-backend-licenses-update.yml"
   - *build
 
-# Files that can affect premium or enterprise behaviour. Changes to any of
-# these files trigger the enterprise Playwright job for pull requests.
+# Files that can affect premium / enterprise behaviour. Gate the enterprise
+# Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
   - *ci
   - app/proprietary/**

.github/config/repo_devs.json

@@ -11,6 +11,7 @@
     "LaserKaspar",
     "sbplat",
     "reecebrowne",
+    "DarioGii",
     "ConnorYoh",
     "EthanHealy01",
     "jbrunton96",

.github/dependabot.yml

@@ -11,18 +11,11 @@ updates:
       - "/app/common"
       - "/app/core"
       - "/app/proprietary"
-      - "/app/saas"
-      - "/buildSrc"
     schedule:
       interval: "weekly"
     cooldown:
       default-days: 7
     rebase-strategy: "auto"
-    groups:
-      simple-java-mail:
-        patterns:
-          - "org.simplejavamail:simple-java-mail"
-          - "org.simplejavamail:outlook-module"
 
   - package-ecosystem: "docker"
     directories:
@@ -39,19 +32,6 @@ updates:
     cooldown:
       default-days: 7
     rebase-strategy: "auto"
-    groups:
-      ubuntu:
-        patterns:
-          - "ubuntu"
-      eclipse-temurin:
-        patterns:
-          - "eclipse-temurin"
-      uv:
-        patterns:
-          - "ghcr.io/astral-sh/uv"
-      gradle:
-        patterns:
-          - "gradle"
 
   - package-ecosystem: github-actions
     directory: /
@@ -65,7 +45,6 @@ updates:
     directories:
       - /devTools
       - /frontend
-      - /testing/compose/mcp-client-check
     schedule:
       interval: "weekly"
     cooldown:
@@ -94,13 +73,14 @@ updates:
           - "react-dom"
           - "@types/react"
           - "@types/react-dom"
-      tanstack:
+      typescript-eslint:
         patterns:
-          - "@tanstack/*"
-      typescript:
+          - "@typescript-eslint/*"
+          - "typescript-eslint"
+      eslint:
         patterns:
-          - "typescript"
-          - "@typescript/*"
+          - "eslint"
+          - "@eslint/*"
       vite:
         patterns:
           - "vite"
@@ -129,10 +109,6 @@ updates:
         patterns:
           - "@posthog/*"
           - "posthog-js"
-      storybook:
-        patterns:
-          - "storybook"
-          - "@storybook/*"
       supabase:
         patterns:
           - "@supabase/*"
@@ -179,8 +155,8 @@ updates:
           - "tokio"
           - "tokio-*"
 
-  - package-ecosystem: "uv"
-    directory: "/engine"
+  - package-ecosystem: pip
+    directory: /testing/cucumber
     schedule:
       interval: "weekly"
     cooldown:

.github/scripts/check_language_toml.py

@@ -19,9 +19,9 @@ import argparse
 import glob
 import os
 import re
-import tomllib  # Python 3.11+ (stdlib)
 from pathlib import Path
 
+import tomllib  # Python 3.11+ (stdlib)
 import tomli_w  # For writing TOML files
 
 
@@ -133,7 +133,11 @@ def update_missing_keys(reference_file, file_list, branch=""):
         file_path = Path(file_path)
         language_dir = file_path.parent.name
         reference_lang_dir = reference_file.parent.name
-        if language_dir == reference_lang_dir or file_path.suffix != ".toml" or file_path.parents[1].name != "locales":
+        if (
+            language_dir == reference_lang_dir
+            or file_path.suffix != ".toml"
+            or file_path.parents[1].name != "locales"
+        ):
             print(f"Skipping file: {file_path}")
             continue
 
@@ -194,7 +198,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
         # Verify that file is within the expected directory
         if not absolute_path.is_relative_to(base_dir):
             has_differences = True
-            report.append(f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n")
+            report.append(
+                f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n"
+            )
             continue
 
         # Verify file size before processing
@@ -208,7 +214,10 @@ def check_for_differences(reference_file, file_list, branch, actor):
         if basename_current_file == basename_reference_file and locale_dir == "en-US":
             continue
 
-        if file_normpath.suffix != ".toml" or basename_current_file != "translation.toml":
+        if (
+            file_normpath.suffix != ".toml"
+            or basename_current_file != "translation.toml"
+        ):
             continue
 
         only_reference_file = False
@@ -252,7 +261,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
                 )
                 report.append("")
                 report.append("    Use the following command to remove them:")
-                report.append(f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
+                )
                 report.append("")
             if extra_keys_list:
                 report.append(
@@ -260,7 +271,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
                 )
                 report.append("")
                 report.append("    Use the following command to add them:")
-                report.append(f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
+                )
                 report.append("")
 
             if missing_keys_list or extra_keys_list:
@@ -275,7 +288,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
             output = "\n".join(
                 [
                     f"      - `{key}`: first at {first}, duplicate at `{duplicate}`"
-                    for key, first, duplicate in find_duplicate_keys(branch_path / file_normpath)
+                    for key, first, duplicate in find_duplicate_keys(
+                        branch_path / file_normpath
+                    )
                 ]
             )
             report.append("3. **Test Status:** ❌ **_Failed_**")
@@ -298,14 +313,18 @@ def check_for_differences(reference_file, file_list, branch, actor):
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
         report.append("")
-        report.append(f"Thanks @{actor} for your help in keeping the translations up to date.")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )
 
     if not only_reference_file:
         print("\n".join(report))
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
+    parser = argparse.ArgumentParser(
+        description="Find missing keys in TOML translation files"
+    )
     parser.add_argument(
         "--actor",
         required=False,

.github/scripts/requirements_dev.in

@@ -0,0 +1,9 @@
+pip
+setuptools
+WeasyPrint
+pdf2image
+pillow
+unoserver
+opencv-python-headless
+pre-commit
+brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29

.github/scripts/requirements_dev.txt

@@ -0,0 +1,528 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --allow-unsafe --generate-hashes --output-file='.github\scripts\requirements_dev.txt' --strip-extras '.github\scripts\requirements_dev.in'
+#
+# WARNING: pip install will require the following package to be hashed.
+# Consider using a hashable URL like https://github.com/jazzband/pip-tools/archive/SOMECOMMIT.zip
+brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
+    # via
+    #   -r .github/scripts/requirements_dev.in
+    #   fonttools
+cffi==2.1.0 \
+    --hash=sha256:02cb7ff33ded4f1532476731f89ede53e2e488a8e6205515a82144246ffa7dcc \
+    --hash=sha256:03e9810d18c646077e501f661b682fbf5dee4676048527ca3cffe66faa9960dd \
+    --hash=sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d \
+    --hash=sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5 \
+    --hash=sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f \
+    --hash=sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6 \
+    --hash=sha256:0a96b74cda968eebbad56d973efe5098974f0a9fb323865bf99ea1fd24e3e64c \
+    --hash=sha256:10537b1df4967ca26d21e5072d7d54188354483b91dc75058968d3f0cf13fbda \
+    --hash=sha256:11b3fb55f4f8ad92274ed26705f65d8f91457de71f5380061eb6d125a768fecd \
+    --hash=sha256:15faec4adfff450819f3aee0e2e02c812de6edb88203aa58807955db2003472a \
+    --hash=sha256:164bff1657b2a74f0b6d54e11c9b375bc97b931f2ca9c43fcf875838da1570dd \
+    --hash=sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd \
+    --hash=sha256:19c54ac121cad98450b4896fa9a43ee0180d57bc4bc911a33db6cab1efab6cd3 \
+    --hash=sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb \
+    --hash=sha256:1e9f50d192a3e525b15a75ab5114e442d83d657b7ec29182a991bc9a88fd3a66 \
+    --hash=sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d \
+    --hash=sha256:2282cd5e38aa8accd03e99d1256af8411c84cdbee6a89d841b563fdbd1f3e50f \
+    --hash=sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6 \
+    --hash=sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0 \
+    --hash=sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c \
+    --hash=sha256:30b65779d598c370374fefabf138d456fd6f3216bfa7bedfab1ba82025b0cd93 \
+    --hash=sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d \
+    --hash=sha256:35aaea0c7ee0e58a5cd8c2fd1a48fdf7ece0d2699b7ecdda08194e9ce5dd9b3d \
+    --hash=sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8 \
+    --hash=sha256:379de10ce1ba048b1448599d1b37b24caee16309d1ac98d3982fc997f768700b \
+    --hash=sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001 \
+    --hash=sha256:3b926723c13eba9f81d2ef3820d63aeceec3b2d4639906047bf675cb8a7a500d \
+    --hash=sha256:3d7f118b5adbfdfead90c25822690b02bc8074fba949bb7858bec4ebd55adb43 \
+    --hash=sha256:46b1c8db8f6122420f32d02fffb924c2fe9bc772d228c7c711748fff56aabb2b \
+    --hash=sha256:47ff3a8bfd8cb9da1af7524b965127095055654c177fcfc7578debcb015eecd0 \
+    --hash=sha256:4d433a51f1870e43a13b6732f92aaf540ff77c2015097c78556f75a2d6c030e0 \
+    --hash=sha256:4f26194e3d95e06501b942642855aed4f953d55e95d7d01b7c4483db3ecff458 \
+    --hash=sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8 \
+    --hash=sha256:5972433ad71a9e46516584ef60a0fda12d9dc459938d1539c3ddecf9bdc1368d \
+    --hash=sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94 \
+    --hash=sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022 \
+    --hash=sha256:63960549e4f8dc41e31accb97b975abaecfc44c03e396c093a6436763c2ea7db \
+    --hash=sha256:64c753a0f87a256020004f37a1c8c02c480e725f910f0b2a0f3f07debd1b2479 \
+    --hash=sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376 \
+    --hash=sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d \
+    --hash=sha256:6d194185eabd279f1c05ebe3504265ddfc5ad2b58d0714f7db9f01da592e9eb6 \
+    --hash=sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3 \
+    --hash=sha256:716ff8ec22f20b4d988b12884086bcef0fc99737043e503f7a3935a6be99b1ea \
+    --hash=sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd \
+    --hash=sha256:7762faa47e8ff7eb80bd261d9a7d8eea2d8baa69de5e95b70c1f338bbe712f02 \
+    --hash=sha256:78474632761faa0fb96f30b1c928c84ebcf68713cbb80d15bab09dfe61640fde \
+    --hash=sha256:799416bae98336e400981ff6e532d67d5c709cfb30afb79865a1315f94b0e224 \
+    --hash=sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76 \
+    --hash=sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804 \
+    --hash=sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1 \
+    --hash=sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913 \
+    --hash=sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714 \
+    --hash=sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc \
+    --hash=sha256:88023dfe18799507b73f1dbb0d14326a17465de1bc9c9c7655c22845e9ddc3a2 \
+    --hash=sha256:89095c1968b4ba8285840e131bf2891b09ae137fe2146905acae0354fbce1b5e \
+    --hash=sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda \
+    --hash=sha256:8e74a6135550c4748af665b1b1118b6aab33b1fc6a16f9aff630af107c3b4512 \
+    --hash=sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28 \
+    --hash=sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699 \
+    --hash=sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3 \
+    --hash=sha256:961be50688f7fba2fa65f63712d3b9b341a22311f5253460ce933f52f0de1c8c \
+    --hash=sha256:98fff996e983a36d3aa2eca83af40c5821202e7e6f32d13ae94e3d2286f10cfe \
+    --hash=sha256:9b8f0f26ca4e7513c534d351eca551947d053fac438f2a04ac96d882909b0d3a \
+    --hash=sha256:9d72af0cf10a76a600a9690078fe31c63b9588c8e86bf9fd353f713c84b5db0f \
+    --hash=sha256:9d8272c0e483b024e1b9ad029821470ed8ec65631dbd90217469da0e7cd89f1c \
+    --hash=sha256:a016194dbe13d14ee9556e734b772d8d67b947092b268d757fd4290e3ba2dfc2 \
+    --hash=sha256:a5781494d4d400a3f47f8f1da94b324f6e6b440a53387774002890a2a2f4b50f \
+    --hash=sha256:a95b05f9baf29b91171b3a8bd2020b028835243e7b0ff6bb23e2a3c228518b1b \
+    --hash=sha256:aa7a1b53a2a4452ada2d1b5dade9960b2522f1e61293a811a077439e39029565 \
+    --hash=sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056 \
+    --hash=sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629 \
+    --hash=sha256:b6422532152adf4e59b110cb2808cee7a033800952f5c036b4af047ee43199e7 \
+    --hash=sha256:b65f590ef2a44640f9a05dbb548a429b4ade77913ce683ac8b1480777658a6c0 \
+    --hash=sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9 \
+    --hash=sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853 \
+    --hash=sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13 \
+    --hash=sha256:bf5c6cf48238b0eb4c086978c492ad1cbc22373fc5b2d7353b3a598ce6db887a \
+    --hash=sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4 \
+    --hash=sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce \
+    --hash=sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac \
+    --hash=sha256:c5f5df567f6eb216de69be06ce55c8b714090fae02b18a3b40da8163b8c5fa9c \
+    --hash=sha256:c941bb58d5a6e1c3892d86e42927ed6c180302f07e6d395d08c416e594b98b46 \
+    --hash=sha256:c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384 \
+    --hash=sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b \
+    --hash=sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210 \
+    --hash=sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc \
+    --hash=sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a \
+    --hash=sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5 \
+    --hash=sha256:d9fafc5aa2e2a39aaf7f8cc0c1f044a9b07fca12e558dca53a3cc5c654ad67a7 \
+    --hash=sha256:db3eb7d46527159a878ec3460e9d40615bc25ba337d477db681aea6e4f05c5d2 \
+    --hash=sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326 \
+    --hash=sha256:df2b82571a1b30f58a87bf4e5a9e78d2b1eff6c6ce8fd3aa3757221f93f0863f \
+    --hash=sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca \
+    --hash=sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98 \
+    --hash=sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9 \
+    --hash=sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5 \
+    --hash=sha256:f5bce581e6b8c235e566a14768a943b172ada3ed73537bb0c0be1edee312d4e7 \
+    --hash=sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc \
+    --hash=sha256:fb62edb5bb52cca65fab91a63afa7561607120d26090a7e8fda6fb9f064726da \
+    --hash=sha256:ff067a8d8d880e7809e4ac88eb009bb848870115317b306666502ccad30b147f
+    # via weasyprint
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+    # via pre-commit
+cssselect2==0.9.0 \
+    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
+    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
+    # via weasyprint
+distlib==0.4.3 \
+    --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \
+    --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed
+    # via virtualenv
+filelock==3.30.0 \
+    --hash=sha256:1774e682dbe443bd60f9609162fc596e2c80dc84ffc2957068953406d0520090 \
+    --hash=sha256:40632998f0772e64183bb819f086a1b9def6be1090cf1dcb9d45f46806ef279b
+    # via
+    #   python-discovery
+    #   virtualenv
+fonttools==4.63.0 \
+    --hash=sha256:032038247a96c1690f9f31e377c389383c902531b085aa4e4dabd6f57f870e69 \
+    --hash=sha256:063e08bd17bd5a90127a14123de0d6a952dbc847695fd98b63c043d58057f90c \
+    --hash=sha256:0c18358a155d75034911c5ee397a5b44cd19dd325dbb8b35fb60bf421d6a72ac \
+    --hash=sha256:0eac00b9118c3c2f87d272e45341871c5b3066baa3c86897fa634a7c3fb59096 \
+    --hash=sha256:1e874792a8212b44583ea02189d9e693906b2f78b261f372f95d6c563210ac1d \
+    --hash=sha256:22135da48a348785c5e2d5d2d9d6bec5ed44adacbaeb9db12d9493bf6c6bfa68 \
+    --hash=sha256:22693918177bd9ceabec4736d338045f357769416fc6b0b2508eefef75b08616 \
+    --hash=sha256:27fdc65af8da6f88b9c6121c47a464cbe359fcfff7ff6fc2d37a1f395d755b78 \
+    --hash=sha256:2b8ae05d9eacf6081414d759c0a352769ac28ce31280d6bb8e77b03f9e3c449f \
+    --hash=sha256:2c14b4fd138c4bafcca294765c547914e1aa431ae1ca94ab99d8db08c958bd3b \
+    --hash=sha256:308f957cdeaf8abe4e5f2f124902ef405448af92c90f80e302a3b771c2e6116b \
+    --hash=sha256:37dd23e621e3b0aef1baa70a303b80aaf38449632cfc8fd2a55fb285bbccfc02 \
+    --hash=sha256:445af2eab030a16b9171ea8bdda7ebf7d96bda2df88ee182a464252f6e05e20d \
+    --hash=sha256:51394295f1a51de8b5f30bdb1e1b9a4231536c7064ef5c6e211eec19fa36036f \
+    --hash=sha256:58dc6bb86a78d782f00f9190ca02c119cf5bbe2807536e361e18d42019f877d8 \
+    --hash=sha256:59ac449f8cca9b4ffa08d2e7bbadad87ce710d69d1eda5c3c1ce579baa987272 \
+    --hash=sha256:6b2248c5decb223562f7902ff6325077a073f608ee8e33e88ad88db734eb9f49 \
+    --hash=sha256:6d4741eb179121cab9eea4cb2393d24492373a260d7945006358c08cfbf45419 \
+    --hash=sha256:6db5140a60a5d731d21ec076745b40a310607731b0a565b50776393188649001 \
+    --hash=sha256:6e528da43bc3791085f8cb6141b1d13e459226790240340fcbb4625649238b03 \
+    --hash=sha256:796f27556dbe094c4824f75ca85267e4df776c79036c8441469a4df37038c196 \
+    --hash=sha256:79cdc9f567aec74a72918fd060283911406750cbc9fd28c1316023deb6ce31a9 \
+    --hash=sha256:7d76edbff9014094dbf03bd2d074709dfa6ec7aba13d838c937a2b33d2d6a86e \
+    --hash=sha256:7d782fac32985914c351556f68ac0855391572bcd87de50e05970d3cd4c96fc5 \
+    --hash=sha256:7dd683fef0663e9f0f45cf541d788d24caa3ec9db50796b588e1757d8b3bc007 \
+    --hash=sha256:85be818f5506e8a7753153def2c9550178f0ecae6a47b5e0e8dbb23f7cc90380 \
+    --hash=sha256:948428a275741f0b64b113c955425a953314f4b9ab9997f73a72c83e68e569c8 \
+    --hash=sha256:9ced0bd02ac751dd6319b0da88aaef24414e3b0dbc32bb4f24944821a3741a27 \
+    --hash=sha256:9e12f105d2b6342c559c298afb674006bb2893afc7102dcf8a1b55b0486b4e40 \
+    --hash=sha256:a8b33a82979e0a6a34ff435cc81317be1f95ec1ebb7a3a2d1c8a6a54f02ae44e \
+    --hash=sha256:a9faff9e0c1f76f9fd55899d2ce785832efebab37eb8ae13995853aef178bef0 \
+    --hash=sha256:af2fd1664d00a397d75f806985ddb36282091c2131a73a6485c23b4a34722263 \
+    --hash=sha256:afefc1ed0a59785a7fb06ea7e1678e849c193e1e387db783579bc7b3056fcfcb \
+    --hash=sha256:b1cd75a03ad8cb5bc40c90bfde68c0c47de423aa19e5c0f362b43520645eea94 \
+    --hash=sha256:ba04cb5891d4c0c21b6da95eda8d7b090021508a294fff33464fc7d241e0856b \
+    --hash=sha256:bf00f21eb5fb721dbaf73d1e9da6d02a1af7768f2ebcf9798be98beab8ba90f6 \
+    --hash=sha256:c0425b277a59cff3d80ca42162a8de360f318438a2ac83570842a678d826d579 \
+    --hash=sha256:c1aaa4b9c75798400ac043ce04d74e7830376c85095a5a6ed7cba2f17a266bf4 \
+    --hash=sha256:c2a2a42198b696a6f48fad91709afb55176e66a5e566131219dba372fb7f8c59 \
+    --hash=sha256:caeb583deeb5168e694b65cda8b4ee62abedfa66cf88488734466f2366b9c4e0 \
+    --hash=sha256:cb014d58140a38135f16064c74c652ed57aa0b75cbf8bb59cac821f7edb5334e \
+    --hash=sha256:ccf41f2efdf56994d22d73bef4ced1052161958169428d06ba9724ea9e9a64be \
+    --hash=sha256:cd7e9857e5e63738b9d9fd707bc1f59c8b09e5177726d23664db393c59bb08bd \
+    --hash=sha256:d76ac49f929aecaf82d83250b8347e099d7aecba0f4726c1d9b6df3b8bb5fe18 \
+    --hash=sha256:d7e5c9973aa04c95650c96e5f5ad865fbf42d62079163ecfab1e01cbc2504c22 \
+    --hash=sha256:dcf076a4474fe0d7367e5bbf5b052c7284fa1feca729c04176ce513521afd8a0 \
+    --hash=sha256:e3297a6a4059b4acc3a1e9a8b04741f240a80044eef08ebd32e8b5bcdddce75b \
+    --hash=sha256:ee08ebfa58f6e1aeff5697ab9582105bb620008c1caafb681e4c557e7483027b \
+    --hash=sha256:ef3048ef05dbb552b89817713d9cac912e00d0fde4a3105c00d29e52e10c89af \
+    --hash=sha256:fd1e3094f42d806d3d7c79162fc59e5910fcbe3a7360c385b8da969bc4493745
+    # via weasyprint
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+    # via pre-commit
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+    # via pre-commit
+numpy==2.4.6 \
+    --hash=sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1 \
+    --hash=sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4 \
+    --hash=sha256:043191bfa8eab18c776647b62723ac9dddece59743b13f49b2016094129c2b3f \
+    --hash=sha256:06ca2f61ec4385a07a6977c55ba998a4466c123642b4a32694d3128fce18c079 \
+    --hash=sha256:0a041d3d761dc3c35cc56ce0351506a02bcbc25f7b169f652435141a17db9096 \
+    --hash=sha256:0ab0a9c4ffb1a6d95ef519fe4247dba8eb6b18ad93999f76b7f657039acabd47 \
+    --hash=sha256:0c9136e14ed34a9e343a31c533d78a9813a69a3148332bce5e9821cb2f996e66 \
+    --hash=sha256:110f8b71aacb688ec69062bb7f6938a0f8acb01b7c1c4beb453c65b6d234584d \
+    --hash=sha256:112b06a867b235ef466ed3508ddf0238050df9c727cafb5301ac385b899189a1 \
+    --hash=sha256:17f9ade344e7d9b464a084d69bcf18fc691cb1db67c62ed80820bf4926d78f0e \
+    --hash=sha256:1e254a00cdf42b1e4d5b3d68d33af63268d41340d8885df2ab6470f2e1500147 \
+    --hash=sha256:1e978ec1e8bd0e0e4de6bb75de9d30cbb74db6b6a2bb727618613703ca0167dd \
+    --hash=sha256:25c692919ac5a01f170a3bfcd62d745b24fd095c353d50812637d6fcab442e75 \
+    --hash=sha256:260a5d70215b61ab4fadf5c7baacd64821842975eea312125ed3c39a6391b063 \
+    --hash=sha256:2803abfebfc990042cd494d8ce2d5f82e9d847af6d35ec486923aa19dbad5e73 \
+    --hash=sha256:29a287e0cf63ff528da061de6b9f64a4618da591ca1046aafc54062e40ca7eab \
+    --hash=sha256:29cb7f67d10b479ff07c17d33e39f78c07f71c40ef30d63c153d340e96cd3fb4 \
+    --hash=sha256:3213d622a0283a39a93d188f3cf72b26862df52fbb4ca3697f51705016523d41 \
+    --hash=sha256:33111801a01c12a8a1e3721f0a9232f8cfc8ae2c6b7098167e6f623c6073f402 \
+    --hash=sha256:357cc07a6d7b0b182ff02249616a03742827ebb1277546b5c7cd7f7620a45698 \
+    --hash=sha256:38efbc8de75c7a0fc1ac190162d892787f3f47b57cc291231aafee36b80982b7 \
+    --hash=sha256:4081eb135ac24158bd51cdfbef16f1c64df7063b1143f24731387137c092bec8 \
+    --hash=sha256:40fdc1ae7125e518ea98e53e69a4ebc27e1fd50510c47b7ea130cf21e5e1d42b \
+    --hash=sha256:4cfe66903cc32a9921a6733d96b19bb6abf310397581bbad89c228f5abaf0ee8 \
+    --hash=sha256:511dbaf848decaaaf4b4ca48032619fb3138710c4bf7da7617765edad1ef96b0 \
+    --hash=sha256:55cced7c52e981362f708ad635198e97a752dfba412cc03c23bbf3bd8d5cd662 \
+    --hash=sha256:56b39e5e0622a09a25bf5baf62f4bcf0cb8a41ae6e2819cf49bbc5a74c083f91 \
+    --hash=sha256:5dbbdb29840ca3d91ee0fece42fc29278886d908280bfec0a5846c6f901a3eb0 \
+    --hash=sha256:5f9fb9157b4ce2971008323afe46053787b526ef624fea915b261468a8421a0f \
+    --hash=sha256:6180d8b35af935aed8ece3a85e0a43f87393ae0ac87c8d2c8bd2c993f7270ef3 \
+    --hash=sha256:68a5124b13fa6cc2086764a20005d30bc0548146f7f5322f02fce212ca14317f \
+    --hash=sha256:68bb27509ac1b9a3443094260f6326150663b06abe40b73a2f81160623da5b67 \
+    --hash=sha256:6f41ae150c4e32db4f3310cdaf64b1593a03dbabe29eec77fc9b50fe64061df6 \
+    --hash=sha256:7265a2f3d436e54ef9f2b52b5c937e6be778781bd97a590319d7348f1c1ca997 \
+    --hash=sha256:72fbe16c6fac95aedf5937fa873445cec2110be35d8a4e9433d7501fd98dae6b \
+    --hash=sha256:7d92c3819208a60205a12a245c91ad70cb0a85336659b19b834205573ac8456e \
+    --hash=sha256:8155154c7c691289fe18f510b5d4657c68c67989f293f0535a91360392ff6538 \
+    --hash=sha256:81a1cca95ed5bb92aa8b10dd2cdc9a0d3853a50fad926c28b5d7e8ea54389627 \
+    --hash=sha256:89cd468399cfd2504718f0ba50e410dca55a170b61a02ad92bb18c8a65186e93 \
+    --hash=sha256:8ad03c0965fb3c692200e74d458ca28c1dbb4ce96f9a479a8aa041ad5fabca02 \
+    --hash=sha256:90f9849678c75fe7afa2d348ac842c168b0a4d3d61919687216dfc547976d853 \
+    --hash=sha256:948424b06129ce883307e8cff868c31396d8dc7630a59c61d70d98dbe70f222c \
+    --hash=sha256:9cd5ffd25db4e7ba6a375693b3fc0fc1791ec636c17db3720da19bde7180ec43 \
+    --hash=sha256:a0df0043bdb289bde1f62da130d20df23d58b45429f752bc7a8fc5325a225ecd \
+    --hash=sha256:a2c306dea656c12c68f51f4cea133cbe78ca7435eb28c735eac1d3ebe73be6e8 \
+    --hash=sha256:a7830bab239b79cda9c08c2da014761cafb48da6150e1da17ac06283f43b6089 \
+    --hash=sha256:a7c711e21628b52034bb5ab8d1bce291f752fcc5e92accc615778acee1ff4778 \
+    --hash=sha256:aaf159caa35993cb1f56fb9b8e4610d35758e7ca005412eb1daa856a78c9c4b1 \
+    --hash=sha256:ae506e6902902557576a26ff33eda8695e7ecb3cb36c3b573a0765dee114ebdb \
+    --hash=sha256:b507f5c4c1d508876d1819b6bf9a49d365b96320b5d4993426b33a23ca4b8261 \
+    --hash=sha256:bf162abab1c1a736333192707cef898e735a5ca00f38f27eeedf44b39d9e85eb \
+    --hash=sha256:c1a2af6c6ef86344a6b0db6b97834208bf598db514f2b155042439b62605601a \
+    --hash=sha256:c2d37ab77531417474168eb79d6d80b14f821a966818505d03013d0833edb7a8 \
+    --hash=sha256:c4fc99836233ea196540b17ab0983aff60ed07941751930f5f4d05bc3b3b7359 \
+    --hash=sha256:d581b735e177fdcdce6fed8e7e8880a3fb6ee4e3653a3ac6af01c6f4c03effc5 \
+    --hash=sha256:d6da64deb6b8ed903e7560180a92f2d804ee1ba5eeb849ac2748b8c1aba1f6d7 \
+    --hash=sha256:d8e8286dd7cea7895157318d1b91cdacac64c479f3cbc8dce548331728484751 \
+    --hash=sha256:ddea102b48f9e339f3948bf22040944184627a30fdf7f858667673b9c5f033c8 \
+    --hash=sha256:dfa20cc6ca228e6b155b11da03825975ce66aea520985dbbddf0f2a5a495c605 \
+    --hash=sha256:e3e5193ef5a3dc73bceee50f7fdc2c90dbb76c42df8d8fae3d1067a583df579e \
+    --hash=sha256:e3eeb0aabd6bd5ce64faae67e9935203a6991b4bc2a485a767fbafb2c5125f45 \
+    --hash=sha256:e5805d5a22fd19c8ccff10a9561f9df94436b0545619ea579db2d3c35294bce2 \
+    --hash=sha256:e85b752a1e912b70eaad4fafbd4d1238007ab221de2009b9a2f5ae7461239895 \
+    --hash=sha256:eaf7fa2de5c0be8ae6ff8e9bea2ccd725e980541244521d8d4b5f3354a27babe \
+    --hash=sha256:ebfb099f8dcf083deef3ac1ca4c1503f387cf76296fcb3816b66f5ecb5f54fdb \
+    --hash=sha256:ece3d2cfe132e7d51f44a832b303895e6f2d499c5e74dfbdb06ee246147a304a \
+    --hash=sha256:ed9749eef4cbd126da3dc1d6bcb3a57f5eb7ac6a6484146bdbf743f552dfc577 \
+    --hash=sha256:ede83e07a75dd06bc501566c1eca2afc0d61677c1472ac9ad93fdee6e638a48d \
+    --hash=sha256:ef4aea96ce4d3b074422cb4f2f64e216bf9e213004bb58ecfdf50ea02ea8eb9a \
+    --hash=sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda \
+    --hash=sha256:f407cb6b8e9d6d8c626bc73c945db1706035af8fd632295547bf1c9e46d092d6 \
+    --hash=sha256:f74a575920ab21fe304421a3fc28793d82e299cae9eccb37084e9fc7f3617c20
+    # via opencv-python-headless
+opencv-python-headless==5.0.0.93 \
+    --hash=sha256:030ca5e0837a2963ab36ef896baa9767eb8d2b83353fb28af5a521e40dd8756f \
+    --hash=sha256:09a872a157c1376ab922a69bbf22f9a95bcc7b658a9d8b436a60212b02b2eeb4 \
+    --hash=sha256:10818d91510e05c04568ae12b5cd120779c70c01bf897b001a6221fe430df80f \
+    --hash=sha256:1e55af3abfb462eeeabe5c775f12bdb36216d8a93a3583d69e6bd6e1d6ba7d00 \
+    --hash=sha256:829717b6a95554f273e49e357cee3b3a2a26b6f4842fbc1bed2b45bdd8f87e0e \
+    --hash=sha256:840bd717c21e5c11cadadc022a823315ea417f961213d06b4df010e019eb16f4 \
+    --hash=sha256:b82f9831daab90b725c7c1ee1b36cb5732c367096ac76d119e64e14eb70d5f3c \
+    --hash=sha256:c6bcd96b185975ea240d22cfdb15a1f6d080cc95264cfbe2621f21bb144d89b9 \
+    --hash=sha256:ed709fdf9aa0bd1f2ed8549e71d19449b03a675bb581eb292285f6861953be37
+    # via -r .github/scripts/requirements_dev.in
+pdf2image==1.17.0 \
+    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
+    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
+    # via -r .github/scripts/requirements_dev.in
+pillow==12.3.0 \
+    --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \
+    --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \
+    --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \
+    --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \
+    --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
+    --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \
+    --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \
+    --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \
+    --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \
+    --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
+    --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \
+    --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \
+    --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \
+    --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \
+    --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \
+    --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \
+    --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
+    --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \
+    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
+    --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \
+    --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \
+    --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \
+    --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \
+    --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \
+    --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \
+    --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \
+    --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \
+    --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
+    --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \
+    --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \
+    --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \
+    --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \
+    --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \
+    --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \
+    --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \
+    --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \
+    --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \
+    --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \
+    --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
+    --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \
+    --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \
+    --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \
+    --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \
+    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
+    --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \
+    --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \
+    --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \
+    --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \
+    --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \
+    --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \
+    --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \
+    --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \
+    --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \
+    --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \
+    --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \
+    --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \
+    --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \
+    --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \
+    --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \
+    --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \
+    --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \
+    --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
+    --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
+    --hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \
+    --hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \
+    --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
+    --hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \
+    --hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \
+    --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
+    --hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \
+    --hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \
+    --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
+    --hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \
+    --hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \
+    --hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \
+    --hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \
+    --hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \
+    --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
+    --hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \
+    --hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \
+    --hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \
+    --hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \
+    --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
+    --hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \
+    --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
+    --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \
+    --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
+    # via
+    #   -r .github/scripts/requirements_dev.in
+    #   pdf2image
+    #   weasyprint
+platformdirs==4.10.0 \
+    --hash=sha256:31e761a6a0ca04faf7353ea759bdba55652be214725111e5aac52dfa29d4bef7 \
+    --hash=sha256:fb516cdb12eb0d857d0cd85a7c57cea4d060bee4578d6cf5a14dfdf8cbf8784a
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+    # via -r .github/scripts/requirements_dev.in
+pycparser==3.0 \
+    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+    # via cffi
+pydyf==0.12.1 \
+    --hash=sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc \
+    --hash=sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095
+    # via weasyprint
+pyphen==0.17.2 \
+    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
+    --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
+    # via weasyprint
+python-discovery==1.4.4 \
+    --hash=sha256:5cad33982d412c1f3ffb8f9ca4ea292c9680bca3942451d30b69c37fce53a4a3 \
+    --hash=sha256:abebe9120b43453b68c908acfb1e72a19d1a959ed2cb620ad38fc57d08056dbe
+    # via virtualenv
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via pre-commit
+tinycss2==1.5.1 \
+    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
+    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
+    # via
+    #   cssselect2
+    #   weasyprint
+tinyhtml5==2.1.0 \
+    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
+    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
+    # via weasyprint
+unoserver==3.7 \
+    --hash=sha256:b05f9578506ac7374ae1b314c3a79528636c542ac78220a9ce99110584ca424b \
+    --hash=sha256:fc44e6808071c9d2957e705ecf1742cea8a582aa5d5cc23babf36bb332ec6e8e
+    # via -r .github/scripts/requirements_dev.in
+virtualenv==21.6.1 \
+    --hash=sha256:15f978b7cd329f24855ff4a0c4b4899cc7678589f49adbdcbbb4d3232e641128 \
+    --hash=sha256:afe991df855715a2b2f60edfcc0107ef95a79fdfd8cb4cdaa71603d1c12e463b
+    # via pre-commit
+weasyprint==69.0 \
+    --hash=sha256:475951cfd917014de6d4d005caff48c6aa867e7e42b80cd5b16a0484a1609ee6 \
+    --hash=sha256:a7a32f39ca16bd82ef11de99c92ea4b5f14951c9033af035e451ce4f4ee0a88c
+    # via -r .github/scripts/requirements_dev.in
+webencodings==0.5.1 \
+    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
+    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
+    # via
+    #   cssselect2
+    #   tinycss2
+    #   tinyhtml5
+zopfli==0.4.3 \
+    --hash=sha256:0087c9a6f0c8a052be0f6d1a9bb71b6caffdd3e10201d6d6166e28d482cebe6d \
+    --hash=sha256:47604eee5c6704bdf0e94d8391fe3b74ddb2abd84128fbcfdc3ee0fc265feaef \
+    --hash=sha256:62248dbf8dbcbd588ee194b210e5be9fa80bce29641f55599d6d394bd2a9d8a3 \
+    --hash=sha256:628c3e941752880b3491db8d44163d0aedb221944e22a17187ff7fc549b050f6 \
+    --hash=sha256:769875152d0625c46707bcca57d4b2233fe653482067acd55fbf6ec525cb9bdc \
+    --hash=sha256:7e9703ca6e7ef66c8d05e0826b6f558b680c9db8206f84f05a3ee93430a12e42 \
+    --hash=sha256:7fa3c35193475290e3f007bbcdebdbae64ba2f012d75c632da0d727e1da50d5e \
+    --hash=sha256:88f4fbe429aad72bc206275d81fab11a097e0f951a5848d1f51083c37ea73073 \
+    --hash=sha256:921c2c9907f4364963848da5ad194b46d68865e07fdb975d04fd09bc42d47357 \
+    --hash=sha256:d3a50f91a13cea9bafe025de8fd87a005eb26de02a4f0c193127ddbf23ac8ebe \
+    --hash=sha256:d4f51dd1ab5312e837e2091284e0d9f1a138188f2e65812f9a5799dc02c45f94 \
+    --hash=sha256:eb0c9c1d40a8cb1d58762d7e57290ccb753e0828c4d01be8acb59aae5d0ca206 \
+    --hash=sha256:f2e0adcf7d36c6fd0dd36cc771ef7f0c5803a05666feafcd90d7170174a4148e
+    # via fonttools
+
+# The following packages are considered to be unsafe in a requirements file:
+pip==26.1.2 \
+    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
+    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
+    # via -r .github/scripts/requirements_dev.in
+setuptools==83.0.0 \
+    --hash=sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef \
+    --hash=sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3
+    # via -r .github/scripts/requirements_dev.in

