ui

Updated translations of latest additions,
Saintized lots of accented letters,
Brought consistency in formal addressing of the user

.dockerignore

@@ -0,0 +1,75 @@
+# Node modules and build artifacts
+node_modules
+frontend/node_modules
+frontend/dist
+frontend/build
+frontend/.vite
+frontend/.tauri
+frontend/src-tauri/target
+
+# Gradle build artifacts
+.gradle
+build
+bin
+target
+out
+
+# Git
+.git
+.gitignore
+
+# IDE
+.vscode
+.idea
+*.iml
+*.iws
+*.ipr
+
+# Logs
+*.log
+logs
+
+# Environment files
+.env
+.env.*
+!.env.example
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Java compiled files
+*.class
+*.jar
+*.war
+*.ear
+
+# Test reports
+test-results
+coverage
+
+# Docker
+docker-compose.override.yml
+.dockerignore
+
+# Temporary files
+tmp
+temp
+*.tmp
+*.swp
+*~
+
+# Runtime database and config files (locked by running app)
+app/core/configs/**
+stirling/**
+stirling-pdf-DB*.mv.db
+stirling-pdf-DB*.trace.db
+
+# Documentation
+*.md
+!README.md
+docs
+
+# CI/CD
+.github
+.gitlab-ci.yml

.github/config/dependency-review-config.yml

@@ -0,0 +1 @@
+allow-ghsas: GHSA-wrw7-89jp-8q8g

.github/scripts/check_language_properties.py

@@ -1,403 +0,0 @@
-"""
-Author: Ludy87
-Description: This script processes .properties files for localization checks. It compares translation files in a branch with
-a reference file to ensure consistency. The script performs two main checks:
-1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
-2. Ensures that all keys in the translation files are present in the reference file and vice versa.
-
-The script also provides functionality to update the translation files to match the reference file by adding missing keys and
-adjusting the format.
-
-Usage:
-    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
-"""
-# Sample for Windows:
-# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
-
-import copy
-import glob
-import os
-import argparse
-import re
-
-
-def find_duplicate_keys(file_path):
-    """
-    Identifies duplicate keys in a .properties file.
-    :param file_path: Path to the .properties file.
-    :return: List of tuples (key, first_occurrence_line, duplicate_line).
-    """
-    keys = {}
-    duplicates = []
-
-    with open(file_path, "r", encoding="utf-8") as file:
-        for line_number, line in enumerate(file, start=1):
-            stripped_line = line.strip()
-
-            # Skip empty lines and comments
-            if not stripped_line or stripped_line.startswith("#"):
-                continue
-
-            # Split the line into key and value
-            if "=" in stripped_line:
-                key, _ = stripped_line.split("=", 1)
-                key = key.strip()
-
-                # Check if the key already exists
-                if key in keys:
-                    duplicates.append((key, keys[key], line_number))
-                else:
-                    keys[key] = line_number
-
-    return duplicates
-
-
-# Maximum size for properties files (e.g., 200 KB)
-MAX_FILE_SIZE = 200 * 1024
-
-
-def parse_properties_file(file_path):
-    """
-    Parses a .properties file and returns a structured list of its contents.
-    :param file_path: Path to the .properties file.
-    :return: List of dictionaries representing each line in the file.
-    """
-    properties_list = []
-    with open(file_path, "r", encoding="utf-8") as file:
-        for line_number, line in enumerate(file, start=1):
-            stripped_line = line.strip()
-
-            # Handle empty lines
-            if not stripped_line:
-                properties_list.append(
-                    {"line_number": line_number, "type": "empty", "content": ""}
-                )
-                continue
-
-            # Handle comments
-            if stripped_line.startswith("#"):
-                properties_list.append(
-                    {
-                        "line_number": line_number,
-                        "type": "comment",
-                        "content": stripped_line,
-                    }
-                )
-                continue
-
-            # Handle key-value pairs
-            match = re.match(r"^([^=]+)=(.*)$", line)
-            if match:
-                key, value = match.groups()
-                properties_list.append(
-                    {
-                        "line_number": line_number,
-                        "type": "entry",
-                        "key": key.strip(),
-                        "value": value.strip(),
-                    }
-                )
-
-    return properties_list
-
-
-def write_json_file(file_path, updated_properties):
-    """
-    Writes updated properties back to the file in their original format.
-    :param file_path: Path to the .properties file.
-    :param updated_properties: List of updated properties to write.
-    """
-    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
-
-    # Sort lines by their numbers and retain comments and empty lines
-    all_lines = sorted(set(updated_lines.keys()))
-
-    original_format = []
-    for line in all_lines:
-        if line in updated_lines:
-            entry = updated_lines[line]
-        else:
-            entry = None
-        ref_entry = updated_lines[line]
-        if ref_entry["type"] in ["comment", "empty"]:
-            original_format.append(ref_entry)
-        elif entry is None:
-            # Add missing entries from the reference file
-            original_format.append(ref_entry)
-        elif entry["type"] == "entry":
-            # Replace entries with those from the current JSON
-            original_format.append(entry)
-
-    # Write the updated content back to the file
-    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
-        for entry in original_format:
-            if entry["type"] == "comment":
-                file.write(f"{entry['content']}\n")
-            elif entry["type"] == "empty":
-                file.write(f"{entry['content']}\n")
-            elif entry["type"] == "entry":
-                file.write(f"{entry['key']}={entry['value']}\n")
-
-
-def update_missing_keys(reference_file, file_list, branch=""):
-    """
-    Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference .properties file.
-    :param file_list: List of translation files to update.
-    :param branch: Branch where the files are located.
-    """
-    reference_properties = parse_properties_file(reference_file)
-    for file_path in file_list:
-        basename_current_file = os.path.basename(os.path.join(branch, file_path))
-        if (
-            basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".properties")
-            or not basename_current_file.startswith("messages_")
-        ):
-            continue
-
-        current_properties = parse_properties_file(os.path.join(branch, file_path))
-        updated_properties = []
-        for ref_entry in reference_properties:
-            ref_entry_copy = copy.deepcopy(ref_entry)
-            for current_entry in current_properties:
-                if current_entry["type"] == "entry":
-                    if ref_entry_copy["type"] != "entry":
-                        continue
-                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
-                        ref_entry_copy["value"] = current_entry["value"]
-            updated_properties.append(ref_entry_copy)
-        write_json_file(os.path.join(branch, file_path), updated_properties)
-
-
-def check_for_missing_keys(reference_file, file_list, branch):
-    update_missing_keys(reference_file, file_list, branch)
-
-
-def read_properties(file_path):
-    if os.path.isfile(file_path) and os.path.exists(file_path):
-        with open(file_path, "r", encoding="utf-8") as file:
-            return file.read().splitlines()
-    return [""]
-
-
-def check_for_differences(reference_file, file_list, branch, actor):
-    reference_branch = reference_file.split("/")[0]
-    basename_reference_file = os.path.basename(reference_file)
-
-    report = []
-    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_lines = read_properties(reference_file)
-    has_differences = False
-
-    only_reference_file = True
-
-    file_arr = file_list
-
-    if len(file_list) == 1:
-        file_arr = file_list[0].split()
-    base_dir = os.path.abspath(
-        os.path.join(os.getcwd(), "app", "core", "src", "main", "resources")
-    )
-
-    for file_path in file_arr:
-        file_normpath = os.path.normpath(file_path)
-        absolute_path = os.path.abspath(file_normpath)
-        # Verify that file is within the expected directory
-        if not absolute_path.startswith(base_dir):
-            raise ValueError(f"Unsafe file found: {file_normpath}")
-        # Verify file size before processing
-        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
-            raise ValueError(
-                f"The file {file_normpath} is too large and could pose a security risk."
-            )
-
-        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
-        if (
-            basename_current_file == basename_reference_file
-            or (
-                # only local windows command
-                not file_normpath.startswith(
-                    os.path.join(
-                        "", "app", "core", "src", "main", "resources", "messages_"
-                    )
-                )
-                and not file_normpath.startswith(
-                    os.path.join(
-                        os.getcwd(),
-                        "app",
-                        "core",
-                        "src",
-                        "main",
-                        "resources",
-                        "messages_",
-                    )
-                )
-            )
-            or not file_normpath.endswith(".properties")
-            or not basename_current_file.startswith("messages_")
-        ):
-            continue
-        only_reference_file = False
-        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
-        current_lines = read_properties(os.path.join(branch, file_path))
-        reference_line_count = len(reference_lines)
-        current_line_count = len(current_lines)
-
-        if reference_line_count != current_line_count:
-            report.append("")
-            report.append("1. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            has_differences = True
-            if reference_line_count > current_line_count:
-                report.append(
-                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
-                )
-            elif reference_line_count < current_line_count:
-                report.append(
-                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
-                )
-        else:
-            report.append("1. **Test Status:** ✅ **_Passed_**")
-
-        # Check for missing or extra keys
-        current_keys = []
-        reference_keys = []
-        for line in current_lines:
-            if not line.startswith("#") and line != "" and "=" in line:
-                key, _ = line.split("=", 1)
-                current_keys.append(key)
-        for line in reference_lines:
-            if not line.startswith("#") and line != "" and "=" in line:
-                key, _ = line.split("=", 1)
-                reference_keys.append(key)
-
-        current_keys_set = set(current_keys)
-        reference_keys_set = set(reference_keys)
-        missing_keys = current_keys_set.difference(reference_keys_set)
-        extra_keys = reference_keys_set.difference(current_keys_set)
-        missing_keys_list = list(missing_keys)
-        extra_keys_list = list(extra_keys)
-
-        if missing_keys_list or extra_keys_list:
-            has_differences = True
-            missing_keys_str = "`, `".join(missing_keys_list)
-            extra_keys_str = "`, `".join(extra_keys_list)
-            report.append("2. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            if missing_keys_list:
-                spaces_keys_list = []
-                for key in missing_keys_list:
-                    if " " in key:
-                        spaces_keys_list.append(key)
-                if spaces_keys_list:
-                    spaces_keys_str = "`, `".join(spaces_keys_list)
-                    report.append(
-                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
-                    )
-                report.append(
-                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
-                )
-            if extra_keys_list:
-                report.append(
-                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
-                )
-        else:
-            report.append("2. **Test Status:** ✅ **_Passed_**")
-
-        if find_duplicate_keys(os.path.join(branch, file_normpath)):
-            has_differences = True
-            output = "\n".join(
-                [
-                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
-                    for key, first, duplicate in find_duplicate_keys(
-                        os.path.join(branch, file_normpath)
-                    )
-                ]
-            )
-            report.append("3. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            report.append("    - duplicate entries were found:")
-            report.append(output)
-        else:
-            report.append("3. **Test Status:** ✅ **_Passed_**")
-
-        report.append("")
-        report.append("---")
-        report.append("")
-    if has_differences:
-        report.append("## ❌ Overall Check Status: **_Failed_**")
-        report.append("")
-        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/resources/messages_en_GB.properties)"
-        )
-    else:
-        report.append("## ✅ Overall Check Status: **_Success_**")
-        report.append("")
-        report.append(
-            f"Thanks @{actor} for your help in keeping the translations up to date."
-        )
-
-    if not only_reference_file:
-        print("\n".join(report))
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys")
-    parser.add_argument(
-        "--actor",
-        required=False,
-        help="Actor from PR.",
-    )
-    parser.add_argument(
-        "--reference-file",
-        required=True,
-        help="Path to the reference file.",
-    )
-    parser.add_argument(
-        "--branch",
-        type=str,
-        required=True,
-        help="Branch name.",
-    )
-    parser.add_argument(
-        "--check-file",
-        type=str,
-        required=False,
-        help="List of changed files, separated by spaces.",
-    )
-    parser.add_argument(
-        "--files",
-        nargs="+",
-        required=False,
-        help="List of changed files, separated by spaces.",
-    )
-    args = parser.parse_args()
-
-    # Sanitize --actor input to avoid injection attacks
-    if args.actor:
-        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
-
-    # Sanitize --branch input to avoid injection attacks
-    if args.branch:
-        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
-
-    file_list = args.files
-    if file_list is None:
-        if args.check_file:
-            file_list = [args.check_file]
-        else:
-            file_list = glob.glob(
-                os.path.join(
-                    os.getcwd(),
-                    "app",
-                    "core",
-                    "src",
-                    "main",
-                    "resources",
-                    "messages_*.properties",
-                )
-            )
-        update_missing_keys(args.reference_file, file_list)
-    else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_toml.py

@@ -1,6 +1,6 @@
 """
 Author: Ludy87
-Description: This script processes JSON translation files for localization checks. It compares translation files in a branch with
+Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
 a reference file to ensure consistency. The script performs two main checks:
 1. Verifies that the number of translation keys in the translation files matches the reference file.
 2. Ensures that all keys in the translation files are present in the reference file and vice versa.
@@ -9,10 +9,10 @@ The script also provides functionality to update the translation files to match
 adjusting the format.
 
 Usage:
-    python check_language_json.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
 # Sample for Windows:
-# python .github/scripts/check_language_json.py --reference-file frontend/public/locales/en-GB/translation.json --branch "" --files frontend/public/locales/de-DE/translation.json frontend/public/locales/fr-FR/translation.json
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
 
 import copy
 import glob
@@ -20,12 +20,14 @@ import os
 import argparse
 import re
 import json
+import tomllib  # Python 3.11+ (stdlib)
+import tomli_w  # For writing TOML files
 
 
 def find_duplicate_keys(file_path, keys=None, prefix=""):
     """
-    Identifies duplicate keys in a JSON file (including nested keys).
-    :param file_path: Path to the JSON file.
+    Identifies duplicate keys in a TOML file (including nested keys).
+    :param file_path: Path to the TOML file.
     :param keys: Dictionary to track keys (used for recursion).
     :param prefix: Prefix for nested keys.
     :return: List of tuples (key, first_occurrence_path, duplicate_path).
@@ -35,8 +37,9 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
 
     duplicates = []
 
-    with open(file_path, "r", encoding="utf-8") as file:
-        data = json.load(file)
+    # Load TOML file
+    with open(file_path, 'rb') as file:
+        data = tomllib.load(file)
 
     def process_dict(obj, current_prefix=""):
         for key, value in obj.items():
@@ -54,18 +57,18 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for JSON files (e.g., 500 KB)
+# Maximum size for TOML files (e.g., 500 KB)
 MAX_FILE_SIZE = 500 * 1024
 
 
-def parse_json_file(file_path):
+def parse_toml_file(file_path):
     """
-    Parses a JSON translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the JSON file.
+    Parses a TOML translation file and returns a flat dictionary of all keys.
+    :param file_path: Path to the TOML file.
     :return: Dictionary with flattened keys.
     """
-    with open(file_path, "r", encoding="utf-8") as file:
-        data = json.load(file)
+    with open(file_path, 'rb') as file:
+        data = tomllib.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
         items = {}
@@ -99,38 +102,37 @@ def unflatten_dict(d, sep="."):
     return result
 
 
-def write_json_file(file_path, updated_properties):
+def write_toml_file(file_path, updated_properties):
     """
-    Writes updated properties back to the JSON file.
-    :param file_path: Path to the JSON file.
+    Writes updated properties back to the TOML file.
+    :param file_path: Path to the TOML file.
     :param updated_properties: Dictionary of updated properties to write.
     """
     nested_data = unflatten_dict(updated_properties)
 
-    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
-        json.dump(nested_data, file, ensure_ascii=False, indent=2)
-        file.write("\n")  # Add trailing newline
+    with open(file_path, "wb") as file:
+        tomli_w.dump(nested_data, file)
 
 
 def update_missing_keys(reference_file, file_list, branch=""):
     """
     Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference JSON file.
+    :param reference_file: Path to the reference TOML file.
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_properties = parse_json_file(reference_file)
+    reference_properties = parse_toml_file(reference_file)
 
     for file_path in file_list:
         basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
             basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".json")
+            or not file_path.endswith(".toml")
             or not os.path.dirname(file_path).endswith("locales")
         ):
             continue
 
-        current_properties = parse_json_file(os.path.join(branch, file_path))
+        current_properties = parse_toml_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -141,16 +143,16 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_json_file(os.path.join(branch, file_path), updated_properties)
+        write_toml_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
     update_missing_keys(reference_file, file_list, branch)
 
 
-def read_json_keys(file_path):
+def read_toml_keys(file_path):
     if os.path.isfile(file_path) and os.path.exists(file_path):
-        return parse_json_file(file_path)
+        return parse_toml_file(file_path)
     return {}
 
 
@@ -160,7 +162,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_json_keys(reference_file)
+    reference_keys = read_toml_keys(reference_file)
     has_differences = False
 
     only_reference_file = True
@@ -197,12 +199,12 @@ def check_for_differences(reference_file, file_list, branch, actor):
         ):
             continue
 
-        if not file_normpath.endswith(".json") or basename_current_file != "translation.json":
+        if not file_normpath.endswith(".toml") or basename_current_file != "translation.toml":
             continue
 
         only_reference_file = False
         report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_json_keys(os.path.join(branch, file_path))
+        current_keys = read_toml_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -272,7 +274,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.json](https://github.com/Stirling-Tools/Stirling-PDF/blob/V2/frontend/public/locales/en-GB/translation.json)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -286,7 +288,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
     parser.add_argument(
         "--actor",
         required=False,
@@ -337,9 +339,9 @@ if __name__ == "__main__":
                     "public",
                     "locales",
                     "*",
-                    "translation.json",
+                    "translation.toml",
                 )
             )
         update_missing_keys(args.reference_file, file_list)
     else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -52,7 +52,6 @@ jobs:
             core.setOutput('repository', pr.head.repo.full_name);
             core.setOutput('ref', pr.head.ref);
             core.setOutput('is_fork', String(pr.head.repo.fork));
-            core.setOutput('base_ref', pr.base.ref);
             core.setOutput('author', pr.user.login);
             core.setOutput('state', pr.state);
 
@@ -65,10 +64,6 @@ jobs:
           IS_FORK: ${{ steps.resolve.outputs.is_fork }}
           # nur bei workflow_dispatch gesetzt:
           ALLOW_FORK_INPUT: ${{ inputs.allow_fork }}
-          # für Auto-PR-Logik:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
-          PR_BASE: ${{ steps.resolve.outputs.base_ref }}
           PR_AUTHOR: ${{ steps.resolve.outputs.author }}
         run: |
           set -e
@@ -87,16 +82,10 @@ jobs:
               fi
             fi
           else
-            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96")
+            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
             is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
-            if [ "$PR_BASE" = "V2" ] && [ "$is_auth" = true ]; then
+            if [ "$is_auth" = true ]; then
               should=true
-            else
-              title_has_v2=false; echo "$PR_TITLE" | grep -qiE 'v2|version.?2|version.?two' && title_has_v2=true
-              branch_has_kw=false; echo "$PR_BRANCH" | grep -qiE 'v2|react' && branch_has_kw=true
-              if [ "$is_auth" = true ] && { [ "$title_has_v2" = true ] || [ "$branch_has_kw" = true ]; }; then
-                should=true
-              fi
             fi
           fi
 