.github/scripts/requirements_sync_readme.in

@@ -0,0 +1,2 @@
+tomlkit
+tomli-w

.github/scripts/requirements_sync_readme.txt

@@ -0,0 +1,14 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
+#
+tomli-w==1.2.0 \
+    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
+    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
+    # via -r .github/scripts/requirements_sync_readme.in
+tomlkit==0.15.0 \
+    --hash=sha256:4dbc8f0fc024412b57ced8757ac7461305126a648ff8c2c807fcb8e133a78738 \
+    --hash=sha256:7d1a9ecba3086638211b13814ea79c90dd54dd11993564376f3aa92271f5c7a3
+    # via -r .github/scripts/requirements_sync_readme.in

.github/scripts/verify-updater-signatures.py

@@ -4,18 +4,19 @@
 Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
 """
 
-import base64
 import binascii
-import hashlib
-import json
 import sys
+import json
+import base64
+import hashlib
 from pathlib import Path
-
-from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.exceptions import InvalidSignature
 
 ART_ROOT = Path(sys.argv[1])
-CONF = Path(sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json")
+CONF = Path(
+    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
+)
 
 
 def load_pubkey():

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -26,10 +26,6 @@ jobs:
   check-pr:
     if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
-    # Only reads the PR via pulls.get with the default GITHUB_TOKEN.
-    permissions:
-      contents: read
-      pull-requests: read
     outputs:
       should_deploy: ${{ steps.decide.outputs.should_deploy }}
       is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -39,7 +35,7 @@ jobs:
       pr_ref: ${{ steps.resolve.outputs.ref }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -90,7 +86,7 @@ jobs:
               fi
             fi
           else
-            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
+            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
             is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
             if [ "$is_auth" = true ]; then
               should=true
@@ -101,7 +97,6 @@ jobs:
           echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT
 
   deploy-v2-pr:
-    environment: pr-preview
     needs: check-pr
     runs-on: ubuntu-latest
     if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
@@ -112,7 +107,6 @@ jobs:
     permissions:
       contents: read
       issues: write
-      packages: write
       pull-requests: write
     env:
       # Single source of truth for whether this preview embeds the admin portal:
@@ -121,7 +115,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -131,11 +125,20 @@ jobs:
           repository: ${{ github.repository }}
           ref: main
 
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Add deployment started comment
         id: deployment-started
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
@@ -177,12 +180,11 @@ jobs:
         with:
           repository: ${{ needs.check-pr.outputs.pr_repository }}
           ref: ${{ needs.check-pr.outputs.pr_ref }}
-          # untrusted tree is built below - never leave credentials in .git/config
-          persist-credentials: false
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # Fetch full history for commit hash detection
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Get version number
         id: versionNumber
@@ -190,16 +192,11 @@ jobs:
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Get commit hash for app
         id: commit-hash
@@ -223,7 +220,7 @@ jobs:
       - name: Check if image exists
         id: check-image
         run: |
-          if docker manifest inspect ${IMAGE_BASE}:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
             echo "exists=true" >> $GITHUB_OUTPUT
             echo "Image already exists, skipping build"
           else
@@ -231,8 +228,6 @@ jobs:
             echo "Image needs to be built"
           fi
 
-        env:
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
       - name: Build and push V2 image
         if: steps.check-image.outputs.exists == 'false'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -242,7 +237,7 @@ jobs:
           push: true
           cache-from: type=gha,scope=stirling-pdf-latest
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:v2-${{ steps.commit-hash.outputs.app_short }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
           build-args: |
             VERSION_TAG=v2-alpha
             BUILD_PORTAL=${{ env.BUILD_PORTAL }}
@@ -251,11 +246,9 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
       - name: Deploy V2 to VPS
         id: deploy
         run: |
@@ -268,7 +261,7 @@ jobs:
           services:
             stirling-pdf-v2:
               container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${IMAGE_BASE}:v2-${{ steps.commit-hash.outputs.app_short }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
               ports:
                 - "${V2_PORT}:8080"
               volumes:
@@ -280,8 +273,8 @@ jobs:
                 DISABLE_ADDITIONAL_FEATURES: "false"
                 STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
                 SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${TEST_LOGIN_USERNAME}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${TEST_LOGIN_PASSWORD}"
+                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
+                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                 SYSTEM_DEFAULTLOCALE: en-US
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
@@ -295,9 +288,9 @@ jobs:
           EOF
 
           # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${NEW_VPS_USERNAME}@${NEW_VPS_HOST}:/tmp/docker-compose-v2.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
             # Create V2 PR-specific directories
             mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
 
@@ -322,19 +315,12 @@ jobs:
           # Set port for output
           echo "v2_port=${V2_PORT}" >> $GITHUB_OUTPUT
 
-        env:
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
-          TEST_LOGIN_USERNAME: ${{ secrets.TEST_LOGIN_USERNAME }}
-          TEST_LOGIN_PASSWORD: ${{ secrets.TEST_LOGIN_PASSWORD }}
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
-
       # ---- Storybook preview (only when this PR touches stories/.storybook) ----
       # Runs inside the same approved-contributor-gated deploy job, so it deploys
       # under the exact same access rules as the app preview.
       - name: Detect Storybook changes
         id: sb-changes
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         with:
           list-files: json
           filters: |
@@ -345,7 +331,7 @@ jobs:
 
       - name: Set up Node.js for Storybook
         if: steps.sb-changes.outputs.storybook == 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -393,9 +379,8 @@ jobs:
         env:
           SB_URL: ${{ steps.storybook.outputs.url }}
           SB_FILES: ${{ steps.sb-changes.outputs.storybook_files }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
@@ -416,7 +401,7 @@ jobs:
               }
             }
 
-            const deploymentUrl = `http://${process.env.NEW_VPS_HOST}:${v2Port}`;
+            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
 
             // Only mention the portal when this image actually embeds it.
             // Use the direct IP URL - the SSL hostname isn't supported yet.
@@ -462,10 +447,6 @@ jobs:
             });
 
   cleanup-v2-deployment:
-    # Tearing a preview down is not a deployment - no deployment object.
-    environment:
-      name: pr-preview
-      deployment: false
     if: github.event.action == 'closed'
     runs-on: ubuntu-latest
     permissions:
@@ -475,17 +456,26 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Clean up V2 deployment comments
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ github.event.pull_request.number }};
@@ -514,14 +504,12 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
       - name: Cleanup V2 deployment
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
             if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found V2 PR directory, proceeding with cleanup..."
 
@@ -554,11 +542,8 @@ jobs:
             # Only remove PR-specific containers and directories
           ENDSSH
 
-        env:
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
       - name: Cleanup temporary files
         if: always()
         run: |
-          rm -f ../private.key docker-compose.yml storybook.tgz
+          rm -f ../private.key
         continue-on-error: true

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -37,8 +37,7 @@ jobs:
   check-comment:
     runs-on: ubuntu-latest
     permissions:
-      contents: read # actions/checkout
-      issues: write # add reaction to the triggering issue comment
+      issues: write
     if: |
       vars.CI_PROFILE != 'lite' && (
         github.event_name == 'workflow_dispatch' ||
@@ -55,6 +54,7 @@ jobs:
             github.event.comment.user.login == 'Ludy87' ||
             github.event.comment.user.login == 'balazs-szucs' ||
             github.event.comment.user.login == 'reecebrowne' ||
+            github.event.comment.user.login == 'DarioGii' ||
             github.event.comment.user.login == 'EthanHealy01' ||
             github.event.comment.user.login == 'jbrunton96' ||
             github.event.comment.user.login == 'ConnorYoh'
@@ -70,13 +70,22 @@ jobs:
       enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Get PR data
         id: get-pr
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -147,7 +156,7 @@ jobs:
         id: add-eyes-reaction
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             console.log(`Adding eyes reaction to comment ID: ${context.payload.comment.id}`);
             try {
@@ -166,43 +175,46 @@ jobs:
             }
 
   deploy-pr:
-    environment: pr-preview
     needs: check-comment
     runs-on: ubuntu-latest
     permissions:
-      contents: read # actions/checkout, incl. the PR merge ref
-      issues: write # reactions, 'pr-deployed' label, deployment URL comment
+      issues: write
       pull-requests: write
-      packages: write # push PR image to ghcr.io
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
-          # untrusted tree gets built below - never leave credentials in .git/config
-          persist-credentials: false
-
-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-deploy-pr-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          token: ${{ steps.setup-bot.outputs.token }}
 
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -221,18 +233,13 @@ jobs:
           STIRLING_PDF_DESKTOP_UI: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push PR-specific image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -242,7 +249,7 @@ jobs:
           push: true
           cache-from: type=gha,scope=stirling-pdf-latest
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:pr-${{ needs.check-comment.outputs.pr_number }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: |
             VERSION_TAG=alpha
             PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
@@ -252,22 +259,20 @@ jobs:
         if: needs.check-comment.outputs.enable_prototypes == 'true'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          context: .
+          context: ./engine
           file: ./engine/Dockerfile
           push: true
           cache-from: type=gha,scope=stirling-pdf-engine
           cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
           platforms: linux/amd64
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
       - name: Deploy to VPS
         id: deploy
         run: |
@@ -285,11 +290,11 @@ jobs:
           # Set pro/enterprise settings (enterprise implies pro)
           if [ "${{ needs.check-comment.outputs.enable_enterprise }}" == "true" ]; then
             PREMIUM_ENABLED="true"
-            PREMIUM_KEY="${ENTERPRISE_KEY}"
+            PREMIUM_KEY="${{ secrets.ENTERPRISE_KEY }}"
             PREMIUM_PROFEATURES_AUDIT_ENABLED="true"
           elif [ "${{ needs.check-comment.outputs.enable_pro }}" == "true" ]; then
             PREMIUM_ENABLED="true"
-            PREMIUM_KEY="${PRO_KEY}"
+            PREMIUM_KEY="${{ secrets.PREMIUM_KEY }}"
             PREMIUM_PROFEATURES_AUDIT_ENABLED="true"
           else
             PREMIUM_ENABLED="false"
@@ -299,6 +304,7 @@ jobs:
 
           ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
           PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
+          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
 
           # Build engine env vars for backend (only set when prototypes enabled)
           if [ "$ENABLE_PROTOTYPES" == "true" ]; then
@@ -308,9 +314,9 @@ jobs:
             ENGINE_SERVICE="
             stirling-pdf-engine:
               container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${IMAGE_BASE}:engine-pr-${PR_NUMBER}
+              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
               environment:
-                ANTHROPIC_API_KEY: \"${ANTHROPIC_API_KEY}\"
+                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
               networks:
                 - pr-network
               restart: on-failure:5"
@@ -333,7 +339,7 @@ jobs:
           services:
             stirling-pdf:
               container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${IMAGE_BASE}:pr-${PR_NUMBER}
+              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
               ports:
                 - "${PR_NUMBER}:8080"
               volumes:
@@ -357,9 +363,9 @@ jobs:
           EOF
 
           # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${NEW_VPS_USERNAME}@${NEW_VPS_HOST}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
             # Create PR-specific directories
             mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}
 
@@ -375,19 +381,11 @@ jobs:
           # Set output for use in PR comment
           echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV
 
-        env:
-          ENTERPRISE_KEY: ${{ secrets.ENTERPRISE_KEY }}
-          # named PRO_KEY, not PREMIUM_KEY, so the shell var it feeds is not self-referential
-          PRO_KEY: ${{ secrets.PREMIUM_KEY }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
       - name: Add success reaction to comment
         if: success() && github.event_name == 'issue_comment'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             console.log(`Adding rocket reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
             try {
@@ -422,7 +420,7 @@ jobs:
         if: failure() && github.event_name == 'issue_comment'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             console.log(`Adding -1 reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
             try {
@@ -441,17 +439,15 @@ jobs:
       - name: Post deployment URL to PR
         if: success()
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { GITHUB_REPOSITORY } = process.env;
             const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
             const prNumber = ${{ needs.check-comment.outputs.pr_number }};
             const securityStatus = process.env.security_status || "Security Disabled";
 
-            const deploymentUrl = `http://${process.env.NEW_VPS_HOST}:${prNumber}`;
+            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
             const commentBody = `## 🚀 PR Test Deployment\n\n` +
                               `Your PR has been deployed for testing!\n\n` +
                               `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -476,22 +472,26 @@ jobs:
   handle-label-commands:
     if: ${{ github.event.issue.pull_request != null }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read # actions/checkout, reads repo_devs.json and labels.yml
-      issues: write # add/remove labels, delete the command comment
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Check out the repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Apply label commands
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const fs = require('fs');
             const path = require('path');

.github/workflows/PR-Demo-cleanup.yml

@@ -7,33 +7,41 @@ on:
 permissions:
   contents: read
 
+env:
+  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
+  CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred
+
 jobs:
   cleanup:
-    # Tearing a preview down is not a deployment - no deployment object.
-    environment:
-      name: pr-preview
-      deployment: false
     if: github.event.action == 'closed'
     runs-on: ubuntu-latest
     permissions:
-      contents: read # actions/checkout
       pull-requests: write
-      issues: write # list/remove labels, list/delete comments
+      issues: write
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Remove 'pr-deployed' label if present
         id: remove-label-comment
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const prNumber = ${{ github.event.pull_request.number }};
             const owner = context.repo.owner;
@@ -92,22 +100,14 @@ jobs:
         if: steps.remove-label-comment.outputs.present == 'true'
         run: |
           mkdir -p ~/.ssh/
-          echo "${NEW_VPS_SSH_KEY}" > ../private.key
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
-        env:
-          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
       - name: Cleanup PR deployment
         if: steps.remove-label-comment.outputs.present == 'true'
         id: cleanup
-        # ENDSSH heredoc is quoted, so its body is sent literally: secrets inside it
-        # must stay as GitHub expressions, a shell var would be empty on the remote host.
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
             if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found PR directory, proceeding with cleanup..."
 
@@ -122,8 +122,8 @@ jobs:
               rm -rf /stirling/PR-${{ github.event.pull_request.number }}
 
               # Remove the Docker images
-              docker rmi --no-prune ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:engine-pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true
 
               echo "PERFORMED_CLEANUP"
             else
@@ -131,9 +131,6 @@ jobs:
               echo "NO_CLEANUP_NEEDED"
             fi
           ENDSSH
-        env:
-          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
-          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
 
       - name: Cleanup temporary files
         if: always()

.github/workflows/_runner-pick.yml

@@ -38,7 +38,7 @@ jobs:
       is_fork: ${{ steps.decide.outputs.is_fork }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/ai-engine.yml

@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -28,12 +28,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
           cache-suffix: ai-engine
 
       - name: Install Task
@@ -99,14 +96,6 @@ jobs:
           echo "============================================"
           exit 1
 
-      - name: Build engine production image
-        if: always()
-        run: docker build --file engine/Dockerfile --tag stirling-pdf-engine:ci .
-
-      - name: Build engine development image
-        if: always()
-        run: docker build --file engine/Dockerfile.dev --tag stirling-pdf-engine-dev:ci .
-
       - name: Remove engine check comment on success
         if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
         continue-on-error: true

.github/workflows/ai_pr_title_review.yml

@@ -0,0 +1,228 @@
+name: AI - PR Title Review
+
+on:
+  pull_request:
+    types: [opened, edited]
+    branches: [main]
+
+permissions: # required for secure-repo hardening
+  contents: read
+
+jobs:
+  ai-title-review:
+    permissions:
+      contents: read
+      pull-requests: write
+      models: read
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git to suppress detached HEAD warning
+        run: git config --global advice.detachedHead false
+
+      - name: Setup GitHub App Bot
+        if: github.actor != 'dependabot[bot]'
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        continue-on-error: true
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Check if actor is repo developer
+        id: actor
+        run: |
+          if [[ "${{ github.actor }}" == *"[bot]" ]]; then
+            echo "PR opened by a bot – skipping AI title review."
+            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          if [ ! -f .github/config/repo_devs.json ]; then
+            echo "Error: .github/config/repo_devs.json not found" >&2
+            exit 1
+          fi
+          # Validate JSON and extract repo_devs
+          REPO_DEVS=$(jq -r '.repo_devs[]' .github/config/repo_devs.json 2>/dev/null || { echo "Error: Invalid JSON in repo_devs.json" >&2; exit 1; })
+          # Convert developer list into Bash array
+          mapfile -t DEVS_ARRAY <<< "$REPO_DEVS"
+          if [[ " ${DEVS_ARRAY[*]} " == *" ${{ github.actor }} "* ]]; then
+            echo "is_repo_dev=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Get PR diff
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        id: get_diff
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          git diff origin/${{ github.base_ref }}...HEAD | head -n 10000 | grep -vP '[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x{202E}\x{200B}]' > pr.diff
+          echo "diff<<EOF" >> $GITHUB_OUTPUT
+          cat pr.diff >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Check and sanitize PR title
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        id: sanitize_pr_title
+        env:
+          PR_TITLE_RAW: ${{ github.event.pull_request.title }}
+        run: |
+          # Sanitize PR title: max 72 characters, only printable characters
+          PR_TITLE=$(echo "$PR_TITLE_RAW" | tr -d '\n\r' | head -c 72 | sed 's/[^[:print:]]//g')
+          if [[ ${#PR_TITLE} -lt 5 ]]; then
+            echo "PR title is too short. Must be at least 5 characters." >&2
+          fi
+          echo "pr_title=$PR_TITLE" >> $GITHUB_OUTPUT
+
+      - name: AI PR Title Analysis
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        id: ai-title-analysis
+        uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
+        with:
+          model: openai/gpt-4o
+          system-prompt-file: ".github/config/system-prompt.txt"
+          prompt: |
+            Based on the following input data:
+
+            {
+              "diff": "${{ steps.get_diff.outputs.diff }}",
+              "pr_title": "${{ steps.sanitize_pr_title.outputs.pr_title }}"
+            }
+
+            Respond ONLY with valid JSON in the format:
+            {
+              "improved_rating": <0-10>,
+              "improved_ai_title_rating": <0-10>,
+              "improved_title": "<ai generated title>"
+            }
+
+      - name: Validate and set SCRIPT_OUTPUT
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        run: |
+          cat <<EOF > ai_response.json
+          ${{ steps.ai-title-analysis.outputs.response }}
+          EOF
+
+          # Validate JSON structure
+          jq -e '
+            (keys | sort) == ["improved_ai_title_rating", "improved_rating", "improved_title"] and
+            (.improved_rating | type == "number" and . >= 0 and . <= 10) and
+            (.improved_ai_title_rating | type == "number" and . >= 0 and . <= 10) and
+            (.improved_title | type == "string")
+          ' ai_response.json
+          if [ $? -ne 0 ]; then
+            echo "Invalid AI response format" >&2
+            cat ai_response.json >&2
+            exit 1
+          fi
+          # Parse JSON fields
+          IMPROVED_RATING=$(jq -r '.improved_rating' ai_response.json)
+          IMPROVED_TITLE=$(jq -r '.improved_title' ai_response.json)
+          # Limit comment length to 1000 characters
+          COMMENT=$(cat <<EOF
+          ## 🤖 AI PR Title Suggestion
+
+          **PR-Title Rating**: $IMPROVED_RATING/10
+
+          ### ⬇️ Suggested Title (copy & paste):
+
+          \`\`\`
+          $IMPROVED_TITLE
+          \`\`\`
+
+          ---
+          *Generated by GitHub Models AI*
+          EOF
+          )
+          echo "$COMMENT" > /tmp/ai-title-comment.md
+          # Log input and output to the GitHub Step Summary
+          echo "### 🤖 AI PR Title Analysis" >> $GITHUB_STEP_SUMMARY
+          echo "### Input PR Title" >> $GITHUB_STEP_SUMMARY
+          echo '```bash' >> $GITHUB_STEP_SUMMARY
+          echo "${{ steps.sanitize_pr_title.outputs.pr_title }}" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo '### AI Response (raw JSON)' >> $GITHUB_STEP_SUMMARY
+          echo '```json' >> $GITHUB_STEP_SUMMARY
+          cat ai_response.json >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+
+      - name: Post comment on PR if needed
+        if: steps.actor.outputs.is_repo_dev == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        continue-on-error: true
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const fs = require('fs');
+            const body = fs.readFileSync('/tmp/ai-title-comment.md', 'utf8');
+            const { GITHUB_REPOSITORY } = process.env;
+            const [owner, repo] = GITHUB_REPOSITORY.split('/');
+            const issue_number = context.issue.number;
+
+            const ratingMatch = body.match(/\*\*PR-Title Rating\*\*: (\d+)\/10/);
+            const rating = ratingMatch ? parseInt(ratingMatch[1], 10) : null;
+
+            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
+            const comments = await github.rest.issues.listComments({ owner, repo, issue_number });
+
+            const existing = comments.data.find(c =>
+              c.user?.login === expectedActor &&
+              c.body.includes("## 🤖 AI PR Title Suggestion")
+            );
+
+            if (rating === null) {
+              console.log("No rating found in AI response – skipping.");
+              return;
+            }
+
+            if (rating <= 5) {
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner, repo,
+                  comment_id: existing.id,
+                  body
+                });
+                console.log("Updated existing suggestion comment.");
+              } else {
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number,
+                  body
+                });
+                console.log("Created new suggestion comment.");
+              }
+            } else {
+              const praise = `## 🤖 AI PR Title Suggestion\n\nGreat job! The current PR title is clear and well-structured.\n\n✅ No suggestions needed.\n\n---\n*Generated by GitHub Models AI*`;
+
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner, repo,
+                  comment_id: existing.id,
+                  body: praise
+                });
+                console.log("Replaced suggestion with praise.");
+              } else {
+                console.log("Rating > 5 and no existing comment – skipping comment.");
+              }
+            }
+
+      - name: is not repo dev
+        if: steps.actor.outputs.is_repo_dev != 'true'
+        run: |
+          exit 0 # Skip the AI title review for non-repo developers
+
+      - name: Clean up
+        if: always()
+        run: |
+          rm -f pr.diff ai_response.json /tmp/ai-title-comment.md
+          echo "Cleaned up temporary files."
+        continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/aur-publish.yml

@@ -26,7 +26,7 @@ jobs:
       jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -66,12 +66,11 @@ jobs:
           echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
 
   publish-aur:
-    environment: package-publish
     needs: get-release-info
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -107,7 +106,7 @@ jobs:
 
       - name: Publish stirling-pdf-desktop to AUR
         if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@084b0d9b15415bf9cdb65d44dad1efe37a354050 # v4.2.0
+        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
         with:
           pkgname: stirling-pdf-desktop
           pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD

.github/workflows/auto-labelerV2.yml

@@ -13,21 +13,26 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     permissions:
-      contents: read # checkout + labeler fetching its config from the repo
-      pull-requests: write # read changed files, apply labels to the PR
-      issues: write # labels are applied through the issues API
+      pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - uses: srvaroa/labeler@bf262763a8a8e191f5847873aecc0f29df84f957 # v1.14.0
         with:
           config_path: .github/labeler-config-srvaroa.yml
           use_local_config: false
           fail_on_error: true
         env:
-          GITHUB_TOKEN: "${{ github.token }}"
+          GITHUB_TOKEN: "${{ steps.setup-bot.outputs.token }}"

.github/workflows/backend-build.yml

@@ -20,9 +20,6 @@ permissions:
 
 jobs:
   build:
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -31,24 +28,32 @@ jobs:
         flavor: [core, proprietary, saas]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: ${{ matrix.jdk-version }}
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -152,9 +157,6 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           STIRLING_FLAVOR: ${{ matrix.flavor }}
-          # Configure the Gradle daemon explicitly; GRADLE_OPTS alone only
-          # configures the Gradle client JVM.
-          GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx4g -XX:+UseG1GC"
 
       - name: Check Test Reports Exist
         if: always()
@@ -194,14 +196,12 @@ jobs:
           retention-days: 3
           if-no-files-found: warn
 
-      - name: Install uv
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py parses JaCoCo XML through defusedxml to
+        # silence security scanners that pattern-match on the stdlib
+        # xml.etree.ElementTree.parse call.
         if: always() && matrix.flavor == 'saas'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+        run: python -m pip install --quiet defusedxml
 
       - name: JaCoCo coverage step summary
         # Only the saas leg posts the JUnit summary - it's a strict
@@ -210,7 +210,7 @@ jobs:
         # near-identical tables crowding out the aggregate report.
         if: always() && matrix.flavor == 'saas'
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
             --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
             --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
             --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \

.github/workflows/build-enterprise.yml

@@ -15,11 +15,6 @@ name: Enterprise E2E (Playwright)
 
 on:
   workflow_call:
-    inputs:
-      use_shared_cache:
-        required: false
-        type: boolean
-        default: false
   push:
     branches: ["main"]
   schedule:
@@ -42,9 +37,6 @@ jobs:
     uses: ./.github/workflows/_runner-pick.yml
 
   playwright-e2e-enterprise:
-    environment:
-      name: ci-unsigned
-      deployment: false
     needs: pick
     # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE,
     # so the suite can't boot premium and would fail. See the header comment.
@@ -58,37 +50,18 @@ jobs:
       SYSTEM_ENABLEANALYTICS: "false"
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Restore cache Gradle User Home
-        if: inputs.use_shared_cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
-      - name: Restore cache Gradle
-        if: inputs.use_shared_cache == false
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-playwright-e2e-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
-
+          distribution: "temurin"
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -322,80 +295,3 @@ jobs:
           name: playwright-report-enterprise-${{ github.run_id }}
           path: frontend/playwright-report/
           retention-days: 7
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          rm -f /tmp/helpers.sh /tmp/backend.log /tmp/backend.pid
-        continue-on-error: true
-
-  # Multi-node regression: builds + seeds the clustered stack (testing/compose/docker-compose-multinode.yml)
-  # and runs behave features/multinode. Licence-gated, so it runs after the Playwright job (not in parallel).
-  multinode-e2e:
-    environment:
-      name: ci-unsigned
-      deployment: false
-    needs: [pick, playwright-e2e-enterprise]
-    # Nightly cron + manual dispatch only (heavy build), fork-gated for the licence secret.
-    if: >-
-      always() && needs.pick.outputs.is_fork != 'true'
-      && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    timeout-minutes: 60
-    env:
-      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
-      PREMIUM_ENABLED: "true"
-      SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-      MN_COMPOSE: docker-compose-multinode.yml
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
-      - name: Install behave test deps
-        run: |
-          uv sync --project engine --locked --group cucumber
-      - name: Build the multi-node image
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" build
-      - name: Bring up the cluster and wait for both nodes healthy
-        working-directory: testing/compose
-        run: |
-          docker compose -f "$MN_COMPOSE" up -d
-          for i in $(seq 1 90); do
-            h1=$(docker inspect -f '{{.State.Health.Status}}' multinode-stirling-1 2>/dev/null || echo starting)
-            h2=$(docker inspect -f '{{.State.Health.Status}}' multinode-stirling-2 2>/dev/null || echo starting)
-            if [ "$h1" = healthy ] && [ "$h2" = healthy ]; then echo "both nodes healthy"; exit 0; fi
-            sleep 5
-          done
-          echo "::error::nodes did not become healthy"
-          docker compose -f "$MN_COMPOSE" logs --tail=200 stirling-1 stirling-2
-          exit 1
-      - name: Seed the cluster (teams, users, S3 connection, policy)
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" --profile seed run --rm seed
-      - name: Run multi-node regression (implemented guarantees)
-        working-directory: testing/cucumber
-        # -e overrides behave.ini's exclusion of features/multinode; ~@known_gap skips any tracked-gap scenarios.
-        run: uv run --project ../../engine --locked --group cucumber python -m behave features/multinode -e "features/enterprise" --tags="~@known_gap ~@destructive" --no-capture -f plain
-      - name: Run multi-node failover (destructive)
-        working-directory: testing/cucumber
-        run: uv run --project ../../engine --locked --group cucumber python -m behave features/multinode -e "features/enterprise" --tags="@destructive ~@known_gap" --no-capture -f plain
-      - name: Dump node logs on failure
-        if: failure()
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" logs --tail=400 stirling-1 stirling-2
-      - name: Tear down
-        if: always()
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" --profile seed down -v --remove-orphans

.github/workflows/build.yml

@@ -37,7 +37,6 @@ jobs:
     timeout-minutes: 3
     outputs:
       build: ${{ steps.changes.outputs.build }}
-      backend: ${{ steps.changes.outputs.backend }}
       project: ${{ steps.changes.outputs.project }}
       openapi: ${{ steps.changes.outputs.openapi }}
       frontend: ${{ steps.changes.outputs.frontend }}
@@ -49,27 +48,20 @@ jobs:
       proprietary: ${{ steps.changes.outputs.proprietary }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for file changes
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           filters: .github/config/.files.yaml
 
-  gradle-cache-prime:
-    if: needs.files-changed.outputs.backend == 'true'
-    needs: [files-changed]
-    uses: ./.github/workflows/gradle-cache-prime.yml
-    secrets: inherit
-
   build:
-    if: needs.files-changed.outputs.backend == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       actions: read
       contents: read
@@ -84,7 +76,7 @@ jobs:
     # works after Hibernate's ddl-auto=update migrates the schema. Gated on
     # the `project` filter so doc-only PRs skip this ~5-minute job.
     if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       contents: read
     uses: ./.github/workflows/db-migration-test.yml
@@ -92,7 +84,7 @@ jobs:
 
   check-generateOpenApiDocs:
     if: needs.files-changed.outputs.openapi == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       contents: read
     uses: ./.github/workflows/check-openapi.yml
@@ -107,10 +99,9 @@ jobs:
     uses: ./.github/workflows/frontend-validation.yml
     secrets: inherit
 
-  # Required (in all-checks-passed). Scans the stories a branch touches in both
-  # light and dark; an axe violation in either theme blocks the merge. The
-  # whole-suite sweep (nightly.yml) still covers stories a change affects without
-  # touching them directly.
+  # Advisory: deliberately NOT in all-checks-passed. It reports on the stories a
+  # branch touches so a regression is visible in review, but a browser scan is
+  # too new here to block merges on. Promote it once its pass/fail proves stable.
   frontend-a11y:
     if: needs.files-changed.outputs.frontend == 'true'
     needs: [files-changed]
@@ -129,7 +120,7 @@ jobs:
 
   playwright-e2e-live:
     if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       contents: read
     uses: ./.github/workflows/e2e-live.yml
@@ -137,17 +128,15 @@ jobs:
 
   playwright-e2e-enterprise:
     if: needs.files-changed.outputs.proprietary == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       contents: read
     uses: ./.github/workflows/build-enterprise.yml
     secrets: inherit
-    with:
-      use_shared_cache: true
 
   check-licence:
     if: needs.files-changed.outputs.build == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed, build]
     permissions:
       contents: read
     uses: ./.github/workflows/check-licence.yml
@@ -155,7 +144,7 @@ jobs:
 
   docker-compose-tests:
     if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       actions: write
       contents: read
@@ -166,22 +155,8 @@ jobs:
       docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
 
   test-build-docker-images:
-    if: |
-      !cancelled() &&
-      github.event_name == 'pull_request' &&
-      needs.files-changed.outputs.project == 'true' &&
-      contains(fromJSON('["success", "skipped"]'), needs.gradle-cache-prime.result) &&
-      contains(fromJSON('["success", "skipped"]'), needs.build.result) &&
-      contains(fromJSON('["success", "skipped"]'), needs.check-generateOpenApiDocs.result) &&
-      contains(fromJSON('["success", "skipped"]'), needs.check-licence.result)
-    needs:
-      [
-        files-changed,
-        build,
-        check-generateOpenApiDocs,
-        check-licence,
-        gradle-cache-prime,
-      ]
+    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
+    needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
     permissions:
       contents: read
       packages: read
@@ -193,21 +168,18 @@ jobs:
 
   tauri-build:
     if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       contents: read
       pull-requests: write
     uses: ./.github/workflows/tauri-build.yml
     secrets: inherit
-    # PR smoke build: macOS + Windows (the platforms our developers use).
-    # sign: true only reaches macOS - tauri-build's per-platform gate keeps
-    # Windows/Linux signing on main, and an unsigned .dmg cannot be opened.
+    # PR smoke build: macOS + Windows (the platforms our developers use). 
     # The full signed multi-OS matrix runs on release;
     # nightly still warms the Rust cache with all-OS defaults.
     with:
       platform: windows-macos
-      sign: true
-      use_shared_cache: true
+      sign: false
 
   ai-engine:
     if: needs.files-changed.outputs.engine == 'true'
@@ -225,14 +197,12 @@ jobs:
   # frontend filter, so a CSS-only PR does not pay for a backend build.
   generated-models:
     if: needs.files-changed.outputs.generated-models == 'true'
-    needs: [files-changed, gradle-cache-prime]
+    needs: [files-changed]
     permissions:
       contents: read
       pull-requests: write
     uses: ./.github/workflows/check-generated-models.yml
     secrets: inherit
-    with:
-      use_shared_cache: true
 
   pre-commit:
     needs: [files-changed]
@@ -255,7 +225,7 @@ jobs:
   # for whatever did record. Advisory only - intentionally NOT in
   # all-checks-passed, so a flaky aggregate run never blocks merging.
   coverage-aggregate:
-    if: ${{!cancelled()}}
+    if: always()
     needs:
       - build
       - playwright-e2e-live
@@ -279,12 +249,10 @@ jobs:
     if: always()
     needs:
       - files-changed
-      - gradle-cache-prime
       - build
       - db-migration-test
       - check-generateOpenApiDocs
       - frontend-validation
-      - frontend-a11y
       - playwright-e2e
       - playwright-e2e-live
       - playwright-e2e-enterprise
@@ -299,7 +267,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -307,12 +275,10 @@ jobs:
         env:
           RESULTS: |
             files-changed=${{ needs.files-changed.result }}
-            gradle-cache-prime=${{ needs.gradle-cache-prime.result }}
             build=${{ needs.build.result }}
             db-migration-test=${{ needs.db-migration-test.result }}
             check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
             frontend-validation=${{ needs.frontend-validation.result }}
-            frontend-a11y=${{ needs.frontend-a11y.result }}
             playwright-e2e=${{ needs.playwright-e2e.result }}
             playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
             playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}

.github/workflows/check-generated-models.yml

@@ -1,19 +1,14 @@
 name: Check generated models
 
-# Verifies the committed generated files are still in sync with the Java OpenAPI
-# spec: the request models (toolApiTypes.ts, tool_models.py) and the tool I/O
-# tables saying what each endpoint accepts and produces (toolIO.ts, tool_io.py).
-# Regenerates them all with the single top-level `task tool-models` and fails if
-# any committed file is out of date. Called from build.yml when the
-# backend Java, frontend, or engine changes; also runs on push to main as a
-# post-merge safety net.
+# Verifies the committed generated API models are still in sync with the Java
+# OpenAPI spec: the frontend tool API types
+# (frontend/editor/src/core/types/toolApiTypes.ts) and the engine tool
+# models (engine/src/stirling/models/tool_models.py). Regenerates both with the
+# single top-level `task tool-models` and fails if either committed file is
+# out of date. Called from build.yml when the backend Java, frontend, or engine
+# changes; also runs on push to main as a post-merge safety net.
 on:
   workflow_call:
-    inputs:
-      use_shared_cache:
-        required: false
-        type: boolean
-        default: false
   push:
     branches: [main]
 
@@ -28,7 +23,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -36,39 +31,24 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
           cache-suffix: generated-models
 
-      - name: Restore cache Gradle User Home
-        if: inputs.use_shared_cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
-      - name: Restore cache Gradle
-        if: inputs.use_shared_cache == false
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-generated-models-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.0
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -77,10 +57,18 @@ jobs:
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
+      # Rebuilds the OpenAPI spec from the current Java and regenerates both the
+      # frontend types and the engine tool models from it.
+      - name: Regenerate generated models
+        run: task tool-models
+
       - name: Verify generated models are up to date
         id: models-check
         continue-on-error: true
-        run: task tool-models:check
+        run: |
+          git diff --exit-code \
+            frontend/editor/src/core/types/toolApiTypes.ts \
+            engine/src/stirling/models/tool_models.py
 
       - name: Comment on generated models check failure
         # Only post a comment on PRs. github-script's PR helpers need an
@@ -95,9 +83,9 @@ jobs:
               marker,
               '### Generated Models Check Failed',
               '',
-              'One or more generated files are out of date with the Java OpenAPI spec and will need to be regenerated before they can be merged in.',
+              'The generated `frontend/editor/src/core/types/toolApiTypes.ts` and/or `engine/src/stirling/models/tool_models.py` are out of date with the Java OpenAPI spec and will need to be regenerated before they can be merged in.',
               '',
-              'Run `task tool-models` to regenerate them, then commit the updated files.',
+              'Run `task tool-models` to regenerate both, then commit the updated files.',
             ].join('\n');
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
@@ -128,10 +116,11 @@ jobs:
           echo "  Generated Models Check Failed"
           echo "============================================"
           echo ""
-          echo "One or more generated files are out of date with the Java"
-          echo "OpenAPI spec and will need to be regenerated before merging."
+          echo "The generated frontend API types and/or engine tool"
+          echo "models are out of date with the Java OpenAPI spec and"
+          echo "will need to be regenerated before they can be merged in."
           echo ""
-          echo "Run 'task tool-models' to regenerate them, then"
+          echo "Run 'task tool-models' to regenerate both, then"
           echo "commit the updated files."
           echo "============================================"
           exit 1

.github/workflows/check-licence.yml

@@ -10,31 +10,36 @@ permissions:
 
 jobs:
   check-licence:
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

.github/workflows/check-openapi.yml

@@ -11,31 +11,36 @@ permissions:
 
 jobs:
   check-generate-openapi-docs:
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

.github/workflows/check_toml.yml

@@ -23,23 +23,29 @@ jobs:
     if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     permissions:
-      contents: read # Checkout, and read translation files via the contents API
       issues: write # Allow posting comments on issues/PRs
       pull-requests: write # Allow writing to pull requests
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout main branch first
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Get PR data
         id: get-pr-data
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const prNumber = context.payload.pull_request.number;
             const repoOwner = context.payload.repository.owner.login;
@@ -60,18 +66,17 @@ jobs:
       - name: Fetch PR changed files
         id: fetch-pr-changes
         env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
           # Check if PR number exists
-          if [ -z "${PR_NUMBER}" ]; then
+          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
             echo "Error: PR number is empty"
             exit 1
           fi
           # Get changed files and filter for TOML translation files
-          gh pr view "${PR_NUMBER}" --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
           # Check if any files were found
           if [ ! -s changed_files.txt ]; then
             echo "No TOML translation files changed in this PR"
@@ -83,37 +88,33 @@ jobs:
       - name: Determine reference file
         id: determine-file
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          # Untrusted, fork-controlled values are passed via env, never interpolated into the script
-          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
-          REPO_OWNER: ${{ steps.get-pr-data.outputs.repo_owner }}
-          REPO_NAME: ${{ steps.get-pr-data.outputs.repo_name }}
-          PR_REPO_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
-          PR_REPO_NAME: ${{ github.event.pull_request.head.repo.name }}
-          PR_BRANCH: ${{ steps.get-pr-data.outputs.branch }}
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const fs = require("fs");
             const path = require("path");
 
-            // Validate inputs before any use
-            const validateInput = (input, regex, name) => {
-              if (typeof input !== "string" || !regex.test(input)) {
-                throw new Error(`Invalid ${name}: ${input}`);
-              }
-              return input;
-            };
+            const prNumber = ${{ steps.get-pr-data.outputs.pr_number }};
+            const repoOwner = "${{ steps.get-pr-data.outputs.repo_owner }}";
+            const repoName = "${{ steps.get-pr-data.outputs.repo_name }}";
 
-            const repoOwner = validateInput(process.env.REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "repository owner");
-            const repoName = validateInput(process.env.REPO_NAME, /^[a-zA-Z0-9._-]+$/, "repository name");
-            const prRepoOwner = validateInput(process.env.PR_REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "PR repository owner");
-            const prRepoName = validateInput(process.env.PR_REPO_NAME, /^[a-zA-Z0-9._-]+$/, "PR repository name");
-            const branch = validateInput(process.env.PR_BRANCH, /^[a-zA-Z0-9._/-]+$/, "branch name");
-            const prNumber = Number(validateInput(process.env.PR_NUMBER, /^[0-9]+$/, "PR number"));
+            const prRepoOwner = "${{ github.event.pull_request.head.repo.owner.login }}";
+            const prRepoName = "${{ github.event.pull_request.head.repo.name }}";
+            const branch = "${{ steps.get-pr-data.outputs.branch }}";
 
             console.log(`Determining reference file for PR #${prNumber}`);
 
+            // Validate inputs
+            const validateInput = (input, regex, name) => {
+              if (!regex.test(input)) {
+                throw new Error(`Invalid ${name}: ${input}`);
+              }
+            };
+
+            validateInput(repoOwner, /^[a-zA-Z0-9_-]+$/, "repository owner");
+            validateInput(repoName, /^[a-zA-Z0-9._-]+$/, "repository name");
+            validateInput(branch, /^[a-zA-Z0-9._/-]+$/, "branch name");
+
             // Get the list of changed files in the PR
             const { data: files } = await github.rest.pulls.listFiles({
               owner: repoOwner,
@@ -125,7 +126,7 @@ jobs:
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^frontend\/editor\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -194,26 +195,21 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
 
       - name: Install Python dependencies
         run: |
-          uv sync --project engine --locked --group tools
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Run Python script to check files
         id: run-check
-        env:
-          PR_ACTOR: ${{ github.event.pull_request.user.login }}
         run: |
           echo "Running Python script to check TOML files..."
-          uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py \
-            --actor "${PR_ACTOR}" \
+          python .github/scripts/check_language_toml.py \
+            --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
             --files "${FILES_LIST[@]}" > result.txt
@@ -246,7 +242,7 @@ jobs:
         if: env.SCRIPT_OUTPUT != ''
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env;
             const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
@@ -262,7 +258,7 @@ jobs:
             const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
 
             // Only update or create comments by the action user
-            const expectedActor = "github-actions[bot]";
+            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
 
             if (comment && comment.user.login === expectedActor) {
               // Update existing comment

.github/workflows/coverage-aggregate.yml

@@ -34,32 +34,42 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install defusedxml for coverage scripts
+        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
+        # XML through defusedxml - see the script headers for context.
+        run: python -m pip install --quiet defusedxml
 
       # Pattern matches every artifact this PR's producers might upload:
       #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
@@ -71,7 +81,7 @@ jobs:
       # Each lands as a sibling dir under coverage-execs/, with the .exec
       # files preserving their original relative paths.
       - name: Download all .exec artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
         with:
           pattern: jacoco-exec-*
           path: coverage-execs/
@@ -152,7 +162,7 @@ jobs:
         # ("how much of the backend do real user flows cover?").
         if: steps.inventory.outputs.found_e2e == 'true'
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
             --title "Real user-flow backend coverage (e2e:live + cucumber)" \
             --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
             --github-step-summary
@@ -163,7 +173,7 @@ jobs:
         # is meaningless when one is a strict superset of the other.
         if: steps.inventory.outputs.found_all == 'true'
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
             --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
             --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
             --github-step-summary
@@ -196,7 +206,7 @@ jobs:
         # absence on backend-only runs by skipping the download entirely
         # when the producer job was not part of this workflow run.
         if: inputs.frontend-validation-result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
         with:
           name: frontend-coverage
           path: matrix-inputs/vitest/
@@ -206,7 +216,7 @@ jobs:
         # e2e-live uploads the artifact with a stable name. Skip the
         # download entirely when the producer job did not run.
         if: inputs.playwright-e2e-live-result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
         with:
           name: playwright-frontend-coverage
           path: matrix-inputs/playwright/
@@ -218,7 +228,7 @@ jobs:
         # generated above) plus whichever frontend artifacts landed.
         # Every input is optional; missing ones render as "-".
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-matrix.py \
+          python scripts/coverage-matrix.py \
             ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
             ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
             --vitest matrix-inputs/vitest/coverage-summary.json \

.github/workflows/db-migration-test.yml

@@ -13,35 +13,40 @@ permissions:
 
 jobs:
   migration-test:
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: 25
+          distribution: temurin
 
-      # Keep the normal formatting path here so this smoke test exercises the
-      # same Gradle configuration as the backend build.
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
+
+      # No `-PnoSpotless` here yet because the upstream cache layer matches the
+      # backend build's; reuse keeps cold-cache cost identical.
       - name: Build Stirling-PDF JAR
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
@@ -80,8 +85,3 @@ jobs:
           path: /tmp/stirling-migration-failed-*/app.log
           retention-days: 7
           if-no-files-found: warn
-
-      - name: Cleanup temporary files
-        if: always()
-        run: rm -rf /tmp/stirling-migration-failed-*
-        continue-on-error: true

.github/workflows/dependency-review.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/deploy-on-v2-commit.yml

@@ -0,0 +1,189 @@
+name: Auto V2 Deploy on Push
+
+on:
+  push:
+    branches:
+      - V2
+      - deploy-on-v2-commit
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-v2-on-push:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: deploy-v2-push-V2
+      cancel-in-progress: true
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Get commit hashes for frontend and backend
+        id: commit-hashes
+        run: |
+          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
+          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$FRONTEND_HASH" ]; then
+            FRONTEND_HASH="no-frontend-changes"
+          fi
+
+          # Get last commit that touched backend code, docker/backend, or docker/compose
+          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$BACKEND_HASH" ]; then
+            BACKEND_HASH="no-backend-changes"
+          fi
+
+          echo "Frontend hash: $FRONTEND_HASH"
+          echo "Backend hash: $BACKEND_HASH"
+
+          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
+          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
+
+          # Short hashes for tags
+          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
+            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
+          else
+            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
+          fi
+
+          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
+            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
+          else
+            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check if frontend image exists
+        id: check-frontend
+        run: |
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Frontend image already exists, skipping build"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Frontend image needs to be built"
+          fi
+
+      - name: Check if backend image exists
+        id: check-backend
+        run: |
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Backend image already exists, skipping build"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Backend image needs to be built"
+          fi
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Build and push frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./docker/frontend/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-v2-frontend
+          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
+          tags: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push backend image
+        if: steps.check-backend.outputs.exists == 'false'
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./docker/backend/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-v2-backend
+          cache-to: type=gha,mode=max,scope=stirling-v2-backend
+          tags: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          chmod 600 ../private.key
+
+      - name: Deploy to VPS on port 3000
+        run: |
+          export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
+
+          cat > $UNIQUE_NAME << EOF
+          version: '3.3'
+          services:
+            backend:
+              container_name: stirling-v2-backend
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+              ports:
+                - "13000:8080"
+              volumes:
+                - /stirling/V2/data:/usr/share/tessdata:rw
+                - /stirling/V2/config:/configs:rw
+                - /stirling/V2/logs:/logs:rw
+              environment:
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
+                SYSTEM_DEFAULTLOCALE: en-US
+                UI_APPNAME: "Stirling-PDF V2"
+                UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
+                UI_APPNAMENAVBAR: "V2 Deployment"
+                SYSTEM_MAXFILESIZE: "100"
+                METRICS_ENABLED: "true"
+                SYSTEM_GOOGLEVISIBILITY: "false"
+                SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
+                baseUrl: "https://demo.stirlingpdf.cloud"
+              restart: on-failure:5
+
+            frontend:
+              container_name: stirling-v2-frontend
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+              ports:
+                - "3000:80"
+              environment:
+                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
+              depends_on:
+                - backend
+              restart: on-failure:5
+          EOF
+
+          # Copy to remote with unique name
+          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
+
+          # SSH and rename/move atomically to avoid interference
+          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+            mkdir -p /stirling/V2/{data,config,logs}
+            mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
+            cd /stirling/V2
+            docker-compose down || true
+            docker-compose pull
+            docker-compose up -d
+            docker system prune -af --volumes || true
+            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
+          ENDSSH
+
+      - name: Cleanup temporary files
+        if: always()
+        run: |
+          rm -f ../private.key

.github/workflows/docker-compose-tests.yml

@@ -17,9 +17,6 @@ permissions:
 
 jobs:
   docker-compose-tests:
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     permissions:
       actions: write
@@ -28,25 +25,33 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
 
       # When the PR changes the base image, test.sh builds it locally
       # (stirling-pdf-base:local) into the daemon image store. A buildx
@@ -56,7 +61,7 @@ jobs:
       # runtime token isn't exposed) since the docker driver can't use it.
       - name: Set up Docker Buildx
         if: inputs.docker-base-changed != 'true'
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
       - name: Expose GitHub runtime for Buildx cache
@@ -65,20 +70,19 @@ jobs:
 
       - name: Install Docker Compose
         run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v5.4.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
           sudo chmod +x /usr/local/bin/docker-compose
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./testing/cucumber/requirements.txt
 
-      - name: Install Cucumber and coverage dependencies
+      - name: Pip requirements
         run: |
-          uv sync --project engine --locked --group cucumber --group tools
+          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
 
       - name: Extract JaCoCo agent for cucumber coverage
         # Stages build/jacoco/jacocoagent.jar where the coverage override
@@ -121,10 +125,16 @@ jobs:
             echo "report=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py parses JaCoCo XML through defusedxml -
+        # see the script header for context.
+        if: always() && steps.cucumber-coverage.outputs.report == 'true'
+        run: python -m pip install --quiet defusedxml
+
       - name: Cucumber coverage step summary
         if: always() && steps.cucumber-coverage.outputs.report == 'true'
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
             --title "Cucumber (docker) JaCoCo coverage" \
             --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
             --github-step-summary

.github/workflows/e2e-live.yml

@@ -11,34 +11,22 @@ permissions:
 
 jobs:
   playwright-e2e-live:
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
-
+          distribution: "temurin"
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -65,11 +53,6 @@ jobs:
           # to aggregate. Chromium-only - other engines silently skip.
           PW_COVERAGE: "1"
           PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-          # Internal mirror, as in backend-build.yml. Empty on Dependabot and
-          # fork PRs, where the build falls back to Maven Central.
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
         run: task e2e:live
       - name: Flag flaky tests
         # Runs regardless of the test outcome: a flaky test (passed on retry)
@@ -83,10 +66,6 @@ jobs:
       - name: Generate JaCoCo report from e2e:live .exec
         if: always()
         id: live-coverage
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
         # `if: always()` so even a failed test run still produces a
         # report from whatever flows did exercise the backend before
         # the failure. The task itself tolerates a missing .exec
@@ -103,18 +82,20 @@ jobs:
             echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
             echo "report=false" >> "$GITHUB_OUTPUT"
           fi
-      - name: Install uv
-        if: always()
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Set up Python for coverage summary
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
+        # to dodge XXE / billion-laughs scanner findings.
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        run: python -m pip install --quiet defusedxml
       - name: e2e:live coverage step summary
         if: always() && steps.live-coverage.outputs.report == 'true'
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
             --title "Playwright (live backend) JaCoCo coverage" \
             --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
             --github-step-summary
@@ -137,6 +118,23 @@ jobs:
           retention-days: 7
           if-no-files-found: warn
 
+      - name: Set up Python for frontend coverage summary
+        # Separate from the backend-coverage python step because the
+        # frontend path doesn't depend on a JaCoCo report - it produces
+        # a summary even on backend failure, as long as some Playwright
+        # tests ran far enough to dump V8 coverage.
+        if: always()
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install defusedxml for frontend coverage summary
+        # Idempotent re-install: the backend-coverage step may have
+        # installed it already, but this leg can run on its own when the
+        # backend report step skips (e.g. .exec missing).
+        if: always()
+        run: python -m pip install --quiet defusedxml
+
       - name: Aggregate Playwright frontend (V8) coverage
         # Rolls per-test V8 dumps from the test-base fixture into one
         # vitest-shaped coverage-summary.json. Tolerates a missing dump
@@ -147,7 +145,7 @@ jobs:
         run: |
           if [ -d .test-state/playwright/coverage-pw ] && \
              find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            uv run --project engine --locked --group tools python scripts/playwright-coverage-summary.py \
+            python scripts/playwright-coverage-summary.py \
               .test-state/playwright/coverage-pw \
               --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
             echo "summary=true" >> "$GITHUB_OUTPUT"
@@ -159,10 +157,10 @@ jobs:
       - name: Playwright frontend coverage step summary
         if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
-          --title "Playwright (live) frontend coverage" \
-          --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-          --github-step-summary
+          python scripts/coverage-summary.py \
+            --title "Playwright (live) frontend coverage" \
+            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
+            --github-step-summary
 
       - name: Upload Playwright frontend coverage
         # Bundle both the aggregated summary and the raw V8 dumps so

.github/workflows/e2e-stubbed.yml

@@ -2,8 +2,7 @@ name: Playwright E2E (stubbed)
 
 # Reusable workflow called from build.yml. Backend-free Playwright suite —
 # fast, no Spring Boot required. Runs against the `stubbed` project which
-# mocks API responses in the browser. Fans out one job per browser
-# (chromium/firefox/webkit) so all three run in parallel on their own runner.
+# mocks API responses in the browser.
 on:
   workflow_call:
 