@@ -174,7 +163,7 @@ jobs:
               owner,
               repo,
               issue_number: prNumber,
-              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment triggered by V2/version2 keywords in the PR title or V2/React keywords in the branch name._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
+              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment for approved V2 contributors._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
             });
             return newComment.id;
 
@@ -306,8 +295,10 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
               environment:
-                DISABLE_ADDITIONAL_FEATURES: "true"
-                SECURITY_ENABLELOGIN: "false"
+                DISABLE_ADDITIONAL_FEATURES: "false"
+                SECURITY_ENABLELOGIN: "true"
+                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
+                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                 SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
@@ -392,7 +383,7 @@ jobs:
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                               `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
-                              `🔄 **Auto-deployed** because PR title or branch name contains V2/version2/React keywords.`;
+                              `🔄 **Auto-deployed** for approved V2 contributors.`;
 
             await github.rest.issues.createComment({
               owner,
@@ -498,4 +489,4 @@ jobs:
         if: always()
         run: |
           rm -f ../private.key
-        continue-on-error: true
+        continue-on-error: true

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -14,6 +14,7 @@ jobs:
     permissions:
       issues: write
     if: |
+      vars.CI_PROFILE != 'lite' &&
       github.event.issue.pull_request &&
       (
         contains(github.event.comment.body, 'prdeploy') ||
@@ -180,7 +181,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha

.github/workflows/build.yml

@@ -262,7 +262,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
+        include:
+          - docker-rev: docker/embedded/Dockerfile
+            artifact-suffix: Dockerfile
+          - docker-rev: docker/embedded/Dockerfile.ultra-lite
+            artifact-suffix: Dockerfile.ultra-lite
+          - docker-rev: docker/embedded/Dockerfile.fat
+            artifact-suffix: Dockerfile.fat
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -272,6 +278,13 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      - name: Free disk space on runner
+        run: |
+          echo "Disk space before cleanup:" && df -h
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
+          docker system prune -af || true
+          echo "Disk space after cleanup:" && df -h
+
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
@@ -301,7 +314,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/backend/${{ matrix.docker-rev }}
+          file: ./${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -313,7 +326,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: reports-docker-${{ matrix.docker-rev }}
+          name: reports-docker-${{ matrix.artifact-suffix }}
           path: |
             build/reports/tests/
             build/test-results/

.github/workflows/check_toml.yml

@@ -1,19 +1,14 @@
-name: Check Properties Files on PR
+name: Check TOML Translation Files on PR
+
+# This workflow validates TOML translation files
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
-      - "app/core/src/main/resources/messages_*.properties"
+      - "frontend/public/locales/*/translation.toml"
 
 # cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
   cancel-in-progress: true
@@ -73,22 +68,22 @@ jobs:
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
-                   # Check if PR number exists
-            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-              echo "Error: PR number is empty"
-              exit 1
-            fi
-            # Get changed files and filter for properties files, handle case where no matches are found
-            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
-            # Check if any files were found
-            if [ ! -s changed_files.txt ]; then
-              echo "No properties files changed in this PR"
-              echo "Workflow will exit early as no relevant files to check"
-              exit 0
-            fi
-            echo "Found $(wc -l < changed_files.txt) matching properties files"
+          # Check if PR number exists
+          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+            echo "Error: PR number is empty"
+            exit 1
+          fi
+          # Get changed files and filter for TOML translation files
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          # Check if any files were found
+          if [ ! -s changed_files.txt ]; then
+            echo "No TOML translation files changed in this PR"
+            echo "Workflow will exit early as no relevant files to check"
+            exit 0
+          fi
+          echo "Found $(wc -l < changed_files.txt) matching TOML files"
 
-      - name: Determine reference file test
+      - name: Determine reference file
         id: determine-file
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -125,11 +120,11 @@ jobs:
               pull_number: prNumber,
             });
 
-            // Filter for relevant files based on the PR changes
+            // Filter for relevant TOML files based on the PR changes
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^app\/core\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
+                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -169,16 +164,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("app/core/src/main/resources/messages_en_GB.properties")) {
+            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "app/core/src/main/resources/messages_en_GB.properties",
+                path: "frontend/public/locales/en-GB/translation.toml",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-messages_en_GB.properties";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -186,11 +181,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "app/core/src/main/resources/messages_en_GB.properties",
+                path: "frontend/public/locales/en-GB/translation.toml",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-messages_en_GB.properties";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -198,11 +193,20 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Python dependencies
+        run: |
+          pip install tomli-w
+
       - name: Run Python script to check files
         id: run-check
         run: |
-          echo "Running Python script to check files..."
-          python .github/scripts/check_language_properties.py \
+          echo "Running Python script to check TOML files..."
+          python .github/scripts/check_language_toml.py \
             --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
@@ -213,7 +217,7 @@ jobs:
         id: capture-output
         run: |
           if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Test, capturing output..."
+            echo "Capturing output..."
             SCRIPT_OUTPUT=$(cat result.txt)
             echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
             echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
@@ -227,7 +231,7 @@ jobs:
               echo "FAIL_JOB=false" >> $GITHUB_ENV
             fi
           else
-            echo "No update found."
+            echo "No output found."
             echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
             echo "FAIL_JOB=false" >> $GITHUB_ENV
           fi
@@ -249,7 +253,7 @@ jobs:
               issue_number: issueNumber
             });
 
-            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
+            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
 
             // Only update or create comments by the action user
             const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
@@ -260,7 +264,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 comment_id: comment.id,
-                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Updated existing comment.");
             } else if (!comment) {
@@ -269,7 +273,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 issue_number: issueNumber,
-                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Created new comment.");
             } else {
@@ -287,6 +291,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/dependency-review.yml

@@ -25,3 +25,5 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: "Dependency Review"
         uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
+        with:
+          config-file: './.github/config/dependency-review-config.yml'

.github/workflows/multiOSReleases.yml

@@ -1,4 +1,4 @@
-name: Test Installers Build
+name: Multi-OS Tauri Releases
 
 on:
   workflow_dispatch:
@@ -6,7 +6,23 @@ on:
       test_mode:
         description: "Run in test mode (skip release step)"
         required: false
-        default: "false"
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  push:
+    branches: [main, V2, V2-demo, V2-master]
   release:
     types: [created]
 
@@ -14,288 +30,501 @@ permissions:
   contents: read
 
 jobs:
-  read_versions:
+  determine-matrix:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
-      versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Set up JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          distribution: 'temurin'
-          java-version: '21'
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
 
-      # ✅ Get version from Gradle
       - name: Get version number
         id: versionNumber
         run: |
+          echo "Running gradlew printVersion..."
+          ./gradlew printVersion --quiet
           VERSION=$(./gradlew printVersion --quiet | tail -1)
+          echo "Extracted version: $VERSION"
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      # ✅ Get Mac-specific version from Gradle
-      - name: Get version number mac
-        id: versionNumberMac
+      - name: Determine build matrix
+        id: set-matrix
         run: |
-          VERSION_MAC=$(./gradlew printMacVersion --quiet | tail -1)
-          echo "versionNumberMac=$VERSION_MAC" >> $GITHUB_OUTPUT
-
-  build-portable:
-    needs: read_versions
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
-        run: ./gradlew clean createExe
-        env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Rename binaries
-        run: |
-          mkdir ./binaries
-          mv ./build/launch4j/Stirling-PDF.exe ./binaries/win-Stirling-PDF-portable-Server${{ matrix.file_suffix }}.exe
-          mv ./app/core/build/libs/stirling-pdf-${{ needs.read_versions.outputs.version }}.jar ./binaries/Stirling-PDF${{ matrix.file_suffix }}.jar
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          retention-days: 1
-          if-no-files-found: error
-          name: stirling${{ matrix.file_suffix }}-binaries
-          path: |
-            ./binaries/*
-
-  sign_verify-portable:
-    needs: [build-portable, read_versions]
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "with-login-"
-          - disable_security: true
-            file_suffix: ""
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: stirling-${{ matrix.file_suffix }}binaries
-
-      - name: Display structure of downloaded files
-        run: ls -R
-
-      - name: Upload signed artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          retention-days: 1
-          if-no-files-found: error
-          name: stirling-${{ matrix.file_suffix }}signed
-          path: |
-            ./*
-            !cosign.*
-
-  build-installers:
-    needs: read_versions
-    strategy:
-      matrix:
-        include:
-          - os: windows-latest
-            platform: win-
-          - os: macos-latest
-            platform: mac-
-          # - os: ubuntu-latest
-          #   platform: linux-
-    runs-on: ${{ matrix.os }}
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      # Install Windows dependencies
-      - name: Install WiX Toolset
-        if: matrix.os == 'windows-latest'
-        run: |
-          curl -L -o wix.exe https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314.exe
-          .\wix.exe /install /quiet
-
-      # Build installer
-      - name: Build Installer
-        run: ./gradlew build jpackage -x test --info
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: true
-          BROWSER_OPEN: true
-
-      - name: Set up JDK (x86_64)
-        if: matrix.os == 'macos-latest'
-        run: |
-          curl -L -o jdk.tar.gz https://cdn.azul.com/zulu/bin/zulu17.56.15-ca-jdk17.0.14-macosx_x64.tar.gz
-          mkdir -p zulu17
-          tar -xzf jdk.tar.gz -C zulu17 --strip-components=1
-          echo "JAVA_HOME=$PWD/zulu17" >> $GITHUB_ENV
-          echo "$PWD/zulu17/bin" >> $GITHUB_PATH
-
-      -   name: Verify JDK architecture
-          if: matrix.os == 'macos-latest'
-          run: file $JAVA_HOME/bin/java
-
-      -   name: Build project and run jpackage (x86_64)
-          if: matrix.os == 'macos-latest'
-          run: arch -x86_64 ./gradlew jpackageMacX64
-
-      # Rename and collect artifacts based on OS
-      - name: Prepare artifacts
-        id: prepare
-        shell: bash
-        run: |
-          ls -lah ./build/jpackage/
-          mkdir ./binaries
-          if [ "${{ matrix.os }}" = "windows-latest" ]; then
-            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.version }}.exe" "./binaries/Stirling-PDF-win-installer.exe"
-          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
-            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-installer.dmg"
-            mv "./build/jpackage/x86_64/Stirling PDF (x86_64)-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-x86_64-installer.dmg"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
           else
-            mv "./build/jpackage/stirling-pdf_${{ needs.read_versions.outputs.version }}-1_amd64.deb" "./binaries/Stirling-PDF-linux-installer.deb"
+            # For push/release events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
           fi
 
-      - name: Display structure of downloaded files
-        run: ls -R ./binaries
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          retention-days: 1
-          if-no-files-found: error
-          name: ${{ matrix.platform }}binaries
-          path: |
-            ./binaries/*
-
-  sign_verify:
-    needs: [read_versions, build-installers]
+  build-jars:
+    needs: determine-matrix
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        include:
-          - os: windows-latest
-            platform: win-
-          - os: macos-latest
-            platform: mac-
-          # - os: ubuntu-latest
-          #   platform: linux-
-    runs-on: ubuntu-latest
+        variant:
+          - name: "default"
+            disable_security: true
+            build_frontend: true
+            file_suffix: ""
+          - name: "with-login"
+            disable_security: false
+            build_frontend: true
+            file_suffix: "-with-login"
+          - name: "server-only"
+            disable_security: true
+            build_frontend: false
+            file_suffix: "-server"
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download build artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          name: ${{ matrix.platform }}binaries
+          java-version: "21"
+          distribution: "temurin"
 
-      - name: Display structure of downloaded files
-        run: ls -R
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
 
-      - name: Install Cosign
-        if: matrix.os == 'windows-latest'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+      - name: Setup Node.js
+        if: matrix.variant.build_frontend == true
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
 
-      - name: Generate key pair
-        if: matrix.os == 'windows-latest'
-        run: cosign generate-key-pair
+      - name: Build JAR
+        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Sign and generate attestations
-        if: matrix.os == 'windows-latest'
+      - name: Rename JAR
         run: |
-          cosign sign-blob \
-            --key ./cosign.key \
-            --yes \
-            --output-signature ./Stirling-PDF-win-installer.exe.sig \
-            ./Stirling-PDF-win-installer.exe
+          echo "Version from determine-matrix: ${{ needs.determine-matrix.outputs.version }}"
+          echo "Looking for: app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar"
+          ls -la app/core/build/libs/
+          mkdir -p ./jar-dist
+          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
 
-          cosign attest-blob \
-            --predicate - \
-            --key ./cosign.key \
-            --yes \
-            --output-attestation ./Stirling-PDF-win-installer.exe.intoto.jsonl \
-            ./Stirling-PDF-win-installer.exe
-
-          cosign verify-blob \
-            --key ./cosign.pub \
-            --signature ./Stirling-PDF-win-installer.exe.sig \
-            ./Stirling-PDF-win-installer.exe
-
-      - name: Display structure of downloaded files
-        run: ls -R
-
-      - name: Upload signed artifacts
+      - name: Upload JAR artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
+          name: jar${{ matrix.variant.file_suffix }}
+          path: ./jar-dist/*.jar
+          retention-days: 1
+
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on release or V2-master
+          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
           retention-days: 1
-          if-no-files-found: error
-          name: ${{ matrix.platform }}signed
-          path: |
-            ./Stirling-PDF-${{ matrix.platform }}installer.*
-            ./Stirling-PDF-${{ matrix.platform }}x86_64-installer.*
-            !cosign.*
 
   create-release:
-    if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_mode != 'true'
-    needs: [read_versions, sign_verify, sign_verify-portable]
+    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+    needs: [determine-matrix, build, build-jars]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -305,14 +534,43 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Download signed artifacts
+      - name: Download all Tauri artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: Stirling-PDF-*
+          path: ./artifacts/tauri
+
+      - name: Download JAR artifact (default)
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: jar
+          path: ./artifacts/jars
+
+      - name: Download JAR artifact (with login)
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: jar-with-login
+          path: ./artifacts/jars
+
+      - name: Download JAR artifact (server only)
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: jar-server
+          path: ./artifacts/jars
+
       - name: Display structure of downloaded files
-        run: ls -R
-      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+        run: ls -R ./artifacts
+
+      - name: Upload binaries to Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.read_versions.outputs.version }}
+          tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
           files: |
-            ./*signed/*
+            ./artifacts/**/*.jar
+            ./artifacts/**/*.msi
+            ./artifacts/**/*.dmg
+            ./artifacts/**/*.deb
+            ./artifacts/**/*.AppImage
+          draft: false
+          prerelease: false

.github/workflows/push-docker-v2.yml

@@ -0,0 +1,246 @@
+name: Push Docker Image - V2 Branch
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - V2-master
+      - alljavadocker
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-24.04-8core
+    permissions:
+      packages: write
+      id-token: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Get version number
+        id: versionNumber
+        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        with:
+          cosign-release: "v2.4.1"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+
+      - name: Generate tags for latest (V2-master branch - production)
+        id: meta
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Generate tags for latest (alljavadocker branch - test)
+        id: meta-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign regular images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --yes \
+              --key env://COSIGN_PRIVATE_KEY \
+              "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for latest-fat (V2-master branch - production)
+        id: meta-fat
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Generate tags for latest-fat (alljavadocker branch - test)
+        id: meta-fat-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Build and push Unified Dockerfile (fat variant)
+        id: build-push-fat
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.fat
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign fat images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite (V2-master branch - production)
+        id: meta-lite
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Generate tags for ultra-lite (alljavadocker branch - test)
+        id: meta-lite-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done

.github/workflows/push-docker.yml

@@ -24,6 +24,7 @@ permissions:
 
 jobs:
   push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -107,7 +108,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -152,7 +153,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./Dockerfile.ultra-lite
+          file: ./docker/embedded/Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -183,7 +184,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./Dockerfile.fat
+          file: ./docker/embedded/Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/releaseArtifacts.yml

@@ -2,85 +2,445 @@ name: Release Artifacts
 
 on:
   workflow_dispatch:
-  release:
-    types: [created]
+    inputs:
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  push:
+    branches: [main, V2, V2-demo]
 
 permissions:
   contents: read
 
 jobs:
-  build:
+  determine-matrix:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
     outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "17"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
-        run: ./gradlew clean createExe
-        env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
-          STIRLING_PDF_DESKTOP_UI: false
-
       - name: Get version number
         id: versionNumber
         run: |
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Rename binaries
+      - name: Determine build matrix
+        id: set-matrix
         run: |
-          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
-          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
+          else
+            # For push events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+          fi
 
-      - name: Debug build artifacts
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
         run: |
-          echo "Current Directory: $(pwd)"
-          ls -R ./build/libs
-          ls -R ./build/launch4j
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: binaries${{ matrix.file_suffix }}
-          path: |
-            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
-            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
+          retention-days: 30
 
   sign_verify:
     needs: build
     runs-on: ubuntu-latest
+    if: success()
     strategy:
+      fail-fast: false
       matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
+        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -90,7 +450,8 @@ jobs:
       - name: Download build artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: binaries${{ matrix.file_suffix }}
+          name: Stirling-PDF-${{ matrix.name }}
+
       - name: Display structure of downloaded files
         run: ls -R
 
@@ -101,80 +462,74 @@ jobs:
         run: cosign generate-key-pair
 
       - name: Sign and generate attestations
+        shell: bash
         run: |
-          cosign sign-blob \
-            --key ./cosign.key \
-            --yes \
-            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+          # Sign all artifacts for this platform
+          for file in *; do
+            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
+              echo "Signing: $file"
 
-          cosign attest-blob \
-            --predicate - \
-            --key ./cosign.key \
-            --yes \
-            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+              # Sign the artifact
+              cosign sign-blob \
+                --key ./cosign.key \
+                --yes \
+                --output-signature "${file}.sig" \
+                "$file"
 
-          cosign verify-blob \
-            --key ./cosign.pub \
-            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+              # Generate attestation
+              cosign attest-blob \
+                --predicate - \
+                --key ./cosign.key \
+                --yes \
+                --output-attestation "${file}.intoto.jsonl" \
+                "$file"
 
-          cosign sign-blob \
-            --key ./cosign.key \
-            --yes \
-            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+              # Verify the signature
+              cosign verify-blob \
+                --key ./cosign.pub \
+                --signature "${file}.sig" \
+                "$file"
 
-          cosign attest-blob \
-            --predicate - \
-            --key ./cosign.key \
-            --yes \
-            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
-
-          cosign verify-blob \
-            --key ./cosign.pub \
-            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+              echo "✅ Signed and verified: $file"
+            fi
+          done
 
       - name: Upload signed artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: signed${{ matrix.file_suffix }}
+          name: Stirling-PDF-${{ matrix.name }}-signed
           path: |
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            *
+            !cosign.key
+            !cosign.pub
+          retention-days: 30
 
   release:
-    needs: [build, sign_verify]
+    needs: [determine-matrix, build, sign_verify]
     runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     permissions:
       contents: write
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download signed artifacts
+      - name: Download all signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: signed${{ matrix.file_suffix }}
+          pattern: Stirling-PDF-*-signed
+          path: ./artifacts
 