@@ -12,57 +11,32 @@ permissions:
 
 jobs:
   playwright-e2e:
-    name: playwright-e2e (${{ matrix.browser }})
     runs-on: ubuntu-latest
-    # The image already contains the Playwright browsers and all Linux
-    # dependencies. This keeps the matrix for per-browser reporting while
-    # avoiding three concurrent `playwright install --with-deps` runs.
-    container:
-      image: mcr.microsoft.com/playwright:v1.58.2-noble@sha256:6446946a1d9fd62d9ae501312a2d76a43ee688542b21622056a372959b65d63d
-    strategy:
-      # One browser breaking must not mask a failure in another - report all.
-      fail-fast: false
-      matrix:
-        include:
-          - browser: chromium
-            project: stubbed
-          - browser: firefox
-            project: stubbed-firefox
-          - browser: webkit
-            project: stubbed-webkit
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+      - name: Install Playwright (chromium only)
+        run: task e2e:install -- chromium
       - name: Build frontend (production bundle for vite preview)
         env:
           VITE_BUILD_FOR_PREVIEW: "1"
         run: task frontend:build
-      - name: Run stubbed E2E tests (${{ matrix.browser }})
+      - name: Run stubbed E2E tests (chromium)
         env:
-          # The official Playwright image expects its browser runtime under
-          # the root home directory. Keep this scoped to Playwright and use a
-          # neutral Docker config path so Docker does not read /root/.docker.
-          HOME: /root
-          DOCKER_CONFIG: /tmp/playwright-docker-config
           PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-          NPM_CONFIG_PREFER_OFFLINE: "true"
-          NPM_CONFIG_FETCH_RETRIES: "5"
-          NPM_CONFIG_FETCH_RETRY_FACTOR: "2"
-          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: "1000"
-          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: "120000"
-        run: task e2e:stubbed-project PROJECT=${{ matrix.project }} -- --workers=3
+        run: task e2e:stubbed -- --workers=3
       - name: Flag flaky tests
         # Runs regardless of the test outcome: a flaky test (passed on retry)
         # leaves the step green, so this is the only place it surfaces. Emits
@@ -76,6 +50,6 @@ jobs:
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-report-stubbed-${{ matrix.browser }}-${{ github.run_id }}
+          name: playwright-report-stubbed-${{ github.run_id }}
           path: frontend/playwright-report/
           retention-days: 7

.github/workflows/frontend-a11y.yml

@@ -3,12 +3,17 @@ name: Frontend a11y regression gate
 # Reusable workflow called from build.yml when frontend sources change.
 #
 # Scans the stories this branch touches in real Chromium and runs axe against
-# each; the check fails on any axe violation, or on a story that fails to render
-# at all.
+# each. Existing violations are grandfathered in .storybook/a11y-baseline.json;
+# the check fails on a NEW violation — a story breaking a rule it wasn't already
+# breaking — or on a story that fails to render at all.
 #
 # Only changed stories, because a full sweep is ~30 minutes: far too slow to sit
 # in front of every merge. The whole suite is scanned nightly instead
 # (nightly.yml), which catches anything a branch didn't touch.
+#
+# Advisory for now: this is not in build.yml's all-checks-passed list, so a
+# failure reports without blocking. Promote it once a few weeks of runs show the
+# pass/fail is stable.
 on:
   workflow_call:
 
@@ -21,7 +26,7 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
@@ -30,7 +35,7 @@ jobs:
           # Need the base branch too, to diff against it.
           fetch-depth: 0
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"

.github/workflows/frontend-backend-licenses-update.yml

@@ -28,7 +28,7 @@ jobs:
       licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -36,16 +36,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for file changes
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           filters: .github/config/.files.yaml
 
   generate-frontend-license-report:
-    # ci-bot, not bot-identity: this job runs on PRs too, and bot-identity is main-only.
-    environment:
-      name: ci-bot
-      deployment: false
     if: needs.files-changed.outputs.licenses-frontend == 'true'
     name: Generate Frontend License Report
     needs: files-changed
@@ -56,7 +52,7 @@ jobs:
       repository-projects: write # Required for enabling automerge
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -84,7 +80,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -166,7 +162,7 @@ jobs:
             });
 
             // Filter for license check comments
-            const licenseComments = comments.filter(comment =>
+            const licenseComments = comments.filter(comment => 
               comment.body.includes('## ✅ Frontend License Check Passed') ||
               comment.body.includes('## ❌ Frontend License Check Failed')
             );
@@ -320,10 +316,6 @@ jobs:
           GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
 
   generate-backend-license-report:
-    # ci-bot, not bot-identity: this job runs on PRs too, and bot-identity is main-only.
-    environment:
-      name: ci-bot
-      deployment: false
     if: needs.files-changed.outputs.licenses-backend == 'true'
     needs: files-changed
     name: Generate Backend License Report
@@ -334,7 +326,7 @@ jobs:
       repository-projects: write # Required for enabling automerge
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -352,18 +344,16 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-license-report-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -417,7 +407,7 @@ jobs:
               per_page: 100
             });
 
-            const backendLicenseComments = comments.filter(comment =>
+            const backendLicenseComments = comments.filter(comment => 
               comment.body.includes('## ✅ Backend License Check Passed') ||
               comment.body.includes('## ❌ Backend License Check Failed')
             );

.github/workflows/frontend-validation.yml

@@ -1,8 +1,8 @@
 name: Frontend lint, type-check, and build
 
 # Reusable workflow called from build.yml when frontend / testing sources
-# change. Runs `task frontend:check:all` and uploads the 
-# coverage + dist artifacts for downstream jobs.
+# change. Runs the consolidated `task frontend:check:all` (lint, types,
+# unit tests, build) and uploads the dist artifact for downstream jobs.
 on:
   workflow_call:
 
@@ -15,13 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -105,18 +105,30 @@ jobs:
                 comment_id: existing.id,
               });
             }
-      - name: Install uv
+      - name: Vitest coverage
+        # Separate from `frontend:check:all` so the quality-gate run stays
+        # uninstrumented (faster signal) and coverage stays an informational
+        # follow-up. Continue-on-error keeps the workflow green even when
+        # a handful of test files refuse to import (e.g. missing icon
+        # specifiers) - the summary still gets posted with whatever
+        # vitest managed to instrument.
+        id: frontend-coverage
+        continue-on-error: true
+        run: task frontend:test:coverage
+      - name: Set up Python for coverage summary
         if: always()
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+      - name: Install defusedxml for coverage summary
+        # See coverage-summary.py header - it parses XML through defusedxml
+        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
+        if: always()
+        run: python -m pip install --quiet defusedxml
       - name: Vitest coverage step summary
         if: always()
         run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
             --title "Frontend Vitest coverage" \
             --vitest frontend/editor/coverage/coverage-summary.json \
             --github-step-summary

.github/workflows/gradle-cache-prime.yml

@@ -1,65 +0,0 @@
-name: Prime Gradle Cache
-
-on:
-  workflow_call:
-  push:
-    branches: ["main"]
-
-permissions:
-  contents: read
-
-jobs:
-  gradle-cache-prime:
-    environment:
-      name: ci-unsigned
-      deployment: false
-    name: Prime shared Gradle cache
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Calculate Gradle cache key
-        id: gradle-cache-key
-        shell: bash
-        run: |
-          echo "key=gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}" >> "$GITHUB_OUTPUT"
-
-      - name: Cache Gradle (lookup-only)
-        id: cache-gradle-restore
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ steps.gradle-cache-key.outputs.key }}
-          lookup-only: true
-
-      - name: Set up JDK 25
-        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
-        uses: ./.github/actions/java
-        with:
-          java-version: "25"
-
-      - name: Resolve backend dependencies
-        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
-        run: ./gradlew :stirling-pdf:classes --no-daemon
-        env:
-          STIRLING_FLAVOR: saas
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Save cache Gradle User Home
-        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ steps.gradle-cache-key.outputs.key }}

.github/workflows/manage-label.yml

@@ -15,7 +15,7 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/multiOSReleases.yml

@@ -12,14 +12,13 @@ on:
           - "true"
           - "false"
       platform:
-        description: "Platform to build (windows, windows-arm64, macos, linux, or all)"
+        description: "Platform to build (windows, macos, linux, or all)"
         required: true
         default: "all"
         type: choice
         options:
           - all
           - windows
-          - windows-arm64
           - macos
           - linux
       sign:
@@ -38,9 +37,6 @@ permissions:
 
 jobs:
   determine-matrix:
-    environment:
-      name: ci-unsigned
-      deployment: false
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
@@ -48,24 +44,32 @@ jobs:
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Cache Gradle
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependencies
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
 
-      - name: Set up JDK 25
-        uses: ./.github/actions/java
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
-          java-version: "25"
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -83,43 +87,27 @@ jobs:
       - name: Determine build matrix
         id: set-matrix
         run: |
-          # windows-arm64: NSIS only (WiX MSI has no arm64 support in Tauri) and no
-          # JPDFium natives yet - flip to windows-arm64 once JPDFium ships them.
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
-          WINDOWS_ARM64='{"platform":"windows-11-arm","args":"--target aarch64-pc-windows-msvc --bundles nsis","name":"windows-arm64","jpdfium_platforms":"none"}'
-          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'
-          ALL="$WINDOWS,$WINDOWS_ARM64,$MACOS,$LINUX"
-
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${INPUT_PLATFORM}" in
+            case "${{ github.event.inputs.platform }}" in
               "windows")
-                echo "matrix={\"include\":[$WINDOWS,$WINDOWS_ARM64]}" >> $GITHUB_OUTPUT
-                ;;
-              "windows-arm64")
-                echo "matrix={\"include\":[$WINDOWS_ARM64]}" >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}]}' >> $GITHUB_OUTPUT
                 ;;
               "macos")
-                echo "matrix={\"include\":[$MACOS]}" >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}]}' >> $GITHUB_OUTPUT
                 ;;
               "linux")
-                echo "matrix={\"include\":[$LINUX]}" >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
                 ;;
               *)
-                echo "matrix={\"include\":[$ALL]}" >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
                 ;;
             esac
           else
             # For push/release events, build all platforms
-            echo "matrix={\"include\":[$ALL]}" >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
           fi
 
-        env:
-          INPUT_PLATFORM: ${{ github.event.inputs.platform }}
   build-jars:
-    environment:
-      name: ci-unsigned
-      deployment: false
     needs: determine-matrix
     runs-on: ubuntu-latest
     strategy:
@@ -139,28 +127,26 @@ jobs:
             file_suffix: "-server"
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
           cache: "npm"
@@ -194,7 +180,6 @@ jobs:
           retention-days: 1
 
   build:
-    environment: release-signing
     needs: determine-matrix
     strategy:
       fail-fast: false
@@ -202,10 +187,11 @@ jobs:
     runs-on: ${{ matrix.platform }}
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
           allowed-endpoints: >
@@ -222,7 +208,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
           cache: "npm"
@@ -234,35 +220,32 @@ jobs:
           toolchain: stable
           targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       # x86_64 JDK is set up first so the aarch64 step below can leave its
       # JAVA_HOME as the active one. The macOS universal JRE build needs
       # jmods from both arches; the x64 path is captured into the env
-      # before the second local JDK setup overwrites JAVA_HOME.
+      # before the second setup-java overwrites JAVA_HOME.
       - name: Set up x86_64 JDK 25 (macOS universal JRE)
         if: matrix.platform == 'macos-15'
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
           architecture: "x64"
 
       - name: Capture x86_64 JAVA_HOME
         if: matrix.platform == 'macos-15'
         run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
 
-      # Temurin has no windows-aarch64 JDK 25 yet; Microsoft OpenJDK does.
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
-          distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -288,7 +271,7 @@ jobs:
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -298,22 +281,22 @@ jobs:
           SM_HOST: ${{ secrets.SM_HOST }}
 
       - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         shell: pwsh
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
 
           # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("$env:SM_CLIENT_CERT_FILE_B64")
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
           $certPath = "D:\Certificate_pkcs12.p12"
           [IO.File]::WriteAllBytes($certPath, $certBytes)
 
           # Set environment variables
           echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=$env:SM_HOST" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=$env:SM_API_KEY" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=$env:SM_KEYPAIR_ALIAS" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
 
           # Get PKCS11 config path from DigiCert action
           $pkcs11Config = $env:PKCS11_CONFIG
@@ -331,14 +314,40 @@ jobs:
             }
           }
 
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         env:
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
       - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -359,7 +368,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -375,7 +384,7 @@ jobs:
       # Without this, signCommand failures are opaque (Tauri captures but drops
       # smctl's stderr) - running these loudly surfaces auth/env/keypair issues.
       - name: Preflight smctl
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         shell: pwsh
         env:
           KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -406,7 +415,7 @@ jobs:
       # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
       # from env (set by prior DigiCert setup step). No --config-file needed.
       - name: Configure Windows code signing
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         shell: bash
         env:
           KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -427,7 +436,7 @@ jobs:
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
 
       - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |
           echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
           gpg --list-secret-keys --keyid-format=long
@@ -445,7 +454,7 @@ jobs:
           fi
 
       - name: Build Tauri app
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -459,8 +468,8 @@ jobs:
           #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
           #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
           # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or the release branch, when secret is present.
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')) && '1' || '0' }}
+          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or V2-master, when secret is present.
+          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
           SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -475,57 +484,10 @@ jobs:
           projectPath: ./frontend/editor
           tauriScript: npx tauri
           args: ${{ matrix.args }}
-
-      # Bundled libwayland conflicts with the host's on some distros (Fedora
-      # Wayland: EGL_BAD_PARAMETER, blank window - #6878). Repack without it,
-      # then regenerate the updater .sig (repack invalidates the original) and
-      # GPG-sign again when release signing is on.
-      - name: Strip bundled Wayland libs from AppImage
-        if: matrix.platform == 'ubuntu-22.04'
-        continue-on-error: true
-        env:
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          GPG_SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')) && '1' || '0' }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-        run: |
-          set -euo pipefail
-          AI=$(find "$PWD/frontend/editor/src-tauri/target" -name "*.AppImage" | head -1)
-          if [ -z "$AI" ]; then echo "No AppImage found - skipping"; exit 0; fi
-          chmod +x "$AI"
-          WORK=$(mktemp -d)
-          (cd "$WORK" && "$AI" --appimage-extract >/dev/null)
-          if ! ls "$WORK/squashfs-root/usr/lib/"libwayland-* >/dev/null 2>&1; then
-            echo "No bundled libwayland - nothing to strip"
-            rm -rf "$WORK"
-            exit 0
-          fi
-          rm -f "$WORK/squashfs-root/usr/lib/"libwayland-*
-          curl -fsSL -o "$WORK/appimagetool" \
-            https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
-          # Pinned checksum: never execute an unverified downloaded binary. On
-          # mismatch (upstream rebuilt continuous) the step aborts and the
-          # original AppImage ships unchanged - update the pin deliberately.
-          echo "a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0  $WORK/appimagetool" | sha256sum -c -
-          chmod +x "$WORK/appimagetool"
-          SIGN_ARGS=()
-          if [ "$GPG_SIGN" = "1" ] && [ -n "${SIGN_KEY:-}" ]; then
-            SIGN_ARGS=(--sign --sign-key "$SIGN_KEY")
-          fi
-          "$WORK/appimagetool" --appimage-extract-and-run "${SIGN_ARGS[@]}" "$WORK/squashfs-root" "$AI.new"
-          # Updater payload signature must match the repacked bytes. The CLI
-          # reads the key/password from env - never pass secrets as argv.
-          if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
-            (cd frontend && npx tauri signer sign "$AI.new")
-            mv "$AI.new.sig" "$AI.sig"
-          fi
-          mv "$AI.new" "$AI"
-          rm -rf "$WORK"
-          echo "Stripped bundled libwayland from $(basename "$AI")"
+          updaterJsonKeepUniversal: true
 
       - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
+        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         env:
           RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
         run: |
@@ -540,31 +502,10 @@ jobs:
       # artifact. Tauri signs a COPY when bundling into the MSI and leaves the raw
       # cargo output unsigned, so checking it produces false negatives.
       - name: Verify Windows Code Signature
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         timeout-minutes: 15
         shell: pwsh
         run: |
-          # arm64 ships an NSIS installer, not an MSI. Tauri's signCommand signs the
-          # inner exe before packing and the setup exe after, so verifying the setup
-          # exe is the arm64 equivalent of the MSI + inner-exe check below.
-          if ("${{ matrix.platform }}" -eq "windows-11-arm") {
-            $setupExes = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*-setup.exe" -Recurse -File
-            if ($setupExes.Count -eq 0) {
-              Write-Host "[ERROR] No NSIS installer found under target/"
-              exit 1
-            }
-            foreach ($exe in $setupExes) {
-              $sig = Get-AuthenticodeSignature -FilePath $exe.FullName
-              Write-Host "NSIS installer: $($exe.Name) Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-              if ($sig.Status -ne "Valid") {
-                Write-Host "[ERROR] NSIS installer is not signed"
-                exit 1
-              }
-            }
-            Write-Host "[SUCCESS] NSIS installer is properly signed"
-            exit 0
-          }
-
           $allSigned = $true
 
           # Check MSI installer (outer wrapper - what users download)
@@ -628,7 +569,7 @@ jobs:
       # but drops stderr when the command exits non-zero, making failures opaque.
       # The real errors live in smctl's log files - surface them here for debugging.
       - name: Dump smctl logs on failure
-        if: ${{ failure() && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' }}
+        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         shell: pwsh
         run: |
           $logDir = "$env:USERPROFILE\.signingmanager\logs"
@@ -664,11 +605,6 @@ jobs:
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
             find . -name "*.msi.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi.sig" \;
-          elif [ "${{ matrix.platform }}" = "windows-11-arm" ]; then
-            # arm64 ships the NSIS installer (WiX MSI has no arm64 support in Tauri).
-            # The setup exe is also its own updater payload (-> sibling .sig).
-            find . -name "*-setup.exe" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}-setup.exe" \;
-            find . -name "*-setup.exe.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}-setup.exe.sig" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
             # DMG = manual install; .app.tar.gz (+ .sig) = updater payload.
             # Raw .app is intentionally not shipped (hundreds of MB of uncompressed input).
@@ -694,17 +630,6 @@ jobs:
           path: ./dist/*
           retention-days: 1
 
-      - name: Cleanup temporary files
-        if: always()
-        shell: bash
-        run: |
-          rm -f certificate.p12
-          rm -rf "$RUNNER_TEMP/msi-verify"
-          if [ "${{ matrix.platform }}" = "macos-15" ]; then
-            security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" 2>/dev/null || true
-          fi
-        continue-on-error: true
-
   collect-and-release:
     needs: [determine-matrix, build, build-jars]
     runs-on: ubuntu-latest
@@ -712,7 +637,7 @@ jobs:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -794,10 +719,6 @@ jobs:
                   'bundles': ['Stirling-PDF-windows-x86_64.msi'],
                   'targets': ['windows-x86_64-msi', 'windows-x86_64'],
               },
-              {
-                  'bundles': ['Stirling-PDF-windows-arm64-setup.exe'],
-                  'targets': ['windows-aarch64-nsis', 'windows-aarch64'],
-              },
               {
                   'bundles': ['Stirling-PDF-macos-universal.app.tar.gz'],
                   'targets': ['darwin-x86_64', 'darwin-aarch64'],
@@ -860,7 +781,7 @@ jobs:
           PYEOF
 
       - name: Upload merged artifacts for review
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: release-artifacts
           path: ./artifacts/
@@ -868,27 +789,21 @@ jobs:
 
       # Gate publish on valid updater sigs. Runs after the review upload (so
       # artifacts survive for debugging) and before action-gh-release.
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
       - name: Verify updater signatures
         run: |
-          uv run --project engine --locked --only-group updater-signatures python .github/scripts/verify-updater-signatures.py \
+          python3 -m pip install --quiet 'cryptography==44.0.0'
+          python3 .github/scripts/verify-updater-signatures.py \
             ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
 
       # workflow_dispatch path requires platform=='all' so a single-platform
       # dispatch can't overwrite an existing release's full latest.json with a
       # partial one (action-gh-release defaults overwrite_files:true).
-      # release event / release branch always build the full matrix so no extra guard needed.
+      # release / V2-master always build the full matrix so no extra guard needed.
       # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
       # instead of silently shipping a broken auto-update.
       - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/release'
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
           # Don't regenerate/append notes on re-runs, and don't force this into the
@@ -902,7 +817,6 @@ jobs:
           files: |
             ./artifacts/**/*.jar
             ./artifacts/**/*.msi
-            ./artifacts/**/*-setup.exe
             ./artifacts/**/*.dmg
             ./artifacts/**/*.app.tar.gz
             ./artifacts/**/*.deb

.github/workflows/nightly.yml

@@ -4,11 +4,6 @@ on:
   schedule:
     - cron: "0 2 * * *" # 2 AM UTC every night
   workflow_dispatch:
-  pull_request:
-    paths:
-      - .github/workflows/nightly.yml
-      - testing/cucumber/**
-      - docker/embedded/compose/test_cicd.yml
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -23,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -31,7 +26,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -65,16 +60,11 @@ jobs:
   # a day.
   a11y-all-stories:
     name: a11y (every story)
-    strategy:
-      fail-fast: false
-      matrix:
-        theme: [light, dark]
     runs-on: ubuntu-latest
-    # One full sweep (~30 minutes of browser time).
     timeout-minutes: 60
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -82,7 +72,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"
@@ -91,14 +81,14 @@ jobs:
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
-      - name: a11y gate (every story, ${{ matrix.theme }})
-        run: task frontend:storybook:a11y:${{ matrix.theme }}
+      - name: a11y gate (every story)
+        run: task frontend:storybook:a11y
 
       - name: Upload scan reports
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: a11y-scan-nightly-${{ matrix.theme }}-${{ github.run_id }}
+          name: a11y-scan-nightly-${{ github.run_id }}
           path: frontend/.a11y-scan/
           retention-days: 14
           if-no-files-found: ignore
@@ -108,13 +98,8 @@ jobs:
 
   # Builds all desktop platforms on a schedule so the Rust dependency cache is
   # written on main, where PR and merge-queue tauri builds can restore it.
-  #
-  # The only job here still pinned to schedule/main: it primes a cache rather than
-  # testing anything, and Actions scopes a cache written on a PR branch to that PR
-  # alone, so a PR run costs three platform builds and produces nothing reusable.
   warm-tauri-cache:
     name: Warm Tauri Rust cache
-    if: github.event_name == 'schedule' || github.ref == 'refs/heads/main'
     permissions:
       contents: read
       pull-requests: write
@@ -123,74 +108,3 @@ jobs:
       platform: all
       sign: false
     secrets: inherit
-
-  # Runs the @nightly tag (conversion scenarios) plus a 10-shard concurrency run
-  # of every other feature.
-  cucumber-nightly:
-    environment:
-      name: ci-unsigned
-      deployment: false
-    name: Cucumber (nightly scenarios + full concurrency)
-    runs-on: ubuntu-latest
-    # Fork pull requests get no MAVEN_* secrets, so the image build cannot work.
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: read
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: ./.github/actions/java
-        with:
-          java-version: "25"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Start the fat image with login and storage enabled
-        run: docker compose -f docker/embedded/compose/test_cicd.yml up -d --build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Wait for the server
-        # Throwaway key from test_cicd.yml; out of the header literal for gitleaks.
-        env:
-          TEST_API_KEY: "123456789"
-        run: |
-          curl --retry 90 --retry-delay 3 --retry-connrefused --retry-all-errors \
-            -sf -H "X-API-KEY: $TEST_API_KEY" http://localhost:8080/api/v1/info/status
-
-      # Heavy LibreOffice/Calibre/Ghostscript conversions, excluded from the PR run.
-      # Both tasks install the behave deps themselves, so there is no separate uv sync step.
-      - name: Run @nightly scenarios
-        run: task cucumber:nightly
-
-      # Genuinely different payloads contending on one backend.
-      - name: Sharded concurrency validation
-        run: task cucumber:parallel SHARDS=10
-
-      - name: Container logs on failure
-        if: failure()
-        run: docker compose -f docker/embedded/compose/test_cicd.yml logs --tail 400
-
-      - name: Tear down
-        if: always()
-        run: docker compose -f docker/embedded/compose/test_cicd.yml down -v

.github/workflows/package-managers.yml

@@ -28,7 +28,7 @@ jobs:
       jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -73,14 +73,13 @@ jobs:
           echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
 
   update-homebrew-and-scoop:
-    environment: package-publish
     needs: get-release-info
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/pr-conflict-labeler.yml

@@ -27,22 +27,29 @@ jobs:
     name: Label conflicted PRs
     runs-on: ubuntu-latest
     permissions:
-      contents: read # actions/checkout
-      issues: write # get/create the repo-level conflict label
-      pull-requests: write # pulls.get/list plus add/remove the label on PRs
+      contents: read
+      issues: write
+      pull-requests: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: Check out the repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Set up stirling-bot token
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Apply conflict label
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ github.token }}
+          github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const conflictLabel = process.env.CONFLICT_LABEL;
             const owner = context.repo.owner;

.github/workflows/pre_commit.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -25,16 +25,13 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
           cache-suffix: pre-commit
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Run pre-commit checks
         run: task pre-commit

.github/workflows/push-docker-base.yml

@@ -17,9 +17,6 @@ permissions:
 
 jobs:
   push-base:
-    # Own environment: docker-publish is branch-locked to release/main,
-    # which excludes the baseDockerImage/accessIssueFix branches this runs on.
-    environment: docker-base-publish
     if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
     runs-on: ubuntu-24.04-8core
     permissions:
@@ -35,11 +32,9 @@ jobs:
 
       - name: Set version
         id: version
-        env:
-          INPUT_VERSION: ${{ github.event.inputs.version }}
         run: |
           if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${INPUT_VERSION}"
+            VERSION="${{ github.event.inputs.version }}"
           elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
             VERSION="1.0.3"
           else
@@ -48,20 +43,20 @@ jobs:
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -69,10 +64,10 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Convert repository owner to lowercase
         id: repoowner
@@ -80,7 +75,7 @@ jobs:
 
       - name: Generate tags for base image
         id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base

.github/workflows/push-docker.yml

@@ -13,25 +13,22 @@ on:
         required: false
         type: boolean
         default: true
+      build_engine:
+        description: "Build & push the stirling-pdf-engine image (plus the -docparse addon variant)."
+        required: false
+        type: boolean
+        default: false
       force_unoserver_rebuild:
         description: "Rebuild stirling-unoserver even if its source hash is unchanged."
         required: false
         type: boolean
         default: false
-      build_engine:
-        description: "Build & push the standalone stirling-engine image."
-        required: false
-        type: boolean
-        default: true
-      force_engine_rebuild:
-        description: "Rebuild stirling-engine even if its source hash is unchanged."
-        required: false
-        type: boolean
-        default: false
   push:
     branches:
-      - release
+      - master
       - main
+      - V2-master
+      - testMain
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -50,7 +47,6 @@ permissions:
 
 jobs:
   push:
-    environment: docker-publish
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-24.04-8core
     permissions:
@@ -60,31 +56,40 @@ jobs:
     env:
       RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
       RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
-      RUN_ENGINE: ${{ github.event_name != 'workflow_dispatch' || inputs.build_engine }}
+      # Engine images are dispatch-only for now; flip the default once the addon stabilises.
+      RUN_ENGINE: ${{ github.event_name == 'workflow_dispatch' && inputs.build_engine }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Cache Gradle
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependencies
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-push-docker-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
 
-      - name: Set up JDK 25
-        uses: ./.github/actions/java
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
-          java-version: "25"
+          gradle-version: 9.6.1
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -97,32 +102,32 @@ jobs:
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
       - name: Install cosign
-        if: github.ref == 'refs/heads/release'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: "v2.4.1"
 
       - name: Install cosign
-        if: github.ref == 'refs/heads/release'
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: "v2.4.1"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Convert repository owner to lowercase
         id: repoowner
@@ -131,7 +136,7 @@ jobs:
       - name: Generate tags for latest
         id: meta
         if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -139,8 +144,8 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/release' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
 
       - name: Build and push Unified Dockerfile (latest variant)
         id: build-push-latest
@@ -164,7 +169,7 @@ jobs:
           sbom: true
 
       - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-latest.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
         env:
           DIGEST: ${{ steps.build-push-latest.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
@@ -179,7 +184,7 @@ jobs:
 
       - name: Generate tags for latest-fat
         id: meta-fat
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
@@ -188,8 +193,8 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/release' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
 
       - name: Build and push Unified Dockerfile (fat variant)
         id: build-push-fat
@@ -210,7 +215,7 @@ jobs:
           sbom: true
 
       - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-fat.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
         env:
           DIGEST: ${{ steps.build-push-fat.outputs.digest }}
           TAGS: ${{ steps.meta-fat.outputs.tags }}
@@ -221,9 +226,65 @@ jobs:
             cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
           done
 
+      - name: Generate tags for engine
+        id: meta-engine
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        if: env.RUN_ENGINE == 'true'
+        with:
+          images: |
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-engine
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-engine
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Build and push engine image
+        id: build-push-engine
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        if: env.RUN_ENGINE == 'true' && steps.meta-engine.outputs.tags != ''
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: ./engine
+          push: true
+          cache-from: type=gha,scope=stirling-pdf-engine
+          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
+          tags: ${{ steps.meta-engine.outputs.tags }}
+          labels: ${{ steps.meta-engine.outputs.labels }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Generate tags for engine docparse addon
+        id: meta-engine-docparse
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        if: env.RUN_ENGINE == 'true'
+        with:
+          images: |
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-engine
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-engine
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-docparse
+            type=raw,value=latest-docparse
+
+      - name: Build and push engine docparse addon image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        if: env.RUN_ENGINE == 'true' && steps.meta-engine-docparse.outputs.tags != ''
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: ./engine
+          push: true
+          cache-from: type=gha,scope=stirling-pdf-engine-docparse
+          cache-to: type=gha,mode=max,scope=stirling-pdf-engine-docparse
+          tags: ${{ steps.meta-engine-docparse.outputs.tags }}
+          labels: ${{ steps.meta-engine-docparse.outputs.labels }}
+          build-args: DOCPARSE=true
+          platforms: linux/amd64
+          provenance: true
+          sbom: true
+
       - name: Generate tags for ultra-lite
         id: meta-lite
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
@@ -232,8 +293,8 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/release' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
 