-      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+      - name: Display structure of downloaded files
+        run: ls -R ./artifacts
+
+      - name: Create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.build.outputs.version }}
+          tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
-          files: |
-            ./libs/Stirling-PDF*
-            ./launch4j/Stirling-PDF-Server*
+          files: ./artifacts/**/*
+          draft: false
+          prerelease: false

.github/workflows/scorecards.yml

@@ -17,6 +17,7 @@ permissions: read-all
 
 jobs:
   analysis:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:

.github/workflows/sonarqube.yml

@@ -27,6 +27,7 @@ permissions:
 
 jobs:
   sonarqube:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/stale.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   stale:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/swagger.yml

@@ -23,6 +23,7 @@ permissions:
 
 jobs:
   push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/sync_files.yml

@@ -1,122 +0,0 @@
-name: Sync Files
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - "build.gradle"
-      - "README.md"
-      - "app/core/src/main/resources/messages_*.properties"
-      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
-      - "scripts/ignore_translation.toml"
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  sync-files:
-    runs-on: ubuntu-latest
-    env:
-      # Prevents sdist builds → no tar extraction
-      PIP_ONLY_BINARY: ":all:"
-      PIP_DISABLE_PIP_VERSION_CHECK: "1"
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-
-      - name: Sync translation property files
-        run: |
-          python .github/scripts/check_language_properties.py --reference-file "app/core/src/main/resources/messages_en_GB.properties" --branch main
-
-      - name: Commit translation files
-        run: |
-          git add app/core/src/main/resources/messages_*.properties
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
-
-      - name: Install dependencies
-        # Wheels-only + Hash-Pinning
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Sync README.md
-        run: |
-          python scripts/counter_translation.py
-
-      - name: Run git add
-        run: |
-          git add README.md scripts/ignore_translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
-
-      - name: Create Pull Request
-        if: always()
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: Update files
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: sync_readme
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
-          body: |
-            ### Description of Changes
-
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
-
-            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
-            - Ensured consistency and synchronization across all supported language files.
-            - Highlighted any missing or incomplete translations.
-
-            #### **2. Update README.md**
-            - Generated the translation progress table in `README.md`.
-            - Added a summary of the current translation status for all supported languages.
-            - Included up-to-date statistics on translation coverage.
-
-            #### **Why these changes are necessary**
-            - Keeps translation files aligned with the latest reference updates.
-            - Ensures the documentation reflects the current translation progress.
-
-            ---
-
-            Auto-generated by [create-pull-request][1].
-
-            [1]: https://github.com/peter-evans/create-pull-request
-          draft: false
-          delete-branch: true
-          labels: github-actions
-          sign-commits: true
-          add-paths: |
-            README.md
-            app/core/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,15 +1,15 @@
-name: Sync Files V2
+name: Sync Files (TOML)
 
 on:
   workflow_dispatch:
   push:
     branches:
-      - V2
+      - main
       - syncLangTest
     paths:
       - "build.gradle"
       - "README.md"
-      - "frontend/public/locales/*/translation.json"
+      - "frontend/public/locales/*/translation.toml"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
       - "scripts/ignore_translation.toml"
 
@@ -52,21 +52,25 @@ jobs:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
-      - name: Sync translation JSON files
+      - name: Install Python dependencies
         run: |
-          python .github/scripts/check_language_json.py --reference-file "frontend/public/locales/en-GB/translation.json" --branch V2
+          pip install tomli-w
+
+      - name: Sync translation TOML files
+        run: |
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
 
       - name: Commit translation files
         run: |
-          git add frontend/public/locales/*/translation.json
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+          git add frontend/public/locales/*/translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
 
-      - name: Install dependencies
+      - name: Install README dependencies
         run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Sync README.md
         run: |
-          python scripts/counter_translation_v2.py
+          python scripts/counter_translation_v3.py
 
       - name: Run git add
         run: |
@@ -82,21 +86,22 @@ jobs:
           committer: ${{ steps.setup-bot.outputs.committer }}
           author: ${{ steps.setup-bot.outputs.committer }}
           signoff: true
-          branch: sync_readme_v2
-          base: V2
-          title: ":globe_with_meridians: [V2] Sync Translations + Update README Progress Table"
+          branch: sync_readme_v3
+          base: main
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
           body: |
             ### Description of Changes
 
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation for the **V2 branch**. Below are the details of the changes made:
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.json`) to reflect changes in the reference file `en-GB/translation.json`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
+            - **Format**: TOML
 
             #### **2. Update README.md**
-            - Generated the translation progress table in `README.md`.
+            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
             - Added a summary of the current translation status for all supported languages.
             - Included up-to-date statistics on translation coverage.
 
@@ -115,4 +120,5 @@ jobs:
           sign-commits: true
           add-paths: |
             README.md
-            frontend/public/locales/*/translation.json
+            frontend/public/locales/*/translation.toml
+            scripts/ignore_translation.toml

.github/workflows/tauri-build.yml

@@ -0,0 +1,646 @@
+name: Build Tauri Applications
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  pull_request:
+    branches: [main, V2, V2-tauri-windows]
+    paths:
+      - 'frontend/src-tauri/**'
+      - 'frontend/src/desktop/**'
+      - 'frontend/tsconfig.desktop.json'
+      - '.github/workflows/tauri-build.yml'
+  push:
+    branches: [main, V2]
+
+permissions:
+  contents: read
+
+jobs:
+  determine-matrix:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Determine build matrix
+        id: set-matrix
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
+          else
+            # For PR/push events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+          fi
+
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          # STIRLING_PDF_DESKTOP_UI=false ./gradlew clean bootJar --no-daemon
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+          
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+          
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+          
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+          
+          # Create custom JRE with jlink (always rebuild)
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+          
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+          
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+          
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+          
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+          
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Check DMG creation dependencies (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
+          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
+          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
+          echo "Available disk space: $(df -h /tmp | tail -1)"
+          echo "macOS version: $(sw_vers -productVersion)"
+          echo "Available tools:"
+          ls -la /usr/bin/hd* || echo "No hd* tools found"
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Verify notarization (macOS only)
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "🔍 Verifying notarization status..."
+          cd ./frontend/src-tauri/target
+          DMG_FILE=$(find . -name "*.dmg" | head -1)
+          if [ -n "$DMG_FILE" ]; then
+            echo "Found DMG: $DMG_FILE"
+            echo "Checking notarization ticket..."
+            spctl -a -vvv -t install "$DMG_FILE" || echo "⚠️ Notarization check failed or not yet complete"
+            stapler validate "$DMG_FILE" || echo "⚠️ No notarization ticket attached"
+          else
+            echo "⚠️ No DMG file found to verify"
+          fi
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
+
+      - name: Verify Windows Code Signature
+        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
+        shell: pwsh
+        run: |
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
+          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
+
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
+
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] EXE is properly signed"
+            }
+          }
+
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
+            exit 1
+          } else {
+            Write-Host "[SUCCESS] Code signature verification completed"
+          }
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
+          retention-days: 7
+ 
+      - name: Verify build artifacts
+        shell: bash
+        run: |
+          cd ./frontend/src-tauri/target
+
+          # Check for expected artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            echo "Checking for Windows artifacts..."
+            find . -name "*.exe" -o -name "*.msi" | head -5
+            if [ $(find . -name "*.exe" | wc -l) -eq 0 ]; then
+              echo "❌ No Windows executable found"
+              exit 1
+            fi
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            echo "Checking for macOS artifacts..."
+            find . -name "*.dmg" -o -name "*.app" | head -5
+            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
+              echo "❌ No macOS artifacts found"
+              exit 1
+            fi
+          else
+            echo "Checking for Linux artifacts..."
+            find . -name "*.deb" -o -name "*.AppImage" | head -5
+            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
+              echo "❌ No Linux artifacts found"
+              exit 1
+            fi
+          fi
+
+          echo "✅ Build artifacts found for ${{ matrix.name }}"
+
+      - name: Test artifact sizes
+        shell: bash
+        run: |
+          cd ./frontend/src-tauri/target
+          echo "Artifact sizes for ${{ matrix.name }}:"
+          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
+            if [ -f "$file" ]; then
+              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
+              echo "$file: $size bytes"
+              # Check if file is suspiciously small (less than 1MB)
+              if [ "$size" != "unknown" ] && [ "$size" -lt 1048576 ]; then
+                echo "⚠️  Warning: $file is smaller than 1MB"
+              fi
+            fi
+          done
+
+  report:
+    needs: build
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Report build results
+        run: |
+          if [ "${{ needs.build.result }}" = "success" ]; then
+            echo "✅ All Tauri builds completed successfully!"
+            echo "Artifacts are ready for distribution."
+          elif [ "${{ needs.build.result }}" = "skipped" ]; then
+            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
+          else
+            echo "❌ Some Tauri builds failed."
+            echo "Please check the logs and fix any issues."
+            exit 1
+          fi

.github/workflows/testdriver.yml

@@ -21,6 +21,7 @@ permissions:
 
 jobs:
   deploy:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -66,7 +67,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

.gitignore

@@ -17,8 +17,8 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/watchedFolders/
-pipeline/finishedFolders/
+pipeline/
+!pipeline/.gitkeep
 customFiles/
 configs/
 watchedFolders/
@@ -31,8 +31,23 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json
 
+# Frontend build artifacts copied to backend static resources
+# These are generated by npm build and should not be committed
+app/core/src/main/resources/static/assets/
+app/core/src/main/resources/static/index.html
+app/core/src/main/resources/static/locales/
+app/core/src/main/resources/static/Login/
+app/core/src/main/resources/static/classic-logo/
+app/core/src/main/resources/static/modern-logo/
+app/core/src/main/resources/static/og_images/
+app/core/src/main/resources/static/samples/
+app/core/src/main/resources/static/manifest-classic.json
+app/core/src/main/resources/static/robots.txt
+# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
+
 # Gradle
 .gradle
+.gradle-home
 .lock
 
 # External tool builders
@@ -213,3 +228,17 @@ node_modules/
 test_batch.json
 *.backup.*.json
 frontend/public/locales/*/translation.backup*.json
+
+# Development/build artifacts
+.gradle-cache/
+scripts/pdf-collection/
+**/tmp/
+*.backup
+
+# Type3 development data
+docs/type3/signatures/
+
+
+# Type3 sample PDFs (development only)
+**/type3/samples/
+

ADDING_TOOLS.md

@@ -202,10 +202,10 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-GB/translation.json`
+**File to update:** `frontend/public/locales/en-GB/translation.toml`
 
 **Required Translation Keys**:
-```json
+```toml
 {
   "home": {
     "[toolName]": {
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-GB/translation.json`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

DeveloperGuide.md

@@ -32,6 +32,12 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Docker for containerization
 - Gradle for build management
 
+**Desktop Application (Tauri):**
+- Tauri for cross-platform desktop app packaging
+- Rust backend for system integration
+- PDF file association support
+- Self-contained JRE bundling with JLink
+
 **Legacy (reference only during development):**
 - Thymeleaf templates (being completely replaced in 2.0)
 
@@ -44,6 +50,8 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Java JDK 17 or later (JDK 21 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
+- Rust and Cargo (required for Tauri desktop app development)
+- Tauri CLI (install with `cargo install tauri-cli`)
 
 ### Setup Steps
 
@@ -95,6 +103,10 @@ Stirling 2.0 uses client-side file storage:
 ### Legacy Code Reference
 The existing Thymeleaf templates remain in the codebase during development as reference material but will be completely removed for the 2.0 release.
 