       - name: Build and push Unified Dockerfile (ultra-lite variant)
         id: build-push-lite
@@ -254,7 +315,7 @@ jobs:
           sbom: true
 
       - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-lite.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
         env:
           DIGEST: ${{ steps.build-push-lite.outputs.digest }}
           TAGS: ${{ steps.meta-lite.outputs.tags }}
@@ -266,7 +327,7 @@ jobs:
           done
 
       # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. release: publish <version>+latest
+      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
       # only when the version is new. main/testMain: republish :alpha only
       # when the source hash differs from the published image's annotation.
       - name: Read unoserver image version
@@ -325,7 +386,7 @@ jobs:
           fi
 
           case "$EFFECTIVE_REF" in
-            refs/heads/release)
+            refs/heads/master|refs/heads/V2-master)
               if [ "${FORCE_REBUILD}" = "true" ]; then
                 echo "force_unoserver_rebuild=true — building stable regardless"
                 mode="stable"
@@ -397,119 +458,3 @@ jobs:
           else
             echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
           fi
-
-      # Standalone AI engine image, same shape as the unoserver image above.
-      - name: Compute engine image source hash
-        id: engineHash
-        if: env.RUN_ENGINE == 'true'
-        run: |
-          set -eu
-          hash=$( { cat engine/Dockerfile engine/pyproject.toml engine/uv.lock engine/.env; \
-                    find engine/src -type f -print0 | sort -z | xargs -0 cat; } \
-                  | sha256sum | cut -d' ' -f1)
-          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
-          echo "Engine source hash: ${hash}"
-
-      - name: Decide whether to publish engine image
-        id: engineDecision
-        if: env.RUN_ENGINE == 'true'
-        env:
-          ENGINE_VERSION: ${{ steps.versionNumber.outputs.versionNumber }}
-          ENGINE_HASH: ${{ steps.engineHash.outputs.hash }}
-          ENGINE_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-engine
-          ENGINE_HASH_ANNOTATION: org.stirlingpdf.engine-source-hash
-          FORCE_REBUILD: ${{ inputs.force_engine_rebuild }}
-          GH_REF: ${{ github.ref }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -eu
-          mode="skip"
-          tags=""
-
-          read_published_hash() {
-            local ref="$1"
-            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
-              | jq -r --arg key "$ENGINE_HASH_ANNOTATION" \
-                  '.annotations[$key] // empty' \
-              2>/dev/null || true
-          }
-
-          # Manual dispatch from any branch routes to the :alpha publish path.
-          EFFECTIVE_REF="$GH_REF"
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            EFFECTIVE_REF="refs/heads/testMain"
-          fi
-
-          case "$EFFECTIVE_REF" in
-            refs/heads/release)
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_engine_rebuild=true — building stable regardless"
-                mode="stable"
-                tags="${ENGINE_IMAGE}:${ENGINE_VERSION},${ENGINE_IMAGE}:latest"
-              elif docker manifest inspect "${ENGINE_IMAGE}:${ENGINE_VERSION}" >/dev/null 2>&1; then
-                echo "stirling-engine:${ENGINE_VERSION} already on GHCR — skipping"
-              else
-                echo "stirling-engine:${ENGINE_VERSION} is new — will publish"
-                mode="stable"
-                tags="${ENGINE_IMAGE}:${ENGINE_VERSION},${ENGINE_IMAGE}:latest"
-              fi
-              ;;
-            refs/heads/main|refs/heads/testMain)
-              published_hash=$(read_published_hash "${ENGINE_IMAGE}:alpha")
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_engine_rebuild=true — rebuilding :alpha regardless"
-                mode="alpha"
-                tags="${ENGINE_IMAGE}:alpha"
-              elif [ -n "$published_hash" ] && [ "$published_hash" = "$ENGINE_HASH" ]; then
-                echo "Published :alpha source hash matches (${published_hash}) — skipping"
-              else
-                if [ -z "$published_hash" ]; then
-                  echo ":alpha has no source-hash annotation (first publish) — will publish"
-                else
-                  echo "Source hash changed (was ${published_hash}, now ${ENGINE_HASH}) — will publish"
-                fi
-                mode="alpha"
-                tags="${ENGINE_IMAGE}:alpha"
-              fi
-              ;;
-            *)
-              echo "Branch ${GH_REF} does not publish engine image"
-              ;;
-          esac
-          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
-          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push engine image
-        id: build-push-engine
-        if: env.RUN_ENGINE == 'true' && steps.engineDecision.outputs.mode != 'skip'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-engine
-          cache-to: type=gha,mode=max,scope=stirling-engine
-          tags: ${{ steps.engineDecision.outputs.tags }}
-          # Manifest annotation read by the decision step above to detect drift.
-          annotations: |
-            index:org.stirlingpdf.engine-source-hash=${{ steps.engineHash.outputs.hash }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign engine image
-        if: env.RUN_ENGINE == 'true' && steps.engineDecision.outputs.mode == 'stable'
-        env:
-          DIGEST: ${{ steps.build-push-engine.outputs.digest }}
-          TAGS: ${{ steps.engineDecision.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping engine image signing"
-          fi

.github/workflows/rollback-latest.yml

@@ -13,13 +13,12 @@ permissions:
 
 jobs:
   rollback:
-    environment: docker-publish
     runs-on: ubuntu-latest
     permissions:
       packages: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -27,13 +26,13 @@ jobs:
         uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/scorecards.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -75,6 +75,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/stale.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - release
+      - master
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -23,31 +23,26 @@ permissions:
 
 jobs:
   push:
-    # package-publish holds SWAGGERHUB_API_KEY. It requires reviewer approval and
-    # is limited to main / release / v* tags, so every push to release waits on one.
-    environment: package-publish
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Cache Gradle
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-swagger-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs

.github/workflows/sync-portal-docs.yml

@@ -24,7 +24,6 @@ permissions:
 
 jobs:
   sync:
-    environment: bot-identity
     name: Sync docs manifest
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -33,7 +32,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -51,7 +50,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
           cache: "npm"

.github/workflows/sync_files_v2.yml

@@ -33,11 +33,10 @@ permissions:
 
 jobs:
   sync-files:
-    environment: bot-identity
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -52,25 +51,28 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
-          cache-suffix: sync-files
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
 
       - name: Install Python dependencies
         run: |
-          uv sync --project engine --locked --group tools
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          cache-suffix: sync-files
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Sync translation TOML files
         run: |
-          uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
 
       - name: Sort translation TOML files
         run: |
@@ -83,7 +85,7 @@ jobs:
 
       - name: Sync README.md
         run: |
-          uv run --project engine --locked --group tools python scripts/counter_translation_v3.py
+          python scripts/counter_translation_v3.py
 
       - name: Run git add
         run: |

.github/workflows/tauri-build.yml

@@ -12,7 +12,7 @@ on:
   workflow_call:
     inputs:
       platform:
-        description: "Platform to build (windows, windows-arm64, macos, linux, windows-macos, or all)."
+        description: "Platform to build (windows, macos, linux, windows-macos, or all)."
         required: false
         type: string
         default: "all"
@@ -26,21 +26,16 @@ on:
         required: false
         type: boolean
         default: false
-      use_shared_cache:
-        required: false
-        type: boolean
-        default: false
   workflow_dispatch:
     inputs:
       platform:
-        description: "Platform to build (windows, windows-arm64, macos, linux, windows-macos, or all)"
+        description: "Platform to build (windows, macos, linux, windows-macos, or all)"
         required: true
         default: "all"
         type: choice
         options:
           - all
           - windows
-          - windows-arm64
           - macos
           - linux
           - windows-macos
@@ -61,18 +56,13 @@ permissions:
 
 jobs:
   determine-matrix:
-    # Only probes APPLE_CERTIFICATE for presence, so it stays on the unrestricted
-    # signing environment - release-signing would block every PR run.
-    environment:
-      name: ci-signing
-      deployment: false
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -83,19 +73,15 @@ jobs:
           PLATFORM: ${{ inputs.platform }}
         run: |
           WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
-          # ARM64: NSIS only (WiX MSI has no arm64 support in Tauri) and no JPDFium
-          # natives yet - flip jpdfium_platforms to windows-arm64 once JPDFium ships it.
-          WINDOWS_ARM64='{"platform":"windows-11-arm","args":"--target aarch64-pc-windows-msvc --bundles nsis","name":"windows-arm64","jpdfium_platforms":"none"}'
           MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
           LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'
 
           case "$PLATFORM" in
-            windows)       ENTRIES=("$WINDOWS" "$WINDOWS_ARM64") ;;
-            windows-arm64) ENTRIES=("$WINDOWS_ARM64") ;;
+            windows)       ENTRIES=("$WINDOWS") ;;
             macos)         ENTRIES=("$MACOS") ;;
             linux)         ENTRIES=("$LINUX") ;;
             windows-macos) ENTRIES=("$WINDOWS" "$MACOS") ;;
-            *)             ENTRIES=("$WINDOWS" "$WINDOWS_ARM64" "$MACOS" "$LINUX") ;;
+            *)             ENTRIES=("$WINDOWS" "$MACOS" "$LINUX") ;;
           esac
 
           # Drop macOS entries when Apple certificate secret is unavailable
@@ -112,12 +98,6 @@ jobs:
           echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT
 
   build:
-    # Windows/GPG signing only runs on main (see the per-step gates below), so only
-    # that path needs the reviewer-gated release-signing environment. Everything else
-    # (PRs, merge queue, nightly) signs macOS only and uses ci-signing, which has no
-    # approval or branch restriction.
-    environment:
-      name: ${{ (inputs.sign && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))) && 'release-signing' || 'ci-signing' }}
     needs: determine-matrix
     strategy:
       fail-fast: false
@@ -125,16 +105,12 @@ jobs:
     runs-on: ${{ matrix.platform }}
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      # Per-platform sign gate. macOS signs on any run with the cert available,
-      # PRs included: Gatekeeper blocks an unsigned .dmg, so an unsigned macOS
-      # PR build is not testable. Windows and Linux stay main-only, matching the
-      # gates on their own signing steps below.
-      SIGN_BUNDLE: ${{ inputs.sign && (matrix.platform == 'macos-15' && secrets.APPLE_CERTIFICATE != '' || github.ref == 'refs/heads/main') }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -148,7 +124,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
           cache: "npm"
@@ -164,7 +140,7 @@ jobs:
       # only recompiles the app crate. Written on main; PRs and the merge queue
       # restore from it.
       - name: Cache Rust build
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: frontend/editor/src-tauri
           # Stable key shared across workflows so the nightly warmer.
@@ -174,41 +150,28 @@ jobs:
           # Save the dependency cache even if a later step fails
           cache-on-failure: true
 
-      - name: Restore cache Gradle User Home
-        if: inputs.use_shared_cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
-      - name: Restore cache Gradle
-        if: inputs.use_shared_cache == false
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-tauri-build-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up x86_64 JDK 25 (macOS universal JRE)
         if: matrix.platform == 'macos-15'
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
           architecture: "x64"
 
       - name: Capture x86_64 JAVA_HOME
         if: matrix.platform == 'macos-15'
         run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
 
-      # Temurin has no windows-aarch64 JDK 25 yet; Microsoft OpenJDK does.
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
-          distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
 
       - name: Setup Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -235,7 +198,7 @@ jobs:
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
-        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
         uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -245,28 +208,22 @@ jobs:
           SM_HOST: ${{ secrets.SM_HOST }}
 
       - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
         shell: pwsh
-        env:
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
 
           # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("$env:SM_CLIENT_CERT_FILE_B64")
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
           $certPath = "D:\Certificate_pkcs12.p12"
           [IO.File]::WriteAllBytes($certPath, $certBytes)
 
           # Set environment variables
           echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=$env:SM_HOST" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=$env:SM_API_KEY" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=$env:SM_KEYPAIR_ALIAS" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
 
           # Get PKCS11 config path from DigiCert action
           $pkcs11Config = $env:PKCS11_CONFIG
@@ -284,8 +241,40 @@ jobs:
             }
           }
 
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
       - name: Import Apple Developer Certificate
-        if: env.SIGN_BUNDLE == 'true' && matrix.platform == 'macos-15'
+        if: inputs.sign && matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -306,7 +295,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: env.SIGN_BUNDLE == 'true' && matrix.platform == 'macos-15'
+        if: inputs.sign && matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -329,7 +318,7 @@ jobs:
           ls -la /usr/bin/hd* || echo "No hd* tools found"
 
       - name: Preflight smctl
-        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
         shell: pwsh
         env:
           KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -342,7 +331,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
 
       - name: Configure Windows code signing
-        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
         shell: bash
         env:
           KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -379,8 +368,8 @@ jobs:
           fi
 
       - name: Build Tauri app (signed)
-        if: env.SIGN_BUNDLE == 'true'
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        if: inputs.sign
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -414,8 +403,8 @@ jobs:
           args: ${{ matrix.platform == 'ubuntu-22.04' && (inputs.minimal && '--bundles deb' || '--bundles deb,rpm') || matrix.args }}
 
       - name: Build Tauri app (unsigned)
-        if: env.SIGN_BUNDLE != 'true'
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        if: ${{ !inputs.sign }}
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SIGN: "0"
@@ -431,9 +420,7 @@ jobs:
           # Linux: build deb+rpm only here (deb-only on minimal smoke builds).
           # AppImage runs in its own continue-on-error step below so its
           # persistent linuxdeploy failure (#6127 onwards) does not tank uploads.
-          args: >-
-            ${{ matrix.platform == 'ubuntu-22.04' && (inputs.minimal && '--bundles deb' || '--bundles deb,rpm') || matrix.args }}
-            --config '{"bundle":{"createUpdaterArtifacts":false}}'
+          args: ${{ matrix.platform == 'ubuntu-22.04' && (inputs.minimal && '--bundles deb' || '--bundles deb,rpm') || matrix.args }}
 
       # AppImage is decoupled so its linuxdeploy run gets a fresh process
       # (rpm scratch state torn down) and its failure can't tank deb/rpm.
@@ -441,7 +428,7 @@ jobs:
       - name: Build Tauri app (Linux AppImage)
         if: matrix.platform == 'ubuntu-22.04' && !inputs.minimal
         continue-on-error: true
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SIGN: ${{ (inputs.sign && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
@@ -458,37 +445,6 @@ jobs:
           tauriScript: npx tauri
           args: --bundles appimage
 
-      # Bundled libwayland conflicts with the host's on some distros (Fedora
-      # Wayland: EGL_BAD_PARAMETER, blank window - #6878). The AppImage
-      # ecosystem excludelist agrees these libs must come from the system.
-      - name: Strip bundled Wayland libs from AppImage
-        if: matrix.platform == 'ubuntu-22.04' && !inputs.minimal
-        continue-on-error: true
-        run: |
-          set -euo pipefail
-          AI=$(find "$PWD/frontend/editor/src-tauri/target" -name "*.AppImage" | head -1)
-          if [ -z "$AI" ]; then echo "No AppImage found - skipping"; exit 0; fi
-          chmod +x "$AI"
-          WORK=$(mktemp -d)
-          (cd "$WORK" && "$AI" --appimage-extract >/dev/null)
-          if ! ls "$WORK/squashfs-root/usr/lib/"libwayland-* >/dev/null 2>&1; then
-            echo "No bundled libwayland - nothing to strip"
-            rm -rf "$WORK"
-            exit 0
-          fi
-          rm -f "$WORK/squashfs-root/usr/lib/"libwayland-*
-          curl -fsSL -o "$WORK/appimagetool" \
-            https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
-          # Pinned checksum: never execute an unverified downloaded binary. On
-          # mismatch (upstream rebuilt continuous) the step aborts and the
-          # original AppImage ships unchanged - update the pin deliberately.
-          echo "a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0  $WORK/appimagetool" | sha256sum -c -
-          chmod +x "$WORK/appimagetool"
-          "$WORK/appimagetool" --appimage-extract-and-run "$WORK/squashfs-root" "$AI.new"
-          mv "$AI.new" "$AI"
-          rm -rf "$WORK"
-          echo "Stripped bundled libwayland from $(basename "$AI")"
-
       - name: Clear release GPG key from runner keyring (Linux)
         if: always() && inputs.sign && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
         env:
@@ -500,7 +456,7 @@ jobs:
           fi
 
       - name: Verify notarization (macOS only)
-        if: env.SIGN_BUNDLE == 'true' && matrix.platform == 'macos-15'
+        if: inputs.sign && matrix.platform == 'macos-15'
         run: |
           echo "🔍 Verifying notarization status..."
           cd ./frontend/editor/src-tauri/target
@@ -527,9 +483,6 @@ jobs:
             # Only ship the MSI installer. The loose exe and WiX toolset exes
             # are not the user-facing installer - the MSI contains the signed inner exe.
             find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "windows-11-arm" ]; then
-            # arm64 ships the NSIS installer (WiX MSI has no arm64 support in Tauri).
-            find . -name "*-setup.exe" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}-setup.exe" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
             find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
           else
@@ -541,28 +494,9 @@ jobs:
       # Verify the MSI AND the inner exe extracted from it are signed.
       # The inner exe is what gets installed on users' machines and what AV scans.
       - name: Verify Windows Code Signature
-        if: inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
+        if: inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
         shell: pwsh
         run: |
-          # arm64 ships an NSIS installer, not an MSI. Tauri's signCommand signs the
-          # inner exe before packing and the setup exe after, so verifying the setup
-          # exe is the arm64 equivalent of the MSI + inner-exe check below.
-          if ("${{ matrix.platform }}" -eq "windows-11-arm") {
-            $exePath = "./dist/Stirling-PDF-${{ matrix.name }}-setup.exe"
-            if (-not (Test-Path $exePath)) {
-              Write-Host "[ERROR] NSIS installer not found at $exePath"
-              exit 1
-            }
-            $sig = Get-AuthenticodeSignature -FilePath $exePath
-            Write-Host "NSIS installer: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
-            if ($sig.Status -ne "Valid") {
-              Write-Host "[ERROR] NSIS installer is not signed"
-              exit 1
-            }
-            Write-Host "[SUCCESS] NSIS installer is properly signed"
-            exit 0
-          }
-
           $allSigned = $true
           $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
 
@@ -608,7 +542,7 @@ jobs:
           Write-Host "[SUCCESS] MSI and inner exe are properly signed"
 
       - name: Dump smctl logs on failure
-        if: ${{ failure() && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' }}
+        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         shell: pwsh
         run: |
           $logDir = "$env:USERPROFILE\.signingmanager\logs"
@@ -635,7 +569,7 @@ jobs:
           cd ./frontend/editor/src-tauri/target
 
           # Check for expected artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ] || [ "${{ matrix.platform }}" = "windows-11-arm" ]; then
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             echo "Checking for Windows artifacts..."
             find . -name "*.exe" -o -name "*.msi" | head -5
             if [ $(find . -name "*.exe" | wc -l) -eq 0 ]; then
@@ -676,33 +610,15 @@ jobs:
             fi
           done
 
-      - name: Cleanup temporary files
-        if: always()
-        shell: bash
-        run: |
-          rm -f certificate.p12
-          rm -rf "$RUNNER_TEMP/msi-verify"
-          if [ "${{ matrix.platform }}" = "macos-15" ]; then
-            security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" 2>/dev/null || true
-          fi
-        continue-on-error: true
-
   pr-comment:
     needs: build
     runs-on: ubuntu-latest
-    # Fork and Dependabot pull_request runs receive a read-only GITHUB_TOKEN,
-    # so the API cannot create or update PR comments there. The artifacts are
-    # still uploaded and remain available from the Actions run page.
-    if: >-
-      github.event_name == 'pull_request' &&
-      needs.build.result == 'success' &&
-      !github.event.pull_request.head.repo.fork &&
-      github.actor != 'dependabot[bot]'
+    if: github.event_name == 'pull_request' && needs.build.result == 'success'
     permissions:
       pull-requests: write
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -725,7 +641,6 @@ jobs:
             // Map of expected artifact names to display info
             const artifactMap = {
               'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-windows-arm64': { icon: '🪟', platform: 'Windows ARM64', files: '-setup.exe (NSIS)' },
               'Stirling-PDF-macos-universal': { icon: '🍎', platform: 'macOS Universal', files: '.dmg' },
               'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
             };
@@ -794,7 +709,7 @@ jobs:
     if: always()
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/test-build-docker.yml

@@ -22,45 +22,21 @@ permissions:
   contents: read
 
 jobs:
-  # A changed base image is shared by all three embedded-image builds. Build
-  # it once and transfer it as an artifact; the matrix jobs use the local
-  # Docker driver so the loaded image is visible to the build.
-  prepare-base-image:
-    if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-    environment:
-      name: ci-unsigned
-      deployment: false
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Build base image locally
-        run: docker build --platform linux/amd64 -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Export base image
-        run: docker save stirling-pdf-base:pr-test | gzip -1 > stirling-pdf-base-pr-test.tar.gz
-
-      - name: Upload base image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docker-base-pr-test
-          path: stirling-pdf-base-pr-test.tar.gz
-          retention-days: 1
-          if-no-files-found: error
-
+  # TODO: extract a pre-matrix `prepare` job that runs once and produces
+  # shared artifacts for the three matrix entries below to consume:
+  #   1. `task backend:build` — currently runs 3× in parallel with
+  #      identical env (DISABLE_ADDITIONAL_FEATURES=true,
+  #      STIRLING_PDF_DESKTOP_UI=false). Build once, upload the JAR as an
+  #      artifact, matrix entries download.
+  #   2. The base-image `docker build` (gated on docker-base-changed) —
+  #      currently runs 3× in parallel against the same Dockerfile and
+  #      context. Build once, `docker save` to an artifact, matrix entries
+  #      `docker load` before the embedded build.
+  # Saves ~2 full backend builds + 2 base-image builds per PR that touches
+  # docker. May also be reusable from backend-build.yml's jdk-25 +
+  # spring-security=true matrix entry if `task backend:build` and
+  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
   test-build-docker-images:
-    if: always() && (needs.prepare-base-image.result == 'success' || needs.prepare-base-image.result == 'skipped')
-    needs: [prepare-base-image]
-    environment:
-      name: ci-unsigned
-      deployment: false
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -77,7 +53,7 @@ jobs:
             cache-scope: stirling-pdf-fat
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -85,7 +61,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -102,28 +78,26 @@ jobs:
           docker system prune -af || true
           echo "Disk space after cleanup:" && df -h
 
-      - name: Download prepared base image
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: docker-base-pr-test
-
-      - name: Load prepared base image
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: gzip -dc stirling-pdf-base-pr-test.tar.gz | docker load
-
-      - name: Restore cache Gradle User Home
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-
       - name: Set up JDK 25
-        uses: ./.github/actions/java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+          cache-disabled: true
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -137,11 +111,16 @@ jobs:
           STIRLING_PDF_DESKTOP_UI: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Build base image locally (PR base change only)
+        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
+        run: |
+          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
 
       - name: Set base image and platform for this build
         id: build-params
@@ -216,7 +195,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -224,11 +203,11 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build docker/unoserver/Dockerfile
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0

.github/workflows/testdriver.yml

@@ -0,0 +1,207 @@
+name: UI test with TestDriverAI
+
+on:
+  push:
+    branches: ["master", "UITest", "testdriver"]
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          gradle-version: 9.6.1
+
+      - name: Build with Gradle
+        run: ./gradlew build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Build and push test image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-pdf-latest
+          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64
+
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          sudo chmod 600 ../private.key
+
+      - name: Deploy to VPS
+        run: |
+          cat > docker-compose.yml << EOF
+          version: '3.3'
+          services:
+            stirling-pdf:
+              container_name: stirling-pdf-test-${{ github.sha }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
+              ports:
+                - "1337:8080"
+              volumes:
+                - /stirling/test-${{ github.sha }}/data:/usr/share/tessdata:rw
+                - /stirling/test-${{ github.sha }}/config:/configs:rw
+                - /stirling/test-${{ github.sha }}/logs:/logs:rw
+              environment:
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
+                SYSTEM_DEFAULTLOCALE: en-US
+                UI_APPNAME: "Stirling-PDF Test"
+                UI_HOMEDESCRIPTION: "Test Deployment"
+                UI_APPNAMENAVBAR: "Test"
+                SYSTEM_MAXFILESIZE: "100"
+                METRICS_ENABLED: "true"
+                SYSTEM_GOOGLEVISIBILITY: "false"
+                SYSTEM_ENABLEANALYTICS: "false"
+              restart: on-failure:5
+          EOF
+
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+            mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
+            mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
+            cd /stirling/test-${{ github.sha }}
+            docker-compose pull
+            docker-compose up -d
+          EOF
+
+  files-changed:
+    if: always()
+    name: detect what files changed
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    outputs:
+      frontend: ${{ steps.changes.outputs.frontend }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check for file changes
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          filters: ".github/config/.files.yaml"
+
+  test:
+    if: needs.files-changed.outputs.frontend == 'true'
+    needs: [deploy, files-changed]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Run TestDriver.ai
+        uses: testdriverai/action@f0d0f45fdd684db628baa843fe9313f3ca3a8aa8 #1.1.3
+        with:
+          key: ${{secrets.TESTDRIVER_API_KEY}}
+          prerun: |
+            choco install go-task -y
+            task frontend:build
+            cd frontend
+            npm install dashcam-chrome --save
+            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
+            Start-Sleep -Seconds 20
+          prompt: |
+            1. /run testing/testdriver/test.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          FORCE_COLOR: "3"
+
+  cleanup:
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh/
+          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          sudo chmod 600 ../private.key
+
+      - name: Cleanup deployment
+        if: always()
+        run: |
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+            cd /stirling/test-${{ github.sha }}
+            docker-compose down
+            cd /stirling
+            rm -rf test-${{ github.sha }}
+          EOF
+        continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/update-gradle.yml

@@ -1,111 +0,0 @@
-name: Update Gradle
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * 1"
-
-concurrency:
-  group: update-gradle
-  cancel-in-progress: true
-
-jobs:
-  update-gradle:
-    name: Update Gradle and Docker images
-    permissions:
-      contents: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-
-      - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Java
-        uses: ./.github/actions/java
-        with:
-          java-version: "25"
-
-      - name: Find latest Gradle release
-        id: gradle
-        shell: bash
-        run: |
-          set -euo pipefail
-          version=$(curl --fail --silent --show-error --retry 3 \
-            https://services.gradle.org/versions/current | jq -r '.version')
-          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
-            echo "Could not determine a stable Gradle version: $version" >&2
-            exit 1
-          }
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Find matching Docker image digest
-        id: docker
-        env:
-          GRADLE_VERSION: ${{ steps.gradle.outputs.version }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          tag="${GRADLE_VERSION}-jdk25"
-          digest=$(curl --fail --silent --show-error --retry 3 \
-            "https://hub.docker.com/v2/repositories/library/gradle/tags/${tag}" \
-            | jq -r '.digest // empty')
-          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || {
-            echo "Docker image gradle:${tag} was not found" >&2
-            exit 1
-          }
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "digest=$digest" >> "$GITHUB_OUTPUT"
-
-      - name: Update Gradle wrapper
-        env:
-          GRADLE_VERSION: ${{ steps.gradle.outputs.version }}
-        run: ./gradlew wrapper --gradle-version "$GRADLE_VERSION" --distribution-type bin
-
-      - name: Update Gradle Docker images
-        env:
-          DOCKER_TAG: ${{ steps.docker.outputs.tag }}
-          DOCKER_DIGEST: ${{ steps.docker.outputs.digest }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          find docker -type f -name 'Dockerfile*' -print0 |
-            xargs -0 sed -E -i \
-              "s#gradle:[^@[:space:]]+-jdk25(@sha256:[^[:space:]]+)?#gradle:${DOCKER_TAG}@${DOCKER_DIGEST}#g"
-
-      - name: Verify Gradle update
-        env:
-          EXPECTED_VERSION: ${{ steps.gradle.outputs.version }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          actual=$(./gradlew --version | sed -n 's/^Gradle \([0-9.]*\)$/\1/p')
-          [[ "$actual" == "$EXPECTED_VERSION" ]] || {
-            echo "Wrapper resolved Gradle $actual, expected $EXPECTED_VERSION" >&2
-            exit 1
-          }
-          if git diff --quiet; then
-            echo "Gradle is already up to date."
-            exit 0
-          fi
-          git diff --check
-
-      - name: Create pull request
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: automation/update-gradle
-          delete-branch: true
-          commit-message: "chore: update Gradle"
-          title: "chore: update Gradle to ${{ steps.gradle.outputs.version }}"
-          body: |
-            Automated update of the Gradle wrapper and Gradle Docker build images.
-
-            Gradle version: `${{ steps.gradle.outputs.version }}`
-            Docker image: `gradle:${{ steps.docker.outputs.tag }}`
-          labels: dependencies

.gitignore

@@ -22,11 +22,7 @@ pipeline/
 customFiles/
 configs/
 watchedFolders/
-# The rule above targets the app's runtime watched-folders working dir, but it
-# also matches this frontend source component dir; keep the source tracked.
-!frontend/editor/src/proprietary/components/watchedFolders/
 clientWebUI/
-policy-webhook-spool/
 # Scratch dir used by local fixture-regeneration runs (see
 # app/proprietary/src/test/resources/db-migration-fixtures/README.md).
 # Holds downloaded JARs and disposable workdirs. Never committed.
@@ -39,7 +35,6 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 /testing/cucumber/junit/
 /testing/cucumber/report.html
-/testing/cucumber/.parallel/
 /testing/.failed_tests
 /.test-state/
 SwaggerDoc.json
@@ -65,23 +60,13 @@ app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
 app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/og-metadata.saas.json
 app/core/src/main/resources/static/sw-folder-retry.js
 app/core/src/main/resources/static/robots.txt
-app/core/src/main/resources/static/android-chrome-*.png
-app/core/src/main/resources/static/mstile-*.png
-app/core/src/main/resources/static/favicon.png
-app/core/src/main/resources/static/safari-pinned-tab.svg
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
 app/core/src/main/resources/static/**/*.gz
 app/core/src/main/resources/static/**/*.br
-app/core/src/main/resources/static/css/cookieconsent.css
-app/core/src/main/resources/static/css/cookieconsentCustomisation.css
-app/core/src/main/resources/static/mockServiceWorker.js
-app/core/src/main/resources/static/js/thirdParty/cookieconsent.umd.js
-app/core/src/main/resources/static/images/google-drive.svg
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
 # Gradle