+### Tauri Desktop App Development
+Stirling-PDF can be packaged as a cross-platform desktop application using Tauri with PDF file association support and bundled JRE.
+See [the frontend README](frontend/README.md#tauri) for build instructions.
+
 ## 5. Project Structure
 
 ```bash
@@ -109,6 +121,12 @@ Stirling-PDF/
 │   │   ├── services/      # API and utility services
 │   │   ├── types/         # TypeScript type definitions
 │   │   └── utils/         # Utility functions
+│   ├── src-tauri/         # Tauri desktop app configuration
+│   │   ├── src/           # Rust backend code
+│   │   ├── libs/          # JAR files (generated by build scripts)
+│   │   ├── runtime/       # Bundled JRE (generated by build scripts)
+│   │   ├── Cargo.toml     # Rust dependencies
+│   │   └── tauri.conf.json # Tauri configuration
 │   ├── public/
 │   │   └── locales/       # Internationalization files (JSON)
 │   ├── package.json       # Frontend dependencies
@@ -392,23 +410,23 @@ For Stirling 2.0, new features are built as React components instead of Thymelea
    // frontend/src/tools/NewTool.tsx
    import { useState } from 'react';
    import { Button, FileInput, Container } from '@mantine/core';
-   
+
    interface NewToolProps {
      params: Record<string, any>;
      updateParams: (updates: Record<string, any>) => void;
    }
-   
+
    export default function NewTool({ params, updateParams }: NewToolProps) {
      const [files, setFiles] = useState<File[]>([]);
-     
+
      const handleProcess = async () => {
        // Process files using API or client-side logic
      };
-     
+
      return (
        <Container>
-         <FileInput 
-           multiple 
+         <FileInput
+           multiple
            accept="application/pdf"
            onChange={setFiles}
          />

LICENSE

@@ -6,6 +6,10 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
+* All content that resides under the "frontend/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
+* All content that resides under the "frontend/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

README.md

@@ -1,173 +1,69 @@
-<p align="center"><img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80"></p>
-<h1 align="center">Stirling-PDF</h1>
+<p align="center">
+  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
+</p>
 
-[![Docker Pulls](https://img.shields.io/docker/pulls/frooodle/s-pdf)](https://hub.docker.com/r/frooodle/s-pdf)
-[![Discord](https://img.shields.io/discord/1068636748814483718?label=Discord)](https://discord.gg/HYmhKj45pU)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge)](https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF)
-[![GitHub Repo stars](https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social)](https://github.com/Stirling-Tools/stirling-pdf)
+<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
 
-<a href="https://www.producthunt.com/posts/stirling-pdf?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-stirling&#0045;pdf" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=641239&theme=light" alt="Stirling&#0032;PDF - Open&#0032;source&#0032;locally&#0032;hosted&#0032;web&#0032;PDF&#0032;editor | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
-[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/apps/new?repo=https://github.com/Stirling-Tools/Stirling-PDF/tree/digitalOcean&refcode=c3210994b1af)
+Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
 
-[Stirling-PDF](https://www.stirlingpdf.com) is a robust, locally hosted web-based PDF manipulation tool using Docker. It enables you to carry out various operations on PDF files, including splitting, merging, converting, reorganizing, adding images, rotating, compressing, and more. This locally hosted web application has evolved to encompass a comprehensive set of features, addressing all your PDF requirements.
+<p align="center">
+  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
+    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
+  </a>
+  <a href="https://discord.gg/HYmhKj45pU">
+    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
+  </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
+    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
+  </a>
+  <a href="https://github.com/Stirling-Tools/stirling-pdf">
+    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
+  </a>
+</p>
 
-All files and PDFs exist either exclusively on the client side, reside in server memory only during task execution, or temporarily reside in a file solely for the execution of the task. Any file downloaded by the user will have been deleted from the server by that point.
+![Stirling PDF - Dashboard](images/home-light.png)
 
-Homepage: [https://stirlingpdf.com](https://stirlingpdf.com)
+## Key Capabilities
 
-All documentation available at [https://docs.stirlingpdf.com/](https://docs.stirlingpdf.com/)
+- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
+- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
+- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
+- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
+- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
+- **Global UI** - Interface available in 40+ languages.
 
-![stirling-home](images/stirling-home.jpg)
+For a full feature list, see the docs: **https://docs.stirlingpdf.com**
 
-## Features
+## Quick Start
 
-- 50+ PDF Operations
-- Parallel file processing and downloads
-- Dark mode support
-- Custom download options
-- Custom 'Pipelines' to run multiple features in a automated queue
-- API for integration with external scripts
-- Optional Login and Authentication support (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/System%20and%20Security) for documentation)
-- Database Backup and Import (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/DATABASE) for documentation)
-- Enterprise features like SSO (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/Single%20Sign-On%20Configuration) for documentation)
+```bash
+docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
+```
 
-## PDF Features
+Then open: http://localhost:8080
 
-### Page Operations
+For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
 
-- View and modify PDFs - View multi-page PDFs with custom viewing, sorting, and searching. Plus, on-page edit features like annotating, drawing, and adding text and images. (Using PDF.js with Joxit and Liberation fonts)
-- Full interactive GUI for merging/splitting/rotating/moving PDFs and their pages
-- Merge multiple PDFs into a single resultant file
-- Split PDFs into multiple files at specified page numbers or extract all pages as individual files
-- Reorganize PDF pages into different orders
-- Rotate PDFs in 90-degree increments
-- Remove pages
-- Multi-page layout (format PDFs into a multi-paged page)
-- Scale page contents size by set percentage
-- Adjust contrast
-- Crop PDF
-- Auto-split PDF (with physically scanned page dividers)
-- Extract page(s)
-- Convert PDF to a single page
-- Overlay PDFs on top of each other
-- PDF to a single page
-- Split PDF by sections
+## Resources
 
-### Conversion Operations
+- [**Documentation**](https://docs.stirlingpdf.com)
+- [**Homepage**](https://stirling.com)
+- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
+- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
 
-- Convert PDFs to and from images
-- Convert any common file to PDF (using LibreOffice)
-- Convert PDF to Word/PowerPoint/others (using LibreOffice)
-- Convert HTML to PDF
-- Convert PDF to XML
-- Convert PDF to CSV
-- URL to PDF
-- Markdown to PDF
+## Support
 
-### Security & Permissions
+- **Community** [Discord](https://discord.gg/HYmhKj45pU)
+- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
 
-- Add and remove passwords
-- Change/set PDF permissions
-- Add watermark(s)
-- Certify/sign PDFs
-- Sanitize PDFs
-- Auto-redact text
+## Contributing
 
-### Other Operations
+We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
-- Add/generate/write signatures
-- Split by Size or PDF
-- Repair PDFs
-- Detect and remove blank pages
-- Compare two PDFs and show differences in text
-- Add images to PDFs
-- Compress PDFs to decrease their filesize (using qpdf)
-- Extract images from PDF
-- Remove images from PDF
-- Extract images from scans
-- Remove annotations
-- Add page numbers
-- Auto-rename files by detecting PDF header text
-- OCR on PDF (using Tesseract OCR)
-- PDF/A conversion (using LibreOffice)
-- Edit metadata
-- Flatten PDFs
-- Get all information on a PDF to view or export as JSON
-- Show/detect embedded JavaScript
+For development setup, see the [Developer Guide](DeveloperGuide.md).
 
+For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
 
+## License
 
-# 📖 Get Started
-
-Visit our comprehensive documentation at [docs.stirlingpdf.com](https://docs.stirlingpdf.com) for:
-
-- Installation guides for all platforms
-- Configuration options
-- Feature documentation
-- API reference
-- Security setup
-- Enterprise features
-
-
-## Supported Languages
-
-Stirling-PDF currently supports 40 languages!
-
-| Language                                     | Progress                               |
-| -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![83%](https://geps.dev/progress/83)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![32%](https://geps.dev/progress/32)   |
-| Basque (Euskara) (eu_ES)                     | ![18%](https://geps.dev/progress/18)   |
-| Bulgarian (Български) (bg_BG)                | ![35%](https://geps.dev/progress/35)   |
-| Catalan (Català) (ca_CA)                     | ![34%](https://geps.dev/progress/34)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![31%](https://geps.dev/progress/31)   |
-| Czech (Česky) (cs_CZ)                        | ![34%](https://geps.dev/progress/34)   |
-| Danish (Dansk) (da_DK)                       | ![30%](https://geps.dev/progress/30)   |
-| Dutch (Nederlands) (nl_NL)                   | ![30%](https://geps.dev/progress/30)   |
-| English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
-| English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![82%](https://geps.dev/progress/82)   |
-| German (Deutsch) (de_DE)                     | ![84%](https://geps.dev/progress/84)   |
-| Greek (Ελληνικά) (el_GR)                     | ![34%](https://geps.dev/progress/34)   |
-| Hindi (हिंदी) (hi_IN)                          | ![34%](https://geps.dev/progress/34)   |
-| Hungarian (Magyar) (hu_HU)                   | ![38%](https://geps.dev/progress/38)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![31%](https://geps.dev/progress/31)   |
-| Irish (Gaeilge) (ga_IE)                      | ![34%](https://geps.dev/progress/34)   |
-| Italian (Italiano) (it_IT)                   | ![84%](https://geps.dev/progress/84)   |
-| Japanese (日本語) (ja_JP)                    | ![62%](https://geps.dev/progress/62)   |
-| Korean (한국어) (ko_KR)                      | ![34%](https://geps.dev/progress/34)   |
-| Norwegian (Norsk) (no_NB)                    | ![32%](https://geps.dev/progress/32)   |
-| Persian (فارسی) (fa_IR)                      | ![34%](https://geps.dev/progress/34)   |
-| Polish (Polski) (pl_PL)                      | ![36%](https://geps.dev/progress/36)   |
-| Portuguese (Português) (pt_PT)               | ![34%](https://geps.dev/progress/34)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![83%](https://geps.dev/progress/83)   |
-| Romanian (Română) (ro_RO)                    | ![28%](https://geps.dev/progress/28)   |
-| Russian (Русский) (ru_RU)                    | ![83%](https://geps.dev/progress/83)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![37%](https://geps.dev/progress/37)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![85%](https://geps.dev/progress/85)   |
-| Slovakian (Slovensky) (sk_SK)                | ![26%](https://geps.dev/progress/26)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![36%](https://geps.dev/progress/36)   |
-| Spanish (Español) (es_ES)                    | ![84%](https://geps.dev/progress/84)   |
-| Swedish (Svenska) (sv_SE)                    | ![33%](https://geps.dev/progress/33)   |
-| Thai (ไทย) (th_TH)                           | ![31%](https://geps.dev/progress/31)   |
-| Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![38%](https://geps.dev/progress/38)   |
-| Turkish (Türkçe) (tr_TR)                     | ![37%](https://geps.dev/progress/37)   |
-| Ukrainian (Українська) (uk_UA)               | ![36%](https://geps.dev/progress/36)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![28%](https://geps.dev/progress/28)   |
-| Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
-
-## Stirling PDF Enterprise
-
-Stirling PDF offers an Enterprise edition of its software. This is the same great software but with added features, support and comforts.
-Check out our [Enterprise docs](https://docs.stirlingpdf.com/Pro)
-
-
-## 🤝 Looking to contribute?
-
-Join our community:
-- [Contribution Guidelines](CONTRIBUTING.md)
-- [Translation Guide (How to add custom languages)](devGuide/HowToAddNewLanguage.md)
-- [Developer Guide](devGuide/DeveloperGuide.md)
-- [Issue Tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues)
-- [Discord Community](https://discord.gg/HYmhKj45pU)
+Stirling PDF is open-core. See [LICENSE](LICENSE) for details.

WINDOWS_SIGNING.md

@@ -0,0 +1,258 @@
+# Windows Code Signing Setup Guide
+
+This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
+
+## Overview
+
+Windows code signing is essential for:
+- Preventing Windows SmartScreen warnings
+- Building trust with users
+- Enabling Microsoft Store distribution
+- Professional application distribution
+
+## Certificate Types
+
+### OV Certificate (Organization Validated)
+- More affordable option
+- Requires business verification
+- May trigger SmartScreen warnings initially until reputation builds
+- Suitable for most independent software vendors
+
+### EV Certificate (Extended Validation)
+- Premium option with immediate SmartScreen reputation
+- Requires hardware security module (HSM) or cloud-based signing
+- Higher cost but provides immediate trust
+- Required since June 2023 for new certificates
+
+## Obtaining a Certificate
+
+### Certificate Authorities
+Popular certificate authorities for Windows code signing:
+- DigiCert
+- Sectigo (formerly Comodo)
+- GlobalSign
+- SSL.com
+
+### Certificate Format
+You'll receive a certificate in one of these formats:
+- `.pfx` or `.p12` (preferred - contains both certificate and private key)
+- `.cer` + private key (needs conversion to .pfx)
+
+### Converting to PFX (if needed)
+If you have separate certificate and private key files:
+
+```bash
+openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
+```
+
+## Setting Up GitHub Secrets
+
+### Required Secrets
+
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions
+
+Add the following secrets:
+
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file
+
+### Optional Secrets for Tauri Updater
+
+If you're using Tauri's built-in updater feature:
+
+#### `TAURI_SIGNING_PRIVATE_KEY`
+- Generated using Tauri CLI: `npm run tauri signer generate`
+- Used for update package verification
+
+#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
+- Password for the Tauri signing key
+
+## Configuration Files
+
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
+
+The Windows signing configuration is already set up:
+
+```json
+"windows": {
+  "certificateThumbprint": null,
+  "digestAlgorithm": "sha256",
+  "timestampUrl": "http://timestamp.digicert.com"
+}
+```
+
+**Configuration Options:**
+- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
+- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
+- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
+
+**Alternative Timestamp Servers:**
+- DigiCert: `http://timestamp.digicert.com`
+- Sectigo: `http://timestamp.sectigo.com`
+- GlobalSign: `http://timestamp.globalsign.com`
+
+### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
+