.gitleaksignore

@@ -22,13 +22,8 @@ frontend/editor/src/portal/components/docs/GettingStartedSection.tsx:generic-api
 
 # False positive: generic-api-key matches the Java type name "X509Certificate"
 # in a method signature (CreateSignatureBase.resolveSignatureAlgorithm) - not a secret.
-app/core/src/main/java/stirling/software/SPDF/pdf/signature/CreateSignatureBase.java:generic-api-key:224
+app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java:generic-api-key:224
 
 # Supabase publishable key (public by design, RLS-protected) used as a CI fallback
 # default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
 .github/workflows/tauri-build.yml:generic-api-key:402
-
-# Staging Supabase publishable key (public by design). Ignored here rather than with an
-# inline gitleaks:allow because a trailing comment in a .properties file is part of the
-# value, so the pragma would end up inside the key.
-app/saas/src/main/resources/application-staging.properties:generic-api-key:16

.imgbotconfig

@@ -1,7 +1,5 @@
 {
   "ignoredFiles": [
-    "frontend/editor/src-tauri/icons/macos/*",
-    "frontend/editor/src-tauri/icons/linux/*",
-    "frontend/editor/src-tauri/icons/windows/*"
+    "frontend/editor/src-tauri/icons/icon.png"
   ]
 }

.taskfiles/backend.yml

@@ -57,57 +57,16 @@ tasks:
       - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
         platforms: [linux, darwin]
 
-  # SaaS backend. dev:saas -> the PR's preview branch, staging:saas -> shared v3,
-  # PROFILES=none -> production against your own SAAS_DB_*. Production has no named
-  # task on purpose. Use `none`, not an empty value: Go template `default` treats ""
-  # as absent and would resolve back to dev.
-
   dev:saas:
-    desc: "Start SaaS backend against the current PR's Supabase preview branch"
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
-    vars:
-      PROFILES: '{{.PROFILES | default "dev"}}'
-    cmds:
-      # Don't move this check into a `sh:` var: dotenv is visible in cmds but not
-      # during var evaluation, so the test would always see an empty value.
-      - cmd: |
-          if [ "{{.PROFILES}}" = "dev" ] && [ -z "${SAAS_DEV_PROJECT_REF:-}" ]; then
-            echo ">> SAAS_DEV_PROJECT_REF is not set."
-            echo ">> Testing a SaaS PR? Put its ref, DB password and publishable key in app/.env.saas.local."
-            echo ">> Wanted the shared v3 project? Use 'task backend:staging:saas' instead."
-            exit 1
-          fi
-      - task: _run:saas
-        vars:
-          PORT: '{{.PORT}}'
-          PROFILES: '{{.PROFILES}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-
-  staging:saas:
-    desc: "Start SaaS backend against the shared v3 staging project"
-    cmds:
-      - task: _run:saas
-        vars:
-          PORT: '{{.PORT}}'
-          PROFILES: staging
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-
-  _run:saas:
-    internal: true
+    desc: "Start backend in SaaS flavor against Supabase"
+    # `dotenv:` reads from the root Taskfile's directory (".") because this
+    # subtaskfile is included with `dir: .`.
     dotenv: ['app/.env.saas.local', 'app/.env.saas']
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
+      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
       PROFILES: '{{.PROFILES | default "dev"}}'
-      # Built here rather than inline in the cmds below: the Windows line is an
-      # unquoted YAML scalar wrapping a cmd.exe string, so a nested {{if ne .X
-      # "none"}} needs escaped quotes that reach the Go template as literal
-      # backslashes and fail with `unexpected "\" in operand`.
-      PROFILE_ARGS: '{{if ne .PROFILES "none"}}--spring.profiles.include={{.PROFILES}}{{end}}'
       AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
       AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
       AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
@@ -118,11 +77,9 @@ tasks:
       AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
       AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
     cmds:
-      # PROFILE_ARGS is empty when PROFILES=none, i.e. the bare `saas` profile
-      # against SAAS_DB_* (production).
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILE_ARGS}}--args=\"{{.PROFILE_ARGS}}\"{{end}}"
+      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
         platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILE_ARGS}}--args='{{.PROFILE_ARGS}}'{{end}}
+      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
         platforms: [linux, darwin]
 
   build:
@@ -157,15 +114,6 @@ tasks:
       - cmd: ./gradlew test
         platforms: [linux, darwin]
 
-  test:force:
-    desc: "Run backend tests, ignoring cached results"
-    aliases: [test:no-cache]
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat cleanTest test --no-build-cache"
-        platforms: [windows]
-      - cmd: ./gradlew cleanTest test --no-build-cache
-        platforms: [linux, darwin]
-
   format:
     desc: "Auto-fix code formatting"
     cmds:
@@ -189,7 +137,6 @@ tasks:
 
   swagger:
     desc: "Generate OpenAPI docs"
-    run: once
     cmds:
       - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
         platforms: [windows]

.taskfiles/cucumber.yml

@@ -1,44 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Sync the Python environment with the cucumber test dependencies"
-    run: once
-    # Deliberately no sources/status fingerprint: the engine venv is shared, so it can
-    # already exist while synced to a different dependency group. uv no-ops when correct.
-    cmds:
-      - uv sync --project ../../engine --locked --group cucumber
-
-  run:
-    desc: "Run the cucumber suite against a running server (BASE_URL, default localhost:8080)"
-    deps: [install]
-    cmds:
-      - uv run --project ../../engine --locked --group cucumber python -m behave --no-capture -f plain {{.CLI_ARGS}}
-
-  nightly:
-    desc: "Run the @nightly cucumber scenarios, excluded from the default run"
-    summary: |
-      Heavy LibreOffice/Calibre/Ghostscript conversions. behave.ini excludes @nightly,
-      so this opts back in explicitly.
-
-      Pass extra behave flags via -- :
-        task cucumber:nightly -- --tags=@convert
-    deps: [install]
-    cmds:
-      - uv run --project ../../engine --locked --group cucumber python -m behave --tags=@nightly --no-capture -f plain {{.CLI_ARGS}}
-
-  parallel:
-    desc: "Run the cucumber suite as concurrent shards against one server (SHARDS, default 10)"
-    summary: |
-      Splits the feature files across SHARDS concurrent behave processes hitting a single
-      backend, to shake out cross-request interference. Auth-coupled features are pinned
-      to one shard because they change the admin password mid-scenario.
-
-        task cucumber:parallel
-        task cucumber:parallel SHARDS=4
-        BASE_URL=http://localhost:8081 task cucumber:parallel
-    deps: [install]
-    vars:
-      SHARDS: '{{.SHARDS | default "10"}}'
-    cmds:
-      - bash run-parallel.sh {{.SHARDS}} {{if .CLI_ARGS}}-- {{.CLI_ARGS}}{{end}}

.taskfiles/desktop.yml

@@ -22,7 +22,6 @@ vars:
               linux-amd64)   echo "linux-x64";;
               linux-arm64)   echo "linux-arm64";;
               windows-amd64) echo "windows-x64";;
-              windows-arm64) echo "none";;  # no JPDFium windows-arm64 natives published yet
               *)             echo "all";;
           esac
       fi
@@ -195,11 +194,7 @@ tasks:
       # `desktop:build` run `jlink:clean` first to force a fresh build.
       - cmd: chmod -R u+w runtime/jre
         platforms: [linux, darwin]
-      # Single-quoted so Task's shell leaves `$_` and `$false` alone. Double
-      # quotes let it expand them as its own variables, and since neither is
-      # set the command PowerShell actually received was
-      # `ForEach-Object { .IsReadOnly = }`, which fails on every file.
-      - cmd: powershell -NoProfile -Command 'Get-ChildItem -Recurse -File runtime/jre | ForEach-Object { $_.IsReadOnly = $false }'
+      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
         platforms: [windows]
     status:
       - test -f runtime/jre/release

.taskfiles/e2e.yml

@@ -15,15 +15,6 @@ tasks:
     cmds:
       - npx playwright test --project=stubbed {{.CLI_ARGS}}
 
-  stubbed-project:
-    desc: "Run the stubbed E2E suite for a single Playwright project"
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    vars:
-      PROJECT: '{{.PROJECT | default "stubbed"}}'
-    cmds:
-      - npx playwright test --project={{.PROJECT}} {{.CLI_ARGS}}
-
   live:
     desc: "Run live E2E tests"
     summary: |

.taskfiles/engine.yml

@@ -2,49 +2,22 @@ version: '3'
 
 tasks:
   install:
-    desc: "Install engine runtime and development dependencies"
+    desc: "Install engine dependencies"
     run: once
     cmds:
       - uv python install 3.13.8
-      - uv sync --locked --group engine --group engine-dev
+      - uv sync
     sources:
       - uv.lock
       - pyproject.toml
     status:
       - test -d .venv
 
-  lock:
-    desc: "Update the engine lockfile from project metadata"
-    cmds:
-      - uv lock
-
-  lock:upgrade:
-    desc: "Upgrade allowed engine dependencies and update the lockfile"
-    cmds:
-      - uv lock --upgrade
-
-  lock:check:
-    desc: "Check whether the engine lockfile is current"
-    cmds:
-      - uv lock --check
-
-  update:
-    desc: "Upgrade engine dependencies and synchronize the environment"
-    cmds:
-      - task: lock:upgrade
-      - uv sync --locked --group engine --group engine-dev
-
-  update:all:
-    desc: "Upgrade all Python dependency groups and synchronize the environment"
-    cmds:
-      - task: lock:upgrade
-      - uv sync --locked --all-groups
-
   prepare:
     desc: "Set up engine .env from template"
     deps: [install]
     cmds:
-      - uv run --locked --group engine --group engine-dev scripts/setup_env.py
+      - uv run scripts/setup_env.py
     sources:
       - scripts/setup_env.py
     generates:
@@ -60,7 +33,7 @@ tasks:
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run --locked --group engine uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
 
   dev:
     desc: "Start engine dev server with hot reload"
@@ -72,43 +45,43 @@ tasks:
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run --locked --group engine --group engine-dev uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
 
   lint:
     desc: "Run linting"
     deps: [install]
     cmds:
-      - uv run --locked --group engine --group engine-dev ruff check .
+      - uv run ruff check .
 
   lint:fix:
     desc: "Auto-fix lint issues"
     deps: [install]
     cmds:
-      - uv run --locked --group engine --group engine-dev ruff check . --fix
+      - uv run ruff check . --fix
 
   format:
     desc: "Auto-fix code formatting"
     deps: [install]
     cmds:
-      - uv run --locked --group engine --group engine-dev ruff format .
+      - uv run ruff format .
 
   format:check:
     desc: "Check code formatting"
     deps: [install]
     cmds:
-      - uv run --locked --group engine --group engine-dev ruff format . --diff
+      - uv run ruff format . --diff
 
   typecheck:
     desc: "Run type checking"
     deps: [install]
     cmds:
-      - uv run --locked --group engine --group engine-dev pyright . --warnings
+      - uv run pyright . --warnings
 
   test:
     desc: "Run tests"
     deps: [prepare]
     cmds:
-      - uv run --locked --group engine --group engine-dev pytest tests
+      - uv run pytest tests
 
   fix:
     desc: "Auto-fix lint + format"
@@ -129,19 +102,12 @@ tasks:
     desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
     deps: [install, ":backend:swagger"]
     cmds:
-      - uv run --locked --group engine --group engine-dev python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py
+      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py
     sources:
       - ../SwaggerDoc.json
       - scripts/generate_tool_models.py
     generates:
       - src/stirling/models/tool_models.py
-      - src/stirling/models/tool_io.py
-
-  tool-models:check:
-    desc: "Fail if the committed tool models are out of date"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - uv run --locked --group engine --group engine-dev python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py --check
 
   clean:
     desc: "Clean build artifacts"

.taskfiles/frontend.yml

@@ -5,14 +5,6 @@ version: '3'
 # mode flag) or use `--project editor/...` for tsc — so the editor lives
 # under frontend/editor/ without each task needing a cd.
 
-vars:
-  # Dev-only browser-tab label so concurrent worktrees are distinguishable. Only
-  # the worktree folder basename (e.g. "wt1") is exposed — never the full path,
-  # hostname, or user. Dropped from production builds.
-  DEV_LABEL:
-    sh: >-
-      {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
-
 tasks:
   install:
     desc: "Install dependencies"
@@ -88,52 +80,16 @@ tasks:
       OPEN: '{{.OPEN | default ""}}'
     env:
       BACKEND_URL: '{{.BACKEND_URL}}'
-      STIRLING_DEV_LABEL: '{{.DEV_LABEL}}'
+      # Dev-only browser-tab label so concurrent worktrees are distinguishable.
+      # Only the worktree folder basename (e.g. "wt1") is exposed — never the
+      # full path, hostname, or user. Consumed at dev-serve time by vite.config
+      # and dropped from production builds.
+      STIRLING_DEV_LABEL:
+        sh: >-
+          {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
     cmds:
       - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
 
-  # Separate from dev:_run rather than a flag on it: Task sets an `env:` key even
-  # when its value resolves to empty, and Vite treats an empty process.env VITE_* as
-  # authoritative over the committed editor/.env, so folding these in blanks Supabase
-  # config for the core, proprietary and desktop dev servers.
-  dev:_run:saas:
-    internal: true
-    ignore_error: true
-    # The backend's own env files, so both halves target one project. Paths are
-    # relative to this taskfile's dir, `frontend`.
-    dotenv: ['../app/.env.saas.local', '../app/.env.saas']
-    vars:
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      OPEN: '{{.OPEN | default ""}}'
-      SAAS_ENV: '{{.SAAS_ENV | default "dev"}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-      STIRLING_DEV_LABEL: '{{.DEV_LABEL}}'
-      SAAS_ENV: '{{.SAAS_ENV}}'
-      # A real process.env VITE_* beats a committed .env in Vite (loadEnv applies
-      # process.env last), which is what lets this override editor/.env.
-      #
-      # These must stay `sh:`, not Go templates: dotenv values are visible to Task's
-      # embedded shell but not to templates, where {{.SAAS_DEV_PROJECT_REF}} is
-      # always empty.
-      VITE_SUPABASE_URL:
-        sh: |
-          case "${SAAS_ENV:-dev}" in
-            staging) ref="${SAAS_STAGING_PROJECT_REF:?set it in app/.env.saas.local}" ;;
-            *)       ref="${SAAS_DEV_PROJECT_REF:?set it in app/.env.saas.local, or run task staging:saas}" ;;
-          esac
-          echo "https://${ref}.supabase.co"
-      VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY:
-        sh: |
-          case "${SAAS_ENV:-dev}" in
-            staging) echo "${SAAS_STAGING_PUBLISHABLE_KEY:?set it in app/.env.saas.local}" ;;
-            *)       echo "${SAAS_DEV_PUBLISHABLE_KEY:?set it in app/.env.saas.local}" ;;
-          esac
-    cmds:
-      - 'echo ">> frontend Supabase target: $VITE_SUPABASE_URL"'
-      - npx vite editor --mode saas --port {{.PORT}}{{if .OPEN}} --open{{end}}
-
   dev:
     desc: "Start frontend dev server"
     cmds:
@@ -155,23 +111,13 @@ tasks:
         vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
 
   dev:saas:
-    desc: "Start frontend dev server in SaaS mode (SAAS_ENV=dev|staging|prod)"
+    desc: "Start frontend dev server in SaaS mode"
     deps:
       - task: prepare
         vars: { MODE: saas }
-    vars:
-      SAAS_ENV: '{{.SAAS_ENV | default "dev"}}'
-      # prod routes to the plain runner, which sets no VITE_SUPABASE_* and so leaves
-      # the committed editor/.env alone.
-      RUNNER: '{{if eq .SAAS_ENV "prod"}}dev:_run{{else}}dev:_run:saas{{end}}'
     cmds:
-      - task: '{{.RUNNER}}'
-        vars:
-          MODE: saas
-          PORT: '{{.PORT}}'
-          BACKEND_URL: '{{.BACKEND_URL}}'
-          OPEN: '{{.OPEN}}'
-          SAAS_ENV: '{{.SAAS_ENV}}'
+      - task: dev:_run
+        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
 
   dev:desktop:
     desc: "Start frontend dev server in desktop mode"
@@ -264,25 +210,12 @@ tasks:
       #   task frontend:storybook:test -- Button
       - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}
 
-  storybook:a11y:light:
-    desc: "a11y gate over every story in light mode"
-    deps: [prepare, storybook:browser]
-    cmds:
-      - node .storybook/a11y-scan.mjs {{.CLI_ARGS}}
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-
-  storybook:a11y:dark:
-    desc: "a11y gate over every story in dark mode"
-    deps: [prepare, storybook:browser]
-    cmds:
-      - SCAN_THEME=dark node .storybook/a11y-scan.mjs {{.CLI_ARGS}}
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json
-
   storybook:a11y:
-    desc: "a11y gate over every story, light and dark"
+    desc: "a11y regression gate over every story: fail only on NEW axe violations"
+    deps: [prepare, storybook:browser]
     cmds:
-      - task: storybook:a11y:light
-      - task: storybook:a11y:dark
+      - node .storybook/a11y-scan.mjs
+      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
 
   storybook:a11y:changed:
     desc: "a11y gate over the stories this branch affects (default base origin/main)"
@@ -298,6 +231,7 @@ tasks:
 
       Pass a base ref through CLI_ARGS, e.g.
         task frontend:storybook:a11y:changed -- origin/release
+    deps: [prepare, storybook:browser]
     vars:
       BASE: '{{.CLI_ARGS | default "origin/main"}}'
       CHANGED:
@@ -308,19 +242,15 @@ tasks:
             echo "a11y: no story files affected vs {{.BASE}} — nothing to check"
             exit 0
           fi
-          rc=0
-          task frontend:storybook:a11y:light -- {{.CHANGED}} || rc=1
-          task frontend:storybook:a11y:dark -- {{.CHANGED}} || rc=1
-          exit $rc
+          node .storybook/a11y-scan.mjs {{.CHANGED}}
+          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
 
   storybook:a11y:record:
-    desc: "Re-record both a11y baselines (run after intentionally fixing/adding violations)"
+    desc: "Re-record the a11y baseline (run after intentionally fixing/adding violations)"
     deps: [prepare, storybook:browser]
     cmds:
       - node .storybook/a11y-scan.mjs
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record
-      - SCAN_THEME=dark node .storybook/a11y-scan.mjs
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record --baseline .storybook/a11y-baseline.dark.json
 
   # ============================================================
   # Code quality
@@ -330,18 +260,9 @@ tasks:
     desc: "Run linting"
     deps: [install]
     cmds:
-      - task: lint:oxlint
+      - task: lint:eslint
+      - task: lint:dpdm
       - task: lint:colors
-      - task: lint:css
-
-  lint:css:
-    desc: "Lint stylesheets for duplicate selectors"
-    deps: [install]
-    cmds:
-      # Covers the whole editor tree, including the portal/processor layer and
-      # public/css. Vendored CSS and build output are excluded via ignoreFiles
-      # in stylelint.config.mjs.
-      - npx stylelint "editor/**/*.css"
 
   lint:colors:
     desc: "Enforce theme tokens — no hardcoded colours or raw primitives in components"
@@ -359,29 +280,37 @@ tasks:
     cmds:
       - node editor/scripts/lint/theme-lint.mjs contrast
 
-  lint:oxlint:
-    desc: "Run oxlint linting"
+  lint:eslint:
+    desc: "Run ESLint linting"
     deps: [install]
     cmds:
-      - npx oxlint --config oxlint.config.ts --max-warnings=0
+      - npx eslint --max-warnings=0
+
+  lint:dpdm:
+    desc: "Run circular import linting"
+    deps: [install]
+    cmds:
+      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
+      # shell-agnostic. Covers the whole editor tree, including the portal layer.
+      - npx dpdm "editor/src/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
 
   lint:fix:
     desc: "Auto-fix lint issues"
     deps: [install]
     cmds:
-      - npx oxlint --config oxlint.config.ts --fix
+      - npx eslint --fix
 
   format:
     desc: "Auto-fix code formatting"
     deps: [install]
     cmds:
-      - npx oxfmt --write .
+      - npx prettier --write .
 
   format:check:
     desc: "Check code formatting"
     deps: [install]
     cmds:
-      - npx oxfmt --check .
+      - npx prettier --check .
 
   fix:
     desc: "Auto-fix lint and format"
@@ -459,13 +388,6 @@ tasks:
       - task: typecheck:_run
         vars: { PROJECT: editor/src/portal/tsconfig.json }
 
-  typecheck:storybook:
-    desc: "Typecheck Storybook config and stories"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: .storybook/tsconfig.json }
-
   typecheck:all:
     desc: "Typecheck all build variants"
     cmds:
@@ -477,7 +399,6 @@ tasks:
       - task: typecheck:scripts
       - task: typecheck:prototypes
       - task: typecheck:portal
-      - task: typecheck:storybook
 
   # ============================================================
   # Quality Gate
@@ -521,17 +442,8 @@ tasks:
   test:editor:
     desc: "Run editor tests"
     deps: [prepare]
-    vars:
-      COVERAGE: '{{.COVERAGE | default .CI | default "false"}}'
     cmds:
-      - >
-        npx vitest run --root editor
-        {{if eq .COVERAGE "true"}}--coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage{{end}}
+      - npx vitest run --root editor
 
   test:watch:
     desc: "Run tests in watch mode"
@@ -541,9 +453,24 @@ tasks:
 
   test:coverage:
     desc: "Run tests with coverage (one-shot; CI-friendly)."
+    deps: [prepare]
     cmds:
-      - task: test:editor
-        vars: { COVERAGE: "true" }
+      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
+      # mode). Explicit reporter list because v8 + json-summary is what the
+      # coverage-summary.py helper consumes; html/text are kept for humans.
+      #
+      # reportsDirectory is pinned to ./coverage relative to vitest's root
+      # (--root editor), so output lands at frontend/editor/coverage/. The
+      # CI upload step reads from that path. An earlier attempt with
+      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
+      # pinning future-proofs against vitest changing the default.
+      - >
+        npx vitest run --root editor --coverage
+        --coverage.provider=v8
+        --coverage.reporter=text-summary
+        --coverage.reporter=json-summary
+        --coverage.reporter=html
+        --coverage.reportsDirectory=./coverage
 
   # ============================================================
   # Code Generation
@@ -553,20 +480,18 @@ tasks:
     desc: "Generate tool API types from the Java OpenAPI spec"
     deps: [install, ":backend:swagger"]
     cmds:
-      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --io-output editor/src/core/types/toolIO.ts
-      - task: format
+      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts
     sources:
       - editor/scripts/generate-tool-api-types.mts
       - ../SwaggerDoc.json
     generates:
       - editor/src/core/types/toolApiTypes.ts
-      - editor/src/core/types/toolIO.ts
 
   tool-models:check:
     desc: "Fail if committed tool API types are out of date"
+    deps: [install, ":backend:swagger"]
     cmds:
-      - task: tool-models
-      - git diff --exit-code -- editor/src/core/types/toolApiTypes.ts editor/src/core/types/toolIO.ts
+      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --check
 
   licenses:generate:
     desc: "Generate frontend license report"

.taskfiles/pre-commit.yml

@@ -45,10 +45,6 @@ vars:
   # which owns the version and caches the binary here.
   GITLEAKS_BIN: '.task/bin/gitleaks{{if eq OS "windows"}}.exe{{end}}'
 
-env:
-  # Keep repository-wide checks isolated from the engine runtime environment.
-  UV_PROJECT_ENVIRONMENT: '.venv-pre-commit'
-
 tasks:
   default:
     desc: "Check formatting, spelling, and secrets across the repo"
@@ -80,19 +76,19 @@ tasks:
     desc: "Install the pinned pre-commit Python tools"
     run: once
     cmds:
-      - uv sync --project engine --locked --group pre-commit
+      - uv sync --project scripts/pre-commit --locked
     sources:
-      - engine/uv.lock
-      - engine/pyproject.toml
+      - scripts/pre-commit/uv.lock
+      - scripts/pre-commit/pyproject.toml
     status:
-      - test -d engine/.venv-pre-commit
+      - test -d scripts/pre-commit/.venv
 
   clean:
-    desc: "Remove the cached gitleaks binary and the pre-commit virtualenv"
+    desc: "Remove the cached gitleaks binary and the tool virtualenv"
     cmds:
-      - cmd: rm -rf engine/.venv-pre-commit .task/bin/gitleaks
+      - cmd: rm -rf scripts/pre-commit/.venv .task/bin/gitleaks
         platforms: [linux, darwin]
-      - cmd: cmd /c "rmdir /s /q engine\.venv-pre-commit & del /q .task\bin\gitleaks.exe"
+      - cmd: cmd /c "rmdir /s /q scripts\pre-commit\.venv & del /q .task\bin\gitleaks.exe"
         platforms: [windows]
         ignore_error: true
 
@@ -101,26 +97,26 @@ tasks:
   ruff:
     deps: [install]
     cmds:
-      - uv run --project engine --locked --group pre-commit ruff check --isolated --line-length=120 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
+      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
 
   ruff-format:
     deps: [install]
     cmds:
-      - uv run --project engine --locked --group pre-commit ruff format --isolated --line-length=120 {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
+      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
 
   codespell:
     deps: [install]
     cmds:
-      - uv run --project engine --locked --group pre-commit codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
+      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
 
   toml-sort:
     deps: [install]
     cmds:
-      - uv run --project engine --locked --group pre-commit python scripts/pre-commit/sort_locale_toml.py {{if .FIX}}--fix {{end}}{{.LOCALE_TOML}}
+      - uv run --project scripts/pre-commit --no-sync python scripts/pre-commit/sort_locale_toml.py {{if .FIX}}--fix {{end}}{{.LOCALE_TOML}}
 
   whitespace:
     cmds:
-      - uv run --project engine --locked --group pre-commit python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
+      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
 
   gitleaks:
     deps: [gitleaks-bin]
@@ -134,4 +130,4 @@ tasks:
     internal: true
     desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
     cmds:
-      - uv run --project engine --locked --group pre-commit python scripts/pre-commit/install_gitleaks.py
+      - uv run --no-project python scripts/pre-commit/install_gitleaks.py

.vscode/extensions.json

@@ -2,6 +2,8 @@
   "recommendations": [
     "elagil.pre-commit-helper", // Support for pre-commit hooks to enforce code quality
     "josevseb.google-java-format-for-vs-code", // Google Java code formatter to follow the Google Java Style Guide
+    "ms-python.black-formatter", // Python code formatter using Black
+    "ms-python.flake8", // Flake8 linter for Python to enforce code quality
     "ms-python.python", // Official Microsoft Python extension with IntelliSense, debugging, and Jupyter support
     "ms-vscode-remote.vscode-remote-extensionpack", // Remote Development Pack for SSH, WSL, and Containers
     // "Oracle.oracle-java", // Oracle Java extension with additional features for Java development
@@ -17,7 +19,6 @@
     "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
     "stylelint.vscode-stylelint", // Stylelint extension for CSS and SCSS linting
     "redhat.vscode-yaml", // YAML extension for Visual Studio Code
-    "tamasfe.even-better-toml", // TOML language support and formatting
-    "oxc.oxc-vscode", // Oxc (oxlint) extension for JavaScript/TypeScript linting
+    "dbaeumer.vscode-eslint", // ESLint extension for TypeScript linting
   ]
 }

.vscode/settings.json

@@ -20,9 +20,8 @@
     "editor.defaultFormatter": "vscode.json-language-features"
   },
   "[python]": {
-    "editor.defaultFormatter": "charliermarsh.ruff"
+    "editor.defaultFormatter": "ms-python.black-formatter"
   },
-  "ruff.configuration": "${workspaceFolder}/engine/pyproject.toml",
   "[gradle-kotlin-dsl]": {
     "editor.defaultFormatter": "vscjava.vscode-gradle"
   },
@@ -73,52 +72,40 @@
     "stirling",
   ],
   "java.project.resourceFilters": [
-    ".cache/",
-    ".claude/",
     ".devcontainer/",
     ".git/",
-    ".git-blame-ignore-revs",
-    ".gitattributes",
     ".github/",
-    ".gitignore",
     ".gradle/",
-    ".pre-commit-config.yaml",
-    ".task/",
-    ".taskfiles/",
     ".venv/",
     ".venv*/",
     ".vscode/",
-    "app/.gitignore",
-    "app/build/",
-    "app/common/.gitignore",
-    "app/common/bin/",
-    "app/common/build/",
-    "app/core/.gitignore",
-    "app/core/bin/",
-    "app/core/configs/",
-    "app/core/customFiles/",
-    "app/core/LOCAL_APPDATA_FONTCONFIG_CACHE/",
-    "app/core/logs/",
-    "app/core/pipeline/",
-    "app/core/storage/",
-    "app/proprietary/.gitignore",
-    "app/proprietary/bin/",
-    "app/proprietary/storage/",
-    "app/saas/.gitignore",
-    "app/saas/bin/",
-    "app/saas/build/",
     "bin/",
+    "app/core/bin/",
+    "app/common/bin/",
+    "app/proprietary/bin/",
     "build/",
-    "devGuide/",
-    "devTools/",
-    "docker/",
+    "app/core/build/",
+    "app/common/build/",
+    "app/proprietary/build/",
+    "configs/",
+    "app/core/configs/",
+    "customFiles/",
+    "app/core/customFiles/",
     "docs/",
-    "engine/",
-    "frontend/",
+    "exampleYmlFiles",
     "gradle/",
     "images/",
+    "logs/",
+    "pipeline/",
     "scripts/",
     "testings/",
+    ".git-blame-ignore-revs",
+    ".gitattributes",
+    ".gitignore",
+    "app/core/.gitignore",
+    "app/common/.gitignore",
+    "app/proprietary/.gitignore",
+    ".pre-commit-config.yaml",
   ],
   // Enables signature help in Java.
   "java.signatureHelp.enabled": true,
@@ -147,57 +134,13 @@
   "html.format.indentHandlebars": true,
   "html.format.preserveNewLines": true,
   "html.format.maxPreserveNewLines": 2,
-  "stylelint.configFile": "${workspaceFolder}/devTools/.stylelintrc.json",
-  "css.lint.unknownAtRules": "ignore",
-  "scss.lint.unknownAtRules": "ignore",
-  "less.lint.unknownAtRules": "ignore",
+  "stylelint.configFile": "devTools/.stylelintrc.json",
   "java.project.sourcePaths": [
     "app/core/src/main/java",
     "app/common/src/main/java",
     "app/proprietary/src/main/java"
   ],
-  "[javascript]": {
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
-  "[javascriptreact]": {
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
   "[typescript]": {
-    "editor.defaultFormatter": "vscode.typescript-language-features",
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
-  "[typescriptreact]": {
-    "editor.codeActionsOnSave": {
-      "source.fixAll.oxc": "explicit"
-    }
-  },
-  "oxc.enable.oxlint": true,
-  "oxc.enable.oxfmt": false,
-  "oxc.configPath": "frontend/oxlint.config.ts",
-  "oxc.requireConfig": true,
-  "oxc.lint.run": "onType",
-  "oxc.fixKind": "safe_fix",
-  "[toml]": {
-    "editor.defaultFormatter": "tamasfe.even-better-toml",
-    // Keep TOML formatting compatible with .editorconfig and the pre-commit
-    // locale sorter. Key ordering itself is handled by task pre-commit:toml-sort.
-    "editor.insertSpaces": true,
-    "editor.tabSize": 4,
-    "editor.rulers": [127],
-    "evenBetterToml.formatter.alignEntries": false,
-    "evenBetterToml.formatter.alignComments": false,
-    "evenBetterToml.formatter.indentString": "    ",
-    "evenBetterToml.formatter.columnWidth": 127,
-    "evenBetterToml.formatter.reorderKeys": false,
-    "evenBetterToml.formatter.reorderArrays": false,
-    "evenBetterToml.formatter.reorderInlineTables": false,
-    "evenBetterToml.formatter.trailingNewline": true,
-    "evenBetterToml.formatter.crlf": false
+    "editor.defaultFormatter": "vscode.typescript-language-features"
   }
 }

AGENTS.md

@@ -192,7 +192,7 @@ What goes where:
 - **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
 - **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.
 
-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (all enforced by the linter). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
+`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
 
 Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).
 

CONTRIBUTING.md

@@ -2,13 +2,6 @@
 
 Thank you for your interest in contributing to Stirling-PDF! There are many ways to contribute other than writing code. For example, reporting bugs, creating suggestions, and adding or modifying translations.
 
-## License
-
-By contributing to this project, you agree that your contributions will be licensed under the project [license](LICENSE), which follows an open-core model. 
-The codebase is a mix of MIT and source-available code, so your contribution is licensed according to the directory it is committed to.
-
-PRs are welcome in any directory by any user, just be aware of which license applies to the code you change.
-
 ## Issue Guidelines
 
 Issues can be used to report bugs, request features, or ask questions. If you have a question, you could also ask us in our [Discord](https://discord.gg/FJUSXUSYec).
@@ -28,7 +21,7 @@ This project uses [Task](https://taskfile.dev/) as a unified command runner. Aft
 
 1. Install the `task` CLI: https://taskfile.dev/installation/
 2. Run `task install` to install all dependencies
-3. Run `task dev` to start backend + frontend or `task desktop:dev` to start the desktop application
+3. Run `task dev` to start backend + frontend
 4. Run `task check` before submitting a PR
 
 Run `task --list` to see all available commands.
@@ -70,3 +63,7 @@ For technical guides, setup instructions, and development resources:
 For configuration and usage guides, see:
 - [Database Guide](DATABASE.md) - Database setup and configuration
 - [OCR Guide](HowToUseOCR.md) - OCR setup and configuration
+
+## License
+
+By contributing to this project, you agree that your contributions will be licensed under the [MIT License](LICENSE).

DeveloperGuide.md

@@ -46,8 +46,8 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Docker
 - Git
 - Java JDK 25
-- Node.js 22+ and npm (required for frontend development)
-- Gradle 9.0 or later (Included within the repo)
+- Node.js 18+ and npm (required for frontend development)
+- Gradle 7.0 or later (Included within the repo)
 - [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)
@@ -158,7 +158,7 @@ Stirling-PDF/
 │   │   │   └── locales/       # Internationalization files (JSON)
 │   │   └── vite.config.ts     # Vite configuration
 │   ├── package.json       # Shared workspace dependencies
-│   └── oxlint.config.ts   # Shared lint config
+│   └── eslint.config.mjs  # Shared lint config
 ├── customFiles/           # Custom static files and templates (generated at runtime used to replace existing files)
 ├── docs/                  # Documentation files
 ├── exampleYmlFiles/       # Example YAML configuration files
@@ -504,8 +504,7 @@ For Stirling 2.0, new features are built as React components:
 1. **Create a New Controller:**
    - Create a new Java class in the `stirling-pdf/src/main/java/stirling/software/SPDF/controller/api` directory.
    - Annotate the class with `@RestController` and `@RequestMapping` to define the API endpoint.
-   - Ensure to add API documentation annotations like `@Tag(name = "General", description = "General APIs")` and `@Operation(summary = "Crops a PDF document", description = "This operation takes an input PDF file and crops it according to the given coordinates.")`.
-   - If the endpoint transforms a document, declare what it accepts and produces with `@ToolIO`, for example `@ToolIO(produces = ToolFormat.PDF)`. This is what lets a pipeline containing the step be checked before it runs, so a chain that cannot work is caught in the builder rather than part-way through a job. Endpoints under the tool namespaces are required to carry it - `ToolIODeclarationCoverageTest` fails the build otherwise. See [Declaring tool inputs and outputs](#declaring-tool-inputs-and-outputs).
+   - Ensure to add API documentation annotations like `@Tag(name = "General", description = "General APIs")` and `@Operation(summary = "Crops a PDF document", description = "This operation takes an input PDF file and crops it according to the given coordinates. Input:PDF Output:PDF Type:SISO")`.
 
    ```java
    package stirling.software.SPDF.controller.api;
@@ -579,38 +578,6 @@ For Stirling 2.0, new features are built as React components:
   }
   ```
 
-### Declaring tool inputs and outputs
-
-An endpoint that transforms a document declares what it accepts and produces with `@ToolIO`. This is the single source of truth: it is published into the OpenAPI spec as an `x-stirling-io` extension, and generated from there into the frontend (`toolIO.ts`) and the AI engine (`tool_io.py`). A pipeline can therefore be checked while it is being edited, instead of failing part-way through a job.
-
-```java
-@ToolIO(produces = ToolFormat.PDF)
-```
-
-`accepts` defaults to `{ ToolFormat.PDF }` and `arity` to `ToolArity.SISO`, so most tools only declare what they produce.
-
-- **`ToolFormat`** is the kind of file: `PDF`, `PDF_ENCRYPTED`, `IMAGE`, `ZIP`, `WORD`, `PPT`, `EXCEL`, `CSV`, `HTML`, `XML`, `JSON`, `TEXT`, `MARKDOWN`, `JAVASCRIPT`, `EBOOK`, `EMAIL`, `POSTSCRIPT`, `VIDEO`, `CBZ`, `CBR`, plus `ANY` (accepts or produces anything) and `NONE` (returns a report, not a file). Encryption is a format rather than a flag, so the default `accepts = PDF` means an endpoint rejects an encrypted PDF unless it opts in.
-- **`ToolArity`** is how many files go in and out: `SISO`, `SIMO`, `MISO`, `MIMO`. This axis carries ZIP-as-transport. A splitter is `produces = PDF, arity = SIMO`, and the caller unpacks the archive; an endpoint whose deliverable really is an archive declares `produces = ZIP` with a single-output arity and stays packed.
-
-When the output depends on a parameter, declare the exception as a case rather than picking one answer. Add Password produces an encrypted PDF unless both passwords are blank, in which case it has only set permissions:
-
-```java
-@ToolIO(
-        produces = ToolFormat.PDF_ENCRYPTED,
-        cases =
-                @ToolIOCase(
-                        when = {
-                            @ToolIOWhen(param = "password", matches = ""),
-                            @ToolIOWhen(param = "ownerPassword", matches = "")
-                        },
-                        produces = ToolFormat.PDF,
-                        arity = ToolArity.SISO))
-```
-
-Every condition in a `when` must hold for the case to apply, and `matches` is compared as a string, case-insensitively, with an empty string matching an absent or blank value. If a case reads a parameter that is not set yet, the output is reported as uncertain and the chain warns rather than erroring.
-
-Endpoints under the tool namespaces must carry a declaration; `ToolIODeclarationCoverageTest` fails the build for any that does not, with a short allowlist for endpoints that manage a session, a device or a stored resource rather than transforming a document. The matching rules are implemented three times (Java `ToolChainValidator`, `toolIOCompat.ts`, `tool_io_compat.py`) and pinned to the same answers by the shared fixtures in `testing/tool-io-cases.json`, so a behaviour change belongs in that file first.
-
 ## Adding New Translations to Existing Language Files in Stirling-PDF
 
 When adding a new feature or modifying existing ones in Stirling-PDF, you'll need to add new translation entries to the existing language files. Here's a step-by-step guide:

Taskfile.yml

@@ -25,9 +25,6 @@ includes:
   e2e:
     taskfile: .taskfiles/e2e.yml
     dir: .
-  cucumber:
-    taskfile: .taskfiles/cucumber.yml
-    dir: testing/cucumber
   pre-commit:
     taskfile: .taskfiles/pre-commit.yml
     dir: .
@@ -99,22 +96,11 @@ tasks:
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
 
-  # Set SAAS_DEV_PROJECT_REF in app/.env.saas.local to pick the PR.
   dev:saas:
-    desc: "Start SaaS backend + frontend + engine against the current PR's preview branch"
+    desc: "Start SaaS backend + frontend concurrently on free ports"
     cmds:
       - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas, SAAS_ENV: dev }
-
-  staging:saas:
-    desc: "Start SaaS backend + frontend + engine against the shared v3 staging project"
-    cmds:
-      - task: dev:_all
-        vars:
-          FRONTEND: saas
-          BACKEND: saas
-          BACKEND_TASK: backend:staging:saas
-          SAAS_ENV: staging
+        vars: { FRONTEND: saas, BACKEND: saas }
 
   dev:all:
     desc: "Start backend + frontend + engine concurrently on free ports"
@@ -126,9 +112,6 @@ tasks:
     vars:
       FRONTEND: '{{.FRONTEND | default "proprietary"}}'
       BACKEND: '{{.BACKEND | default "proprietary"}}'
-      BACKEND_TASK: '{{.BACKEND_TASK | default (printf "backend:dev:%s" .BACKEND)}}'
-      # Only meaningful to the saas frontend; every other flavor ignores it.
-      SAAS_ENV: '{{.SAAS_ENV | default ""}}'
       PORTS:
         sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
       BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -138,7 +121,7 @@ tasks:
       - task: engine:dev
         vars:
           PORT: '{{.ENGINE_PORT}}'
-      - task: '{{.BACKEND_TASK}}'
+      - task: 'backend:dev:{{.BACKEND}}'
         vars:
           PORT: '{{.BACKEND_PORT}}'
           AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
@@ -148,7 +131,6 @@ tasks:
           PORT: '{{.FRONTEND_PORT}}'
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
-          SAAS_ENV: '{{.SAAS_ENV}}'
 
   # ============================================================
   # Build
@@ -212,12 +194,6 @@ tasks:
       - task: frontend:tool-models
       - task: engine:tool-models
 
-  tool-models:check:
-    desc: "Fail if any committed API model is out of date"
-    cmds:
-      - task: frontend:tool-models:check
-      - task: engine:tool-models:check
-
   # ============================================================
   # Quality Gate
   # ============================================================

WINDOWS_SIGNING.md

@@ -4,11 +4,6 @@ This guide explains how to set up Windows code signing for Stirling-PDF desktop
 
 ## Overview
 
-Releases are signed with **DigiCert KeyLocker**, a cloud HSM: the private key never
-leaves DigiCert, and the runner signs through a PKCS#11 provider. The older approach
-of uploading a base64 `.pfx` to a repository secret has been removed from the
-workflows - the sections below describe KeyLocker, which is what actually runs.
-
 Windows code signing is essential for:
 - Preventing Windows SmartScreen warnings
 - Building trust with users
@@ -54,19 +49,29 @@ openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certifica
 
 ### Required Secrets
 
-Navigate to your GitHub repository → Settings → Environments → `release-signing`.
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions
 
-These live in the `release-signing` environment, not at repository scope. That
-environment requires reviewer approval and is limited to `main`, `release`,
-`hotfix/*` and `v*` tags. All five come from the DigiCert ONE console.
+Add the following secrets:
 
-| Secret | Description |
-| --- | --- |
-| `SM_API_KEY` | KeyLocker API key. Also acts as the on/off switch: signing steps are gated on it being non-empty. |
-| `SM_CLIENT_CERT_FILE_B64` | Base64-encoded PKCS#12 client authentication certificate. |
-| `SM_CLIENT_CERT_PASSWORD` | Password for that client certificate. |
-| `SM_KEYPAIR_ALIAS` | Alias of the signing keypair to use. |
-| `SM_HOST` | DigiCert ONE host, e.g. `https://clientauth.one.digicert.com`. |
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file
 
 ### Optional Secrets for Tauri Updater
 
@@ -105,23 +110,23 @@ The Windows signing configuration is already set up:
 
 ### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
 
-The workflow includes four Windows signing steps, all gated on `SM_API_KEY` being
-set and the ref being the release branch:
+The workflow includes three Windows signing steps:
 
-1. **Setup DigiCert KeyLocker**: Installs the DigiCert signing tools via `digicert/ssm-code-signing`
-2. **Setup DigiCert KeyLocker Certificate**: Writes the client cert and exports the PKCS#11 config
-3. **Configure Windows code signing / Build Tauri app**: Signs through the PKCS#11 provider
-4. **Verify Windows Code Signature**: Validates that the .exe and .msi are properly signed
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
 
 ## Testing the Setup
 
 ### 1. Local Testing (Windows Only)
 
-KeyLocker is CI-only. To check signing locally, install your own certificate into
-the Windows store and point Tauri at it; the build no longer reads any certificate
-from an environment variable.
+Before pushing to GitHub, test locally:
 
 ```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
 # Build the application
 cd frontend
 npm run tauri build
@@ -186,10 +191,9 @@ Look for:
 - Consider EV certificate for immediate reputation
 
 ### Certificate Not Found During Build
-- Verify `SM_API_KEY` is present in the `release-signing` environment. If it is empty
-  the signing steps skip silently and the build succeeds unsigned.
-- Check `SM_CLIENT_CERT_FILE_B64` base64 encoding is correct (no extra whitespace)
-- Ensure `SM_CLIENT_CERT_PASSWORD` and `SM_KEYPAIR_ALIAS` match the DigiCert keypair
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct
 
 ## Security Best Practices
 
@@ -216,10 +220,11 @@ Look for:
 ## Certificate Lifecycle
 
 ### Before Expiration
-1. Renew the certificate in the DigiCert ONE console (typically annual)
-2. If the keypair alias changed, update `SM_KEYPAIR_ALIAS` in the `release-signing` environment
-3. If the client authentication certificate was reissued, update `SM_CLIENT_CERT_FILE_B64` and `SM_CLIENT_CERT_PASSWORD`
-4. Test build to verify the new certificate works
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works
 
 ### Expired Certificates
 - Signed binaries remain valid (timestamp proves signing time)

app/.env.saas

@@ -1,16 +1,15 @@
-# Stirling-PDF SaaS environment defaults. Committed, non-secret. Real values for secrets go in
-# .env.saas.local, which is loaded first and wins. Do not commit that file.
+###############################################################################
+# Stirling-PDF SaaS environment defaults.
 #
-# Three environments, each deriving its Supabase URLs, JWT issuer and JWKS from one project ref:
+# This file is committed and provides non-secret defaults loaded by
+# `task backend:dev:saas`. Put real values for secrets (passwords, project
+# refs, edge function secrets) in `.env.saas.local` - any variable set there
+# takes precedence over what's defined here.
 #
-#   prod     PROFILES=none       SAAS_DB_*          the live project
-#   staging  PROFILES=staging    SAAS_STAGING_*     pinned to v3, always there
-#   dev      PROFILES=dev        SAAS_DEV_*         follows a SaaS PR's preview branch
-#
-# dev is the default for `task backend:dev:saas`. Use staging for somewhere stable; use dev when
-# testing an open SaaS PR, since its preview branch is the only place those migrations are applied.
+# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
+###############################################################################
 
-# ---------- Supabase project (prod / no-profile) ----------
+# ---------- Supabase project ----------
 # Project reference (the subdomain part of <ref>.supabase.co). Required.
 # Set in .env.saas.local.
 SAAS_DB_PROJECT_REF=
@@ -18,35 +17,18 @@ SAAS_DB_PROJECT_REF=
 # Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
 SUPABASE_EDGE_FUNCTION_SECRET=
 
-# ---------- Database (no profile) ----------
-# Direct JDBC URL to the Supabase Postgres. Required when running without
-# `--spring.profiles.include=...`.
+# ---------- Database (saas profile) ----------
+# Direct JDBC URL to the Supabase Postgres. Required when running the plain
+# `saas` profile (i.e. without `--spring.profiles.include=dev`).
 # Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
 SAAS_DB_URL=
 SAAS_DB_USERNAME=postgres
 SAAS_DB_PASSWORD=
 
-# ---------- staging profile ----------
-# The shared long-lived v3 project. application-staging.properties defaults the ref,
-# URL, database host and meter endpoint, so staging needs only the password, in
-# .env.saas.local. Set SAAS_STAGING_PROJECT_REF to repoint it; everything derives.
-#
-# The ref and publishable key are duplicated here because the task derives the
-# frontend's VITE_SUPABASE_* from them and a shell cannot read a Spring default.
-# Neither is secret: the ref is a public subdomain, the key ships in the bundle.
-SAAS_STAGING_PROJECT_REF=qacaivhsjtftfwtgjvva
-SAAS_STAGING_PUBLISHABLE_KEY=sb_publishable_nIM8y-9ARPE7EzQwAQHKMg_40fCN6kY # gitleaks:allow
-SAAS_STAGING_DB_USERNAME=postgres
-SAAS_STAGING_DB_PASSWORD=
-
-# ---------- dev profile ----------
-# The SaaS PR's Supabase preview branch. Take the ref from that PR's "Supabase
-# Preview" check; the profile derives URL, JWT issuer, JWKS, meter endpoint and
-# database host from it, so this one value follows a different PR.
-#
-# A preview branch has its own password and keys; the parent project's will not
-# authenticate. Both go in .env.saas.local, along with the ref.
-SAAS_DEV_PROJECT_REF=
-SAAS_DEV_PUBLISHABLE_KEY=
+# ---------- Database (dev profile overrides) ----------
+# Used when `--spring.profiles.include=dev` is active. The dev profile
+# defaults the URL/username to the shared dev Supabase project, but the
+# password must still be provided in .env.saas.local.
+SAAS_DEV_DB_URL=
 SAAS_DEV_DB_USERNAME=postgres
 SAAS_DEV_DB_PASSWORD=

app/allowed-licenses.json

@@ -32,14 +32,6 @@
       "moduleName": ".*",
       "moduleLicense": "BSD-4 License"
     },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "Revised BSD"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "ISC"
-    },
     {
       "moduleName": ".*",
       "moduleLicense": "MIT"
@@ -56,10 +48,6 @@
       "moduleName": ".*",
       "moduleLicense": "MIT-0"
     },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "MIT license"
-    },
     {
       "moduleName": "com.github.jai-imageio:jai-imageio-core",
       "moduleLicense": "LICENSE.txt"
@@ -156,14 +144,6 @@
       "moduleName": ".*",
       "moduleLicense": "GNU GENERAL PUBLIC LICENSE, Version 2 + Classpath Exception"
     },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "GNU Lesser Public License"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "The GNU Lesser General Public License"
-    },
     {
       "moduleName": "com.martiansoftware:jsap",
       "moduleLicense": "LGPL"
@@ -232,6 +212,14 @@
       "moduleName": "com.google.re2j:re2j",
       "moduleLicense": "Go License"
     },
+    {
+      "moduleName": "com.hubspot:algebra",
+      "moduleLicense": null
+    },
+    {
+      "moduleName": "com.hubspot.immutables:immutables-exceptions",
+      "moduleLicense": null
+    },
     {
       "moduleName": ".*",
       "moduleLicense": "UnRar License"

app/common/build.gradle

@@ -10,19 +10,19 @@ dependencies {
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
     api "org.apache.commons:commons-lang3:${commonsLang3}"
-    api 'com.drewnoakes:metadata-extractor:2.21.0' // Image metadata extractor
+    api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
     api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:8.0.0' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.6.0' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
-    api 'org.snakeyaml:snakeyaml-engine:3.1.1'
+    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
     api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
-    api 'org.simplejavamail:simple-java-mail:9.3.2'
-    api 'org.simplejavamail:outlook-module:9.3.2' // MSG file support
+    api 'org.simplejavamail:simple-java-mail:8.12.6'
+    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
     api 'jakarta.mail:jakarta.mail-api:2.1.5'
     runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
 
@@ -36,24 +36,18 @@ dependencies {
 
     api "com.stirling:jpdfium:${jpdfiumVersion}"
 
-    // -PjpdfiumPlatforms=all|none|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
-    // 'none' skips natives entirely (windows-arm64 builds, until JPDFium ships that platform).
+    // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
     def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
     def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
-    def jpdfiumPlatforms
-    if (jpdfiumPlatformsProp == 'all') {
-        jpdfiumPlatforms = jpdfiumAllPlatforms
-    } else if (jpdfiumPlatformsProp == 'none') {
-        jpdfiumPlatforms = []
-    } else {
-        jpdfiumPlatforms = jpdfiumPlatformsProp.split(',').collect { it.trim() }.findAll { it }
-    }
+    def jpdfiumPlatforms = jpdfiumPlatformsProp == 'all'
+            ? jpdfiumAllPlatforms
+            : jpdfiumPlatformsProp.split(',').collect { it.trim() }.findAll { it }
     def jpdfiumInvalid = jpdfiumPlatforms.findAll { !jpdfiumAllPlatforms.contains(it) }
     if (jpdfiumInvalid) {
         throw new GradleException("Unknown jpdfiumPlatforms value(s): ${jpdfiumInvalid.join(', ')}. " +
-                "Valid: ${jpdfiumAllPlatforms.join(', ')}, 'all' or 'none'.")
+                "Valid: ${jpdfiumAllPlatforms.join(', ')} or 'all'.")
     }
-    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms ? jpdfiumPlatforms.join(', ') : 'none'}")
+    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
     jpdfiumPlatforms.each { platform ->
         runtimeOnly "com.stirling:jpdfium-natives-${platform}:${jpdfiumVersion}"
     }

app/common/src/main/java/org/apache/pdfbox/examples/util/DeletingRandomAccessFile.java

@@ -1,4 +1,4 @@
-package stirling.software.common.util;
+package org.apache.pdfbox.examples.util;
 
 import java.io.File;
 import java.io.IOException;

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -6,7 +6,6 @@ import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.stereotype.Service;
 
@@ -14,7 +13,6 @@ import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.service.PdfaLevelAServiceInterface;
 
 @Service
 @Slf4j
@@ -53,16 +51,12 @@ public class EndpointConfiguration {
     private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
-    private final boolean pdfUaAvailable;
 
     public EndpointConfiguration(
             ApplicationProperties applicationProperties,
-            @Qualifier("runningProOrHigher") boolean runningProOrHigher,
-            @Autowired(required = false) PdfaLevelAServiceInterface pdfaLevelAService) {
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
         this.applicationProperties = applicationProperties;
         this.runningProOrHigher = runningProOrHigher;
-        // The PDF/UA tagger ships in the proprietary module, and so do its endpoints.
-        this.pdfUaAvailable = pdfaLevelAService != null;
         init();
         processEnvironmentConfigs();
     }
@@ -344,7 +338,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("PageOps", "split-pages");
         addEndpointToGroup("PageOps", "rearrange-pages");
         addEndpointToGroup("PageOps", "rotate-pdf");
-        addEndpointToGroup("PageOps", "auto-rotate-pdf");
         addEndpointToGroup("PageOps", "multi-page-layout");
         addEndpointToGroup("PageOps", "booklet-imposition");
         addEndpointToGroup("PageOps", "scale-pages");
@@ -362,7 +355,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Convert", "pdf-to-img");
         addEndpointToGroup("Convert", "img-to-pdf");
         addEndpointToGroup("Convert", "pdf-to-pdfa");
-        addEndpointToGroup("Convert", "pdf-to-ua");
         addEndpointToGroup("Convert", "file-to-pdf");
         addEndpointToGroup("Convert", "pdf-to-word");
         addEndpointToGroup("Convert", "pdf-to-presentation");
@@ -402,7 +394,6 @@ public class EndpointConfiguration {
         // Backend-only endpoints (not in frontend tool registry endpoints)
         addEndpointToGroup("Security", "redact");
         addEndpointToGroup("Security", "verify-pdf");
-        addEndpointToGroup("Security", "accessibility-report");
         addEndpointToGroup("Security", "sign");
 
         // Adding endpoints to "Other" group
@@ -442,6 +433,17 @@ public class EndpointConfiguration {
         addEndpointToGroup("Automation", "automate"); // Alias for handleData (user-friendly name)
         addEndpointToGroup("Automation", "pipeline");
 
+        // Adding endpoints to "DocParse" group (parsing, splitting, chunking, extraction,
+        // templating)
+        addEndpointToGroup("DocParse", "parse-document");
+        addEndpointToGroup("DocParse", "extract-fields");
+        addEndpointToGroup("DocParse", "smart-split");
+        addEndpointToGroup("DocParse", "chunk-document");
+        addEndpointToGroup("DocParse", "rag-ingest");
+        addEndpointToGroup("DocParse", "extract-tables");
+        addEndpointToGroup("DocParse", "suggest-schema");
+        addEndpointToGroup("DocParse", "fill-template");
+
         // Adding endpoints to "DeveloperTools" group
         addEndpointToGroup("DeveloperTools", "show-javascript");
 
@@ -537,8 +539,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Java", "json-to-pdf");
         addEndpointToGroup("Java", "pdf-to-video");
         addEndpointToGroup("Java", "verify-pdf");
-        addEndpointToGroup("Java", "pdf-to-ua");
-        addEndpointToGroup("Java", "accessibility-report");
         addEndpointToGroup("Java", "flatten");
         addEndpointToGroup("Java", "unlock-pdf-forms");
         addEndpointToGroup("Java", "validate-signature");
@@ -610,8 +610,6 @@ public class EndpointConfiguration {
 
         // veraPDF dependent endpoints
         addEndpointToGroup("veraPDF", "verify-pdf");
-        addEndpointToGroup("veraPDF", "pdf-to-ua");
-        addEndpointToGroup("veraPDF", "accessibility-report");
 
         // Pdftohtml dependent endpoints
         addEndpointToGroup("Pdftohtml", "pdf-to-html");
@@ -642,11 +640,6 @@ public class EndpointConfiguration {
             disableGroup("enterprise");
         }
 
-        if (!pdfUaAvailable) {
-            disableEndpoint("pdf-to-ua");
-            disableEndpoint("accessibility-report");
-        }
-
         if (!applicationProperties.getSystem().isEnableUrlToPDF()) {
             disableEndpoint("url-to-pdf");
         }

app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java

@@ -2,9 +2,7 @@ package stirling.software.common.aop;
 
 import java.io.IOException;
 import java.time.Duration;
-import java.util.ArrayList;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
@@ -275,7 +273,6 @@ public class AutoJobAspect {
 
                         // Store the fileId for later reference
                         pdfFile.setFileId(fileId);
-                        recordPendingInputFile(fileId);
 
                         // Replace the original MultipartFile with our persistent copy
                         MultipartFile persistentFile = fileStorage.retrieveFile(fileId);
@@ -293,29 +290,6 @@ public class AutoJobAspect {
         return originalArgs;
     }
 
-    /**
-     * Queue an input copy for attribution to the job. The job id does not exist yet at this point,
-     * so {@link JobExecutorService} drains this list once it mints one.
-     */
-    @SuppressWarnings("unchecked")
-    private void recordPendingInputFile(String fileId) {
-        try {
-            Object existing = request.getAttribute(JobExecutorService.PENDING_INPUT_FILE_IDS_ATTR);
-            List<String> ids;
-            if (existing instanceof List<?> list) {
-                ids = (List<String>) list;
-            } else {
-                ids = new ArrayList<>();
-                request.setAttribute(JobExecutorService.PENDING_INPUT_FILE_IDS_ATTR, ids);
-            }
-            ids.add(fileId);
-        } catch (RuntimeException ex) {
-            // Without a bound request the copy cannot be attributed; the periodic sweep is the
-            // only backstop, so make the miss visible rather than silently leaking the file.
-            log.warn("Could not record input copy {} for cleanup: {}", fileId, ex.getMessage());
-        }
-    }
-
     private String getJobIdFromContext() {
         try {
             return (String) request.getAttribute("jobId");

app/common/src/main/java/stirling/software/common/config/swagger/ToolIOOperationCustomizer.java