+The workflow includes three Windows signing steps:
+
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
+
+## Testing the Setup
+
+### 1. Local Testing (Windows Only)
+
+Before pushing to GitHub, test locally:
+
+```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
+# Build the application
+cd frontend
+npm run tauri build
+
+# Verify the signature
+Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
+```
+
+### 2. GitHub Actions Testing
+
+1. Push your changes to a branch
+2. Manually trigger the workflow:
+   - Go to Actions → Build Tauri Applications
+   - Click "Run workflow"
+   - Select "windows" platform
+3. Check the build logs for:
+   - ✅ Certificate import success
+   - ✅ Build completion
+   - ✅ Signature verification
+
+### 3. Verifying Signed Binaries
+
+After downloading the built artifacts:
+
+**Windows (PowerShell):**
+```powershell
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
+```
+
+Look for:
+- Status: `Valid`
+- Signer: Your organization name
+- Timestamp: Recent date/time
+
+**Windows (GUI):**
+1. Right-click the .exe or .msi file
+2. Select "Properties"
+3. Go to "Digital Signatures" tab
+4. Verify signature details
+
+## Troubleshooting
+
+### "HashMismatch" Status
+- Certificate doesn't match the binary
+- Possible file corruption during download
+- Re-download and verify
+
+### "NotSigned" Status
+- Certificate wasn't imported correctly
+- Check GitHub secrets are set correctly
+- Verify base64 encoding is complete (no truncation)
+
+### "UnknownError" Status
+- Timestamp server unreachable
+- Try alternative timestamp URL in tauri.conf.json
+- Check network connectivity in GitHub Actions
+
+### SmartScreen Still Shows Warnings
+- Normal for OV certificates initially
+- Reputation builds over time with user downloads
+- Consider EV certificate for immediate reputation
+
+### Certificate Not Found During Build
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct
+
+## Security Best Practices
+
+1. **Never commit certificates to version control**
+   - Keep .pfx files secure and backed up
+   - Use GitHub secrets for CI/CD
+
+2. **Rotate certificates before expiration**
+   - Set calendar reminders
+   - Update GitHub secrets with new certificate
+
+3. **Use strong passwords**
+   - Certificate password should be complex
+   - Store securely (password manager)
+
+4. **Monitor certificate usage**
+   - Review GitHub Actions logs
+   - Set up notifications for failed builds
+
+5. **Limit access to secrets**
+   - Only repository admins should access secrets
+   - Audit secret access regularly
+
+## Certificate Lifecycle
+
+### Before Expiration
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works
+
+### Expired Certificates
+- Signed binaries remain valid (timestamp proves signing time)
+- New builds will fail until certificate is renewed
+- Users can still install previously signed versions
+
+## Cost Considerations
+
+### Certificate Costs (Annual, as of 2024)
+- **OV Certificate**: $100-400/year
+- **EV Certificate**: $400-1000/year
+
+### Choosing the Right Certificate
+- **Open source / early stage**: Start with OV
+- **Commercial / enterprise**: Consider EV for better trust
+- **Microsoft Store**: EV certificate required
+
+## Additional Resources
+
+- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
+- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
+- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
+- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
+
+## Support
+
+If you encounter issues with Windows code signing:
+1. Check GitHub Actions logs for detailed error messages
+2. Verify all secrets are set correctly
+3. Test certificate locally first (Windows environment required)
+4. Open an issue in the repository with relevant logs (remove sensitive data)

app/common/build.gradle

@@ -37,6 +37,8 @@ dependencies {
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
+    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
+    api "org.apache.pdfbox:preflight:$pdfboxVersion"
     api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:2.10'

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -18,11 +18,37 @@ import stirling.software.common.model.ApplicationProperties;
 @Slf4j
 public class EndpointConfiguration {
 
+    public enum DisableReason {
+        CONFIG,
+        DEPENDENCY,
+        UNKNOWN
+    }
+
+    public static class EndpointAvailability {
+        private final boolean enabled;
+        private final DisableReason reason;
+
+        public EndpointAvailability(boolean enabled, DisableReason reason) {
+            this.enabled = enabled;
+            this.reason = reason;
+        }
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public DisableReason getReason() {
+            return reason;
+        }
+    }
+
     private static final String REMOVE_BLANKS = "remove-blanks";
     private final ApplicationProperties applicationProperties;
     @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
     private Set<String> disabledGroups = new HashSet<>();
+    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
+    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
@@ -35,16 +61,31 @@ public class EndpointConfiguration {
         processEnvironmentConfigs();
     }
 
+    private String normalizeEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return null;
+        }
+        return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
+    }
+
     public void enableEndpoint(String endpoint) {
-        endpointStatuses.put(endpoint, true);
-        log.debug("Enabled endpoint: {}", endpoint);
+        String normalized = normalizeEndpoint(endpoint);
+        endpointStatuses.put(normalized, true);
+        endpointDisableReasons.remove(normalized);
+        log.debug("Enabled endpoint: {}", normalized);
     }
 
     public void disableEndpoint(String endpoint) {
-        if (!Boolean.FALSE.equals(endpointStatuses.get(endpoint))) {
-            log.debug("Disabling endpoint: {}", endpoint);
+        disableEndpoint(endpoint, DisableReason.CONFIG);
+    }
+
+    public void disableEndpoint(String endpoint, DisableReason reason) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (!Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            log.debug("Disabling endpoint: {}", normalized);
         }
-        endpointStatuses.put(endpoint, false);
+        endpointStatuses.put(normalized, false);
+        endpointDisableReasons.put(normalized, reason);
     }
 
     public boolean isEndpointEnabled(String endpoint) {
@@ -150,6 +191,10 @@ public class EndpointConfiguration {
     }
 
     public void disableGroup(String group) {
+        disableGroup(group, DisableReason.CONFIG);
+    }
+
+    public void disableGroup(String group, DisableReason reason) {
         if (disabledGroups.add(group)) {
             if (isToolGroup(group)) {
                 log.debug(
@@ -161,11 +206,12 @@ public class EndpointConfiguration {
                         group);
             }
         }
+        groupDisableReasons.put(group, reason);
         // Only cascade to endpoints for *functional* groups
         if (!isToolGroup(group)) {
             Set<String> endpoints = endpointGroups.get(group);
             if (endpoints != null) {
-                endpoints.forEach(this::disableEndpoint);
+                endpoints.forEach(endpoint -> disableEndpoint(endpoint, reason));
             }
         }
     }
@@ -174,12 +220,39 @@ public class EndpointConfiguration {
         if (disabledGroups.remove(group)) {
             log.debug("Enabling group: {}", group);
         }
+        groupDisableReasons.remove(group);
         Set<String> endpoints = endpointGroups.get(group);
         if (endpoints != null) {
             endpoints.forEach(this::enableEndpoint);
         }
     }
 
+    public EndpointAvailability getEndpointAvailability(String endpoint) {
+        boolean enabled = isEndpointEnabled(endpoint);
+        DisableReason reason = enabled ? null : determineDisableReason(endpoint);
+        return new EndpointAvailability(enabled, reason);
+    }
+
+    private DisableReason determineDisableReason(String endpoint) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            return endpointDisableReasons.getOrDefault(normalized, DisableReason.CONFIG);
+        }
+
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            Set<String> endpoints = entry.getValue();
+            if (!disabledGroups.contains(group) || endpoints == null) {
+                continue;
+            }
+            if (endpoints.contains(normalized)) {
+                return groupDisableReasons.getOrDefault(group, DisableReason.CONFIG);
+            }
+        }
+
+        return DisableReason.UNKNOWN;
+    }
+
     public Set<String> getDisabledGroups() {
         return new HashSet<>(disabledGroups);
     }
@@ -261,6 +334,10 @@ public class EndpointConfiguration {
         addEndpointToGroup("Convert", "pdf-to-csv");
         addEndpointToGroup("Convert", "pdf-to-markdown");
         addEndpointToGroup("Convert", "eml-to-pdf");
+        addEndpointToGroup("Convert", "cbz-to-pdf");
+        addEndpointToGroup("Convert", "pdf-to-cbz");
+        addEndpointToGroup("Convert", "pdf-to-json");
+        addEndpointToGroup("Convert", "json-to-pdf");
 
         // Adding endpoints to "Security" group
         addEndpointToGroup("Security", "add-password");
@@ -294,6 +371,12 @@ public class EndpointConfiguration {
         addEndpointToGroup("Other", "replace-and-invert-color-pdf");
         addEndpointToGroup("Other", "multi-tool");
 
+        // Adding form-related endpoints to "Other" group
+        addEndpointToGroup("Other", "fields");
+        addEndpointToGroup("Other", "modify-fields");
+        addEndpointToGroup("Other", "delete-fields");
+        addEndpointToGroup("Other", "fill");
+
         // Adding endpoints to "Advance" group
         addEndpointToGroup("Advance", "adjust-contrast");
         addEndpointToGroup("Advance", "compress-pdf");
@@ -388,6 +471,10 @@ public class EndpointConfiguration {
         addEndpointToGroup("Java", "pdf-to-markdown");
         addEndpointToGroup("Java", "add-attachments");
         addEndpointToGroup("Java", "compress-pdf");
+        addEndpointToGroup("Java", "cbz-to-pdf");
+        addEndpointToGroup("Java", "pdf-to-cbz");
+        addEndpointToGroup("Java", "pdf-to-json");
+        addEndpointToGroup("Java", "json-to-pdf");
         addEndpointToGroup("rar", "pdf-to-cbr");
 
         // Javascript
@@ -403,8 +490,9 @@ public class EndpointConfiguration {
         /* Ghostscript */
         addEndpointToGroup("Ghostscript", "repair");
         addEndpointToGroup("Ghostscript", "compress-pdf");
-        addEndpointToGroup("Ghostscript", "crop");
-        addEndpointToGroup("Ghostscript", "replace-invert-pdf");
+
+        /* ImageMagick */
+        addEndpointToGroup("ImageMagick", "compress-pdf");
 
         /* tesseract */
         addEndpointToGroup("tesseract", "ocr-pdf");
@@ -489,6 +577,7 @@ public class EndpointConfiguration {
                 || "Javascript".equals(group)
                 || "Weasyprint".equals(group)
                 || "Pdftohtml".equals(group)
+                || "ImageMagick".equals(group)
                 || "rar".equals(group);
     }
 

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Document analysis and information extraction services for content intelligence and insights.
+                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
+                Use these endpoints to understand what's inside a document without changing it.
 
-                This endpoint group provides analytical capabilities to understand document structure,
-                extract information, and generate insights from PDF content for automated processing.
-
-                Common use cases:
-                • Document inventory management and content audit for compliance verification
-                • Quality assurance workflows and business intelligence analytics
-                • Migration planning, accessibility evaluation, and document forensics
-
-                Business applications:
-                • Legal discovery, financial document review, and healthcare records analysis
-                • Academic research, government processing, and publishing optimization
-
-                Operational scenarios:
-                • Large-scale profiling, migration assessment, and performance optimization
-                • Automated quality control and content strategy development
-
-                Target users: Data analysts, QA teams, administrators, and business intelligence
-                professionals requiring detailed document insights.
+                Typical uses:
+                • Get page counts and dimensions for layout or print rules
+                • List fonts and annotations to spot compatibility issues
+                • Inspect form fields before deciding how to fill or modify them
+                • Pull metadata and security settings for audits or reports
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Document format transformation services for cross-platform compatibility and workflow integration.
+                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
+                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
 
-                This endpoint group enables transformation between various formats, supporting
-                diverse business workflows and system integrations for mixed document ecosystems.
-
-                Common use cases:
-                • Legacy system integration, document migration, and cross-platform sharing
-                • Archive standardization, publishing preparation, and content adaptation
-                • Accessibility compliance and mobile-friendly document preparation
-
-                Business applications:
-                • Enterprise content management, digital publishing, and educational platforms
-                • Legal document processing, healthcare interoperability, and government standardization
-
-                Integration scenarios:
-                • API-driven pipelines, automated workflow preparation, and batch conversions
-                • Real-time format adaptation for user requests
-
-                Target users: System integrators, content managers, digital archivists, and
-                organizations requiring flexible document format interoperability.
+                Typical uses:
+                • Turn PDFs into Word or text for editing
+                • Convert office files, images, HTML, or email (EML) into PDFs
+                • Create PDF/A for long-term archiving
+                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Document content filtering and search operations for information discovery and organization.
+                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
+                Use these endpoints as a "pre-check" step to decide what to do with a file next.
 
-                This endpoint group enables intelligent content discovery and organization within
-                document collections for content-based processing and information extraction.
-
-                Common use cases:
-                • Legal discovery, research organization, and compliance auditing
-                • Content moderation, academic research, and business intelligence
-                • Quality assurance and content validation workflows
-
-                Business applications:
-                • Contract analysis, financial review, and healthcare records organization
-                • Government processing, educational curation, and IP protection
-
-                Workflow scenarios:
-                • Large-scale processing, automated classification, and information extraction
-                • Document preparation for further processing or analysis
-
-                Target users: Legal professionals, researchers