@@ -1,109 +0,0 @@
-package stirling.software.common.config.swagger;
-
-import java.lang.reflect.Method;
-import java.util.Arrays;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.springdoc.core.customizers.GlobalOpenApiCustomizer;
-import org.springdoc.core.customizers.GlobalOperationCustomizer;
-import org.springframework.stereotype.Component;
-import org.springframework.web.method.HandlerMethod;
-
-import io.swagger.v3.oas.models.OpenAPI;
-import io.swagger.v3.oas.models.Operation;
-
-import stirling.software.common.model.tool.ToolArity;
-import stirling.software.common.model.tool.ToolFormat;
-import stirling.software.common.model.tool.ToolIO;
-import stirling.software.common.model.tool.ToolIOCase;
-import stirling.software.common.model.tool.ToolIOWhen;
-import stirling.software.common.service.ToolIOParameterDefaults;
-
-/**
- * Publishes each {@link ToolIO} into the spec as {@code x-stirling-io}, which is how the frontend
- * and the AI engine get it.
- *
- * <p>Also appends the {@code Input:/Output:/Type:} line the docs used to carry by hand, so the
- * published text is unchanged without anyone maintaining it.
- */
-@Component
-public class ToolIOOperationCustomizer
-        implements GlobalOperationCustomizer, GlobalOpenApiCustomizer {
-
-    public static final String EXTENSION_NAME = "x-stirling-io";
-    public static final String VOCABULARY_EXTENSION_NAME = "x-stirling-io-vocabulary";
-
-    // Published separately from the declarations: generators need the full vocabulary for their
-    // enums, and deriving it from what is present would shrink it when an endpoint is disabled.
-    @Override
-    public void customise(OpenAPI openApi) {
-        Map<String, Object> vocabulary = new LinkedHashMap<>();
-        vocabulary.put("formats", names(ToolFormat.values()));
-        vocabulary.put("arities", names(ToolArity.values()));
-        openApi.addExtension(VOCABULARY_EXTENSION_NAME, vocabulary);
-    }
-
-    @Override
-    public Operation customize(Operation operation, HandlerMethod handlerMethod) {
-        ToolIO declaration = handlerMethod.getMethodAnnotation(ToolIO.class);
-        if (declaration == null) {
-            return operation;
-        }
-        operation.addExtension(EXTENSION_NAME, toExtension(declaration, handlerMethod.getMethod()));
-        operation.setDescription(appendSummaryLine(operation.getDescription(), declaration));
-        return operation;
-    }
-
-    private static Map<String, Object> toExtension(ToolIO declaration, Method handler) {
-        Map<String, Object> extension = new LinkedHashMap<>();
-        extension.put("accepts", names(declaration.accepts()));
-        extension.put("produces", declaration.produces().name());
-        extension.put("arity", declaration.arity().name());
-        if (declaration.cases().length > 0) {
-            extension.put("cases", cases(declaration, handler));
-        }
-        return extension;
-    }
-
-    private static List<Map<String, Object>> cases(ToolIO declaration, Method handler) {
-        return Arrays.stream(declaration.cases()).map(rule -> toCase(rule, handler)).toList();
-    }
-
-    private static Map<String, Object> toCase(ToolIOCase rule, Method handler) {
-        Map<String, Object> entry = new LinkedHashMap<>();
-        entry.put("when", Arrays.stream(rule.when()).map(c -> toCondition(c, handler)).toList());
-        entry.put("produces", rule.produces().name());
-        entry.put("arity", rule.arity().name());
-        return entry;
-    }
-
-    private static Map<String, Object> toCondition(ToolIOWhen condition, Method handler) {
-        Map<String, Object> entry = new LinkedHashMap<>();
-        entry.put("param", condition.param());
-        entry.put("matches", List.of(condition.matches()));
-        // The default the endpoint uses when this parameter is absent, so a step that never sends
-        // it still resolves. Omitted when the parameter is required with none.
-        ToolIOParameterDefaults.resolve(handler, condition.param())
-                .ifPresent(value -> entry.put("default", value));
-        return entry;
-    }
-
-    private static List<String> names(Enum<?>[] values) {
-        return Arrays.stream(values).map(Enum::name).toList();
-    }
-
-    private static String appendSummaryLine(String description, ToolIO declaration) {
-        String summary =
-                "Input:"
-                        + String.join("/", names(declaration.accepts()))
-                        + " Output:"
-                        + declaration.produces().name()
-                        + " Type:"
-                        + declaration.arity().name();
-        return description == null || description.isBlank()
-                ? summary
-                : description.trim() + " " + summary;
-    }
-}

app/common/src/main/java/stirling/software/common/configuration/RuntimePathConfig.java

@@ -73,7 +73,7 @@ public class RuntimePathConfig {
                         defaultWatchedFolders,
                         watchedFoldersDirs,
                         pipeline != null ? pipeline.getWatchedFoldersDir() : null);
-        this.pipelineWatchedFoldersPath = this.pipelineWatchedFoldersPaths.getFirst();
+        this.pipelineWatchedFoldersPath = this.pipelineWatchedFoldersPaths.get(0);
         this.pipelineFinishedFoldersPath =
                 resolvePath(
                         defaultFinishedFolders,

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -77,6 +77,7 @@ public class ApplicationProperties {
     private ProcessExecutor processExecutor = new ProcessExecutor();
     private PdfEditor pdfEditor = new PdfEditor();
     private AiEngine aiEngine = new AiEngine();
+    private Docparse docparse = new Docparse();
     private Mcp mcp = new Mcp();
     private InternalApi internalApi = new InternalApi();
     private Cluster cluster = new Cluster();
@@ -251,21 +252,6 @@ public class ApplicationProperties {
          */
         private boolean allowPrivateS3Endpoints = false;
 
-        /**
-         * Whether a network source's host (SFTP, FTP, or SMB) may resolve to a loopback,
-         * link-local, or private address. Off by default so a connection cannot be pointed at
-         * internal services; enable for an on-network file server (e.g. an internal SFTP drop or a
-         * Samba share).
-         */
-        private boolean allowPrivateNetworkSources = false;
-
-        /**
-         * Hostnames (exact, case-insensitive) that a network source may use even when they resolve
-         * to a private or local address and {@code allowPrivateNetworkSources} is off. Lets shared
-         * infra allow one named on-prem file server without opening every internal host.
-         */
-        private List<String> allowedPrivateNetworkHosts = new java.util.ArrayList<>();
-
         /**
          * Whether an API/Purview/ConsignO integration's base URL may resolve to a loopback,
          * link-local, or private address. Off by default: unlike S3 connections, any user may
@@ -440,6 +426,24 @@ public class ApplicationProperties {
         }
     }
 
+    /**
+     * DocParse settings (top-level {@code docparse.*}): document understanding for ingestion
+     * pipelines. The basic tier (text layer) always works; the advanced tier lives in the engine's
+     * docparse addon.
+     */
+    @Data
+    public static class Docparse {
+
+        /** Master switch; hides the DocParse endpoints when false. */
+        private boolean enabled = true;
+
+        /** Requested tier: 'auto', 'basic', or 'advanced'. 'auto' resolves per document. */
+        private String mode = "auto";
+
+        /** Mirrors DOCPARSE_AUTO_INSTALL for the engine's boot-time addon install script. */
+        private boolean autoInstall = false;
+    }
+
     /**
      * Model Context Protocol (MCP) server configuration. All keys live under the top-level {@code
      * mcp.*} prefix. {@link #enabled} defaults to {@code false}: when off, no MCP beans are wired,
@@ -1046,8 +1050,6 @@ public class ApplicationProperties {
 
         // 'https://app.example.com'). If not set, falls back to backendUrl.
         private boolean enableMobileScanner = true; // Enable mobile phone QR code upload feature
-        private boolean enableMobileSignature =
-                true; // Enable drawing signatures on a phone via QR code
         private MobileScannerSettings mobileScannerSettings = new MobileScannerSettings();
         private ServerCertificate serverCertificate = new ServerCertificate();
 
@@ -1093,27 +1095,6 @@ public class ApplicationProperties {
         private Quotas quotas = new Quotas();
         private Sharing sharing = new Sharing();
         private Signing signing = new Signing();
-        private Encryption encryption = new Encryption();
-
-        /**
-         * Encryption at rest for stored files (Pro/Enterprise). Enabling encrypts new writes;
-         * disabling later only stops encrypting new writes — existing encrypted files keep
-         * decrypting as long as the key material is present. The master key is resolved like the
-         * credential key: {@code stirling.security.fileEncryptionKey} property, {@code
-         * STIRLING_FILE_ENCRYPTION_KEY} env var, or an auto-generated {@code file-encryption.key}
-         * in the config directory.
-         */
-        @Data
-        public static class Encryption {
-            private boolean enabled = false;
-
-            /**
-             * Emit an audit event for every decrypt of an encrypted blob. Compliance reviewers
-             * (HIPAA) expect read audit, so it defaults on; busy multi-user installs can disable.
-             * Denied decrypts and key lifecycle events are always audited regardless.
-             */
-            private boolean auditReads = true;
-        }
 
         @Data
         public static class Local {
@@ -1316,7 +1297,7 @@ public class ApplicationProperties {
     public static class Ui {
         private String appNameNavbar;
         private List<String> languages;
-        private String logoStyle = "modern"; // Options: "modern" (default) or "classic"
+        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
         private boolean defaultHideUnavailableTools = false;
         private boolean defaultHideUnavailableConversions = false;
         private HideDisabledTools hideDisabledTools = new HideDisabledTools();
@@ -1327,10 +1308,10 @@ public class ApplicationProperties {
 
         public String getLogoStyle() {
             // Validate and return either "modern" or "classic"
-            if ("classic".equalsIgnoreCase(logoStyle)) {
-                return "classic";
+            if ("modern".equalsIgnoreCase(logoStyle)) {
+                return "modern";
             }
-            return "modern"; // default
+            return "classic"; // default
         }
 
         @Data

app/common/src/main/java/stirling/software/common/model/job/JobResult.java

@@ -52,13 +52,6 @@ public class JobResult {
     /** Key/value metadata that survives the write-through into the shared job store. */
     private final Map<String, String> metadata = new ConcurrentHashMap<>();
 
-    /**
-     * File ids of the persistent input copies made for this job. An async submit copies the upload
-     * into FileStorage so the job can still read it after the request returns; without tracking
-     * them here nothing would ever delete those copies.
-     */
-    @JsonIgnore private final List<String> inputFileIds = new CopyOnWriteArrayList<>();
-
     /**
      * Create a new JobResult with the given job ID
      *
@@ -174,22 +167,6 @@ public class JobResult {
         return Collections.unmodifiableList(notes);
     }
 
-    /** Record a persistent input copy so job cleanup deletes it alongside the results. */
-    public void addInputFileId(String fileId) {
-        if (fileId != null && !fileId.isBlank() && !inputFileIds.contains(fileId)) {
-            this.inputFileIds.add(fileId);
-        }
-    }
-
-    /**
-     * File ids of this job's persistent input copies.
-     *
-     * @return An unmodifiable view of the input file ids
-     */
-    public List<String> getInputFileIds() {
-        return Collections.unmodifiableList(inputFileIds);
-    }
-
     /** Attach a metadata value, e.g. a policy id so cluster peers can identify a policy run. */
     public void putMetadata(String key, String value) {
         if (key != null && value != null) {

app/common/src/main/java/stirling/software/common/model/oauth2/Provider.java

@@ -60,40 +60,54 @@ public class Provider {
     }
 
     private UsernameAttribute validateUsernameAttribute(UsernameAttribute usernameAttribute) {
-        return switch (name) {
-            case "google" -> validateGoogleUsernameAttribute(usernameAttribute);
-            case "github" -> validateGitHubUsernameAttribute(usernameAttribute);
-            case "keycloak" -> validateKeycloakUsernameAttribute(usernameAttribute);
-            default -> usernameAttribute;
-        };
+        switch (name) {
+            case "google" -> {
+                return validateGoogleUsernameAttribute(usernameAttribute);
+            }
+            case "github" -> {
+                return validateGitHubUsernameAttribute(usernameAttribute);
+            }
+            case "keycloak" -> {
+                return validateKeycloakUsernameAttribute(usernameAttribute);
+            }
+            default -> {
+                return usernameAttribute;
+            }
+        }
     }
 
     private UsernameAttribute validateKeycloakUsernameAttribute(
             UsernameAttribute usernameAttribute) {
-        return switch (usernameAttribute) {
-            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME, PREFERRED_USERNAME -> usernameAttribute;
+        switch (usernameAttribute) {
+            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME, PREFERRED_USERNAME -> {
+                return usernameAttribute;
+            }
             default ->
                     throw new UnsupportedClaimException(
                             String.format(EXCEPTION_MESSAGE, usernameAttribute, clientName));
-        };
+        }
     }
 
     private UsernameAttribute validateGoogleUsernameAttribute(UsernameAttribute usernameAttribute) {
-        return switch (usernameAttribute) {
-            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME -> usernameAttribute;
+        switch (usernameAttribute) {
+            case EMAIL, NAME, GIVEN_NAME, FAMILY_NAME -> {
+                return usernameAttribute;
+            }
             default ->
                     throw new UnsupportedClaimException(
                             String.format(EXCEPTION_MESSAGE, usernameAttribute, clientName));
-        };
+        }
     }
 
     private UsernameAttribute validateGitHubUsernameAttribute(UsernameAttribute usernameAttribute) {
-        return switch (usernameAttribute) {
-            case LOGIN, EMAIL, NAME -> usernameAttribute;
+        switch (usernameAttribute) {
+            case LOGIN, EMAIL, NAME -> {
+                return usernameAttribute;
+            }
             default ->
                     throw new UnsupportedClaimException(
                             String.format(EXCEPTION_MESSAGE, usernameAttribute, clientName));
-        };
+        }
     }
 
     @Override

app/common/src/main/java/stirling/software/common/model/tool/ToolArity.java

@@ -1,24 +0,0 @@
-package stirling.software.common.model.tool;
-
-/**
- * How many files an endpoint consumes and produces (Single/Multiple In, Single/Multiple Out).
- *
- * <p>This axis carries ZIP-as-transport: a multi-output endpoint returns its results zipped and the
- * caller unpacks them, so {@code split-pages} is {@code produces = PDF, arity = SIMO} rather than
- * naming a ZIP-of-PDF format. An endpoint whose deliverable really is an archive declares {@link
- * ToolFormat#ZIP} with a single-output arity and stays packed.
- */
-public enum ToolArity {
-    SISO,
-    SIMO,
-    MISO,
-    MIMO;
-
-    public boolean isMultiInput() {
-        return this == MISO || this == MIMO;
-    }
-
-    public boolean isMultiOutput() {
-        return this == SIMO || this == MIMO;
-    }
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolDiagnostic.java

@@ -1,47 +0,0 @@
-package stirling.software.common.model.tool;
-
-/**
- * One problem found while checking a chain, against the step that cannot run. {@code code} is
- * stable so the frontend can pick its own wording; {@code message} is an English fallback.
- */
-public record ToolDiagnostic(int stepIndex, Severity severity, String code, String message) {
-
-    public enum Severity {
-        /** The chain cannot run as configured. Only this should block a save. */
-        ERROR,
-        /** May not run, depending on configuration or file content. */
-        WARN,
-        /** Worth knowing but not a problem, such as a step running once per file. */
-        INFO
-    }
-
-    /** The step declares no {@link ToolIO}, so nothing past it can be checked. */
-    public static final String UNDECLARED = "undeclared-operation";
-
-    /** The previous step's output is not a format this step accepts. */
-    public static final String FORMAT_MISMATCH = "format-mismatch";
-
-    /** The previous step's output depends on a parameter that is not set yet. */
-    public static final String OUTPUT_UNCERTAIN = "output-uncertain";
-
-    /** The pipeline's input files are not a format the first step accepts. */
-    public static final String SOURCE_MISMATCH = "source-mismatch";
-
-    /** The previous step emits several files and this one runs once per file. */
-    public static final String FAN_OUT = "fan-out";
-
-    /** The previous step emits several files and this one consumes them in a single call. */
-    public static final String FAN_IN = "fan-in";
-
-    public static ToolDiagnostic error(int stepIndex, String code, String message) {
-        return new ToolDiagnostic(stepIndex, Severity.ERROR, code, message);
-    }
-
-    public static ToolDiagnostic warn(int stepIndex, String code, String message) {
-        return new ToolDiagnostic(stepIndex, Severity.WARN, code, message);
-    }
-
-    public static ToolDiagnostic info(int stepIndex, String code, String message) {
-        return new ToolDiagnostic(stepIndex, Severity.INFO, code, message);
-    }
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolFormat.java

@@ -1,62 +0,0 @@
-package stirling.software.common.model.tool;
-
-import java.util.List;
-
-import lombok.Getter;
-
-/**
- * The kind of file a tool endpoint consumes or produces.
- *
- * <p>Encryption is its own format rather than a separate attribute, so the endpoints accepting only
- * {@link #PDF} reject an encrypted one without declaring anything.
- *
- * <p>Extensions are a lossy projection used for run-time file checks: {@link #PDF} and {@link
- * #PDF_ENCRYPTED} share {@code pdf}, because a filename cannot tell you whether a PDF is encrypted.
- */
-@Getter
-public enum ToolFormat {
-    PDF("pdf"),
-    PDF_ENCRYPTED("pdf"),
-
-    // Vector formats are folded in: the extension set has always included svg/eps, and splitting
-    // them out would make chains that run fine today report as broken.
-    IMAGE("png", "jpg", "jpeg", "gif", "webp", "bmp", "tif", "tiff", "svg", "psd", "ai", "eps"),
-
-    /**
-     * An archive that is itself the deliverable. Multiple results use {@link ToolArity} instead.
-     */
-    ZIP("zip", "rar", "7z", "tar", "gz", "bz2", "xz", "lz", "lzma", "z"),
-
-    WORD("doc", "docx", "odt", "rtf"),
-    PPT("ppt", "pptx", "odp"),
-    EXCEL("xls", "xlsx", "ods"),
-    CSV("csv"),
-    HTML("html", "htm", "xhtml"),
-    XML("xml", "xsd", "xsl"),
-    JSON("json"),
-    TEXT("txt", "text", "md", "markdown"),
-    MARKDOWN("md", "markdown"),
-    JAVASCRIPT("js", "jsx"),
-    EBOOK("epub", "mobi", "azw3", "fb2", "txt", "docx"),
-    EMAIL("eml", "msg"),
-    POSTSCRIPT("ps", "eps"),
-
-    PCL("pcl", "pxl"),
-    XPS("xps", "oxps"),
-
-    VIDEO("mp4", "webm", "avi", "mov", "mkv"),
-    CBZ("cbz"),
-    CBR("cbr"),
-
-    /** Never reported as incompatible. */
-    ANY(),
-
-    /** A report or a status rather than a document. */
-    NONE();
-
-    private final List<String> extensions;
-
-    ToolFormat(String... extensions) {
-        this.extensions = List.of(extensions);
-    }
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolIO.java

@@ -1,30 +0,0 @@
-package stirling.software.common.model.tool;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * What a tool endpoint consumes and produces, so a chain of steps can be checked before it runs.
- *
- * <p>The single source of truth: read off the handler method by {@code ToolIORegistry}, published
- * into the OpenAPI spec as {@code x-stirling-io}, and generated from there into the frontend and
- * the AI engine.
- */
-@Target(ElementType.METHOD)
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface ToolIO {
-
-    /** Defaulting to a plain PDF is what makes an ordinary endpoint reject an encrypted one. */
-    ToolFormat[] accepts() default {ToolFormat.PDF};
-
-    ToolFormat produces();
-
-    ToolArity arity() default ToolArity.SISO;
-
-    /** Overrides for an output that depends on a parameter; first match wins. */
-    ToolIOCase[] cases() default {};
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolIOCase.java

@@ -1,22 +0,0 @@
-package stirling.software.common.model.tool;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-
-/**
- * An output that applies when every condition in {@link #when()} holds.
- *
- * <p>Conditions are ANDed because the interesting branches turn on more than one parameter: Add
- * Password only leaves the document unencrypted when both passwords are absent.
- */
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface ToolIOCase {
-
-    ToolIOWhen[] when();
-
-    ToolFormat produces();
-
-    ToolArity arity();
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolIOSource.java

@@ -1,19 +0,0 @@
-package stirling.software.common.model.tool;
-
-import java.util.Map;
-import java.util.Optional;
-
-/**
- * Supplies the {@link ToolIO} declaration for an endpoint path. An interface so a chain can be
- * checked against a fixed set of declarations without standing up an application context.
- */
-@FunctionalInterface
-public interface ToolIOSource {
-
-    Optional<ToolIOSpec> find(String operationPath);
-
-    static ToolIOSource of(Map<String, ToolIOSpec> specs) {
-        Map<String, ToolIOSpec> copy = Map.copyOf(specs);
-        return path -> Optional.ofNullable(copy.get(path));
-    }
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolIOSpec.java

@@ -1,134 +0,0 @@
-package stirling.software.common.model.tool;
-
-import java.util.Arrays;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-
-/** The runtime form of a {@link ToolIO} declaration, read off a handler method once at startup. */
-public record ToolIOSpec(
-        Set<ToolFormat> accepts, ToolFormat produces, ToolArity arity, List<Case> cases) {
-
-    /**
-     * @param paramDefault the value used when the parameter is absent, or null when it has no
-     *     default - an absent parameter then leaves the case unresolved rather than defaulted.
-     */
-    public record When(String param, List<String> matches, String paramDefault) {
-
-        boolean holdsFor(Object value) {
-            String normalised = normalise(value);
-            return matches.stream().anyMatch(match -> normalise(match).equals(normalised));
-        }
-    }
-
-    /** Supplies the default value a request parameter takes when a caller omits it. */
-    @FunctionalInterface
-    public interface ParameterDefaults {
-        Optional<String> defaultFor(String param);
-
-        ParameterDefaults NONE = param -> Optional.empty();
-    }
-
-    /**
-     * Both sides of a condition are normalised at comparison, not at construction: the declaration
-     * reaches the frontend and the engine as published data, and normalising only one side there
-     * would silently disagree with this one.
-     */
-    public static String normalise(Object value) {
-        return value == null ? "" : String.valueOf(value).trim().toLowerCase(Locale.ROOT);
-    }
-
-    public record Case(List<When> when, ToolFormat produces, ToolArity arity) {
-
-        public Case {
-            when = List.copyOf(when);
-        }
-    }
-
-    /** {@code certain} is false when a {@link Case} keys on a parameter whose value is unknown. */
-    public record Output(ToolFormat format, ToolArity arity, boolean certain) {}
-
-    public ToolIOSpec {
-        accepts = Set.copyOf(accepts);
-        cases = List.copyOf(cases);
-    }
-
-    public static ToolIOSpec from(ToolIO annotation) {
-        return from(annotation, ParameterDefaults.NONE);
-    }
-
-    public static ToolIOSpec from(ToolIO annotation, ParameterDefaults defaults) {
-        return new ToolIOSpec(
-                new LinkedHashSet<>(Arrays.asList(annotation.accepts())),
-                annotation.produces(),
-                annotation.arity(),
-                Arrays.stream(annotation.cases()).map(rule -> toCase(rule, defaults)).toList());
-    }
-
-    private static Case toCase(ToolIOCase rule, ParameterDefaults defaults) {
-        List<When> when = Arrays.stream(rule.when()).map(c -> toWhen(c, defaults)).toList();
-        return new Case(when, rule.produces(), rule.arity());
-    }
-
-    private static When toWhen(ToolIOWhen condition, ParameterDefaults defaults) {
-        return new When(
-                condition.param(),
-                List.of(condition.matches()),
-                defaults.defaultFor(condition.param()).orElse(null));
-    }
-
-    /**
-     * First matching {@link Case} wins. A parameter the caller omitted resolves to its declared
-     * default; only a parameter with no default leaves the output uncertain, since an unseen value
-     * might then have picked another branch.
-     *
-     * @param parameters the step's configured parameters, or null when not known
-     */
-    public Output resolveOutput(Map<String, Object> parameters) {
-        boolean sawUnknownParam = false;
-        for (Case rule : cases) {
-            boolean allHold = true;
-            for (When condition : rule.when()) {
-                Object value;
-                if (parameters != null && parameters.containsKey(condition.param())) {
-                    value = parameters.get(condition.param());
-                } else if (condition.paramDefault() != null) {
-                    value = condition.paramDefault();
-                } else {
-                    sawUnknownParam = true;
-                    allHold = false;
-                    continue;
-                }
-                allHold &= condition.holdsFor(value);
-            }
-            if (allHold) {
-                return new Output(rule.produces(), rule.arity(), true);
-            }
-        }
-        return new Output(produces, arity, !sawUnknownParam);
-    }
-
-    public Output resolveOutput() {
-        return resolveOutput(null);
-    }
-
-    public boolean acceptsFormat(ToolFormat format) {
-        return format == ToolFormat.ANY
-                || accepts.contains(ToolFormat.ANY)
-                || accepts.contains(format);
-    }
-
-    /** For run-time file checks. Empty means anything is accepted. */
-    public List<String> acceptedExtensions() {
-        if (accepts.contains(ToolFormat.ANY)) {
-            return List.of();
-        }
-        return accepts.stream()
-                .flatMap(format -> format.getExtensions().stream())
-                .distinct()
-                .toList();
-    }
-}

app/common/src/main/java/stirling/software/common/model/tool/ToolIOWhen.java

@@ -1,18 +0,0 @@
-package stirling.software.common.model.tool;
-
-import java.lang.annotation.Documented;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-
-/** One condition on a request parameter, guarding a {@link ToolIOCase}. */
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-public @interface ToolIOWhen {
-
-    String param();
-
-    /**
-     * Compared as strings, case-insensitively. An empty string matches an absent or blank value.
-     */
-    String[] matches();
-}

app/common/src/main/java/stirling/software/common/pdf/PdfMarkdownConverter.java

@@ -361,8 +361,8 @@ public class PdfMarkdownConverter {
         if (xs.isEmpty()) {
             return List.of(lines);
         }
-        float minX = xs.getFirst();
-        float maxX = xs.getLast();
+        float minX = xs.get(0);
+        float maxX = xs.get(xs.size() - 1);
         float splitAt = (minX + maxX) / 2f;
         float biggestGap = 0;
         for (int i = 1; i < xs.size(); i++) {
@@ -492,7 +492,7 @@ public class PdfMarkdownConverter {
 
         List<List<Line>> anchorGroups = new ArrayList<>();
         List<Line> current = new ArrayList<>();
-        current.add(cands.getFirst());
+        current.add(cands.get(0));
         for (int i = 1; i < cands.size(); i++) {
             float gap = cands.get(i - 1).y - cands.get(i).y;
             if (gap > splitThreshold) {
@@ -513,8 +513,8 @@ public class PdfMarkdownConverter {
             if (anchors.size() < 2) {
                 continue;
             }
-            float top = anchors.getFirst().y;
-            float bottom = anchors.getLast().y;
+            float top = anchors.get(0).y;
+            float bottom = anchors.get(anchors.size() - 1).y;
 
             // Each anchor seeds a row; absorb wrapped continuation lines (non-anchors within the
             // run's vertical span, with a little slack below the last row) into the anchor above.
@@ -674,8 +674,8 @@ public class PdfMarkdownConverter {
         float minGutter = Math.max(10f, charWidth * 2.5f);
         List<float[]> merged = new ArrayList<>();
         for (float[] band : columns) {
-            if (!merged.isEmpty() && band[0] - merged.getLast()[1] < minGutter) {
-                merged.getLast()[1] = band[1];
+            if (!merged.isEmpty() && band[0] - merged.get(merged.size() - 1)[1] < minGutter) {
+                merged.get(merged.size() - 1)[1] = band[1];
             } else {
                 merged.add(new float[] {band[0], band[1]});
             }
@@ -734,7 +734,7 @@ public class PdfMarkdownConverter {
             }
         }
         StringBuilder sb = new StringBuilder();
-        sb.append(buildGfmRow(rows.getFirst(), widths, cols)).append('\n');
+        sb.append(buildGfmRow(rows.get(0), widths, cols)).append('\n');
         sb.append('|');
         for (int c = 0; c < cols; c++) {
             sb.append('-').append("-".repeat(widths[c])).append('-').append('|');
@@ -910,8 +910,8 @@ public class PdfMarkdownConverter {
         }
         // Only merge a sentence continuation between two text paragraphs, never into/out of a
         // table.
-        if (!(output.getLast() instanceof String last)
-                || !(pageItems.getFirst() instanceof String first)) {
+        if (!(output.get(output.size() - 1) instanceof String last)
+                || !(pageItems.get(0) instanceof String first)) {
             return;
         }
         if (!first.isEmpty()
@@ -932,13 +932,13 @@ public class PdfMarkdownConverter {
         for (Object e : elements) {
             if (e instanceof TableBlock tb
                     && !out.isEmpty()
-                    && out.getLast() instanceof TableBlock prev
+                    && out.get(out.size() - 1) instanceof TableBlock prev
                     && columnsMatch(flatten(prev.rows()), flatten(tb.rows()))) {
                 List<List<Line>> merged = new ArrayList<>(prev.rows());
                 List<List<Line>> tail = tb.rows();
                 if (!tail.isEmpty()
                         && !prev.rows().isEmpty()
-                        && rowText(tail.getFirst()).equals(rowText(prev.rows().getFirst()))) {
+                        && rowText(tail.get(0)).equals(rowText(prev.rows().get(0)))) {
                     tail = tail.subList(1, tail.size());
                 }
                 merged.addAll(tail);
@@ -971,7 +971,7 @@ public class PdfMarkdownConverter {
                 continue;
             }
             if (e instanceof TableBlock tb && !tb.rows().isEmpty()) {
-                return rowText(tb.rows().getFirst());
+                return rowText(tb.rows().get(0));
             }
             return null;
         }
@@ -983,7 +983,7 @@ public class PdfMarkdownConverter {
         ordered.sort(Comparator.comparingDouble((Line l) -> l.y).reversed());
         StringBuilder sb = new StringBuilder();
         for (Line l : ordered) {
-            if (!sb.isEmpty()) {
+            if (sb.length() > 0) {
                 sb.append(' ');
             }
             sb.append(l.text);

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -17,6 +17,7 @@ import java.util.concurrent.Semaphore;
 import java.util.function.Consumer;
 
 import org.apache.pdfbox.Loader;
+import org.apache.pdfbox.examples.util.DeletingRandomAccessFile;
 import org.apache.pdfbox.io.IOUtils;
 import org.apache.pdfbox.io.MemoryUsageSetting;
 import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
@@ -30,7 +31,6 @@ import org.springframework.web.multipart.MultipartFile;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.api.PDFFile;
-import stirling.software.common.util.DeletingRandomAccessFile;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.TempFileManager;
 
@@ -729,32 +729,4 @@ public class CustomPDFDocumentFactory {
         p.toFile().deleteOnExit();
         return p;
     }
-
-    /** A custom RandomAccessRead implementation that deletes the file when closed */
-    private static class DeletingRandomAccessFile extends RandomAccessReadBufferedFile {
-        private final Path tempFilePath;
-
-        public DeletingRandomAccessFile(File file) throws IOException {
-            super(file);
-            this.tempFilePath = file.toPath();
-        }
-
-        @Override
-        public void close() throws IOException {
-            try {
-                super.close();
-            } finally {
-                try {
-                    boolean deleted = Files.deleteIfExists(tempFilePath);
-                    if (deleted) {
-                        log.info("Successfully deleted temp file: {}", tempFilePath);
-                    } else {
-                        log.warn("Failed to delete temp file (may not exist): {}", tempFilePath);
-                    }
-                } catch (IOException e) {
-                    log.error("Error deleting temp file: {}", tempFilePath, e);
-                }
-            }
-        }
-    }
 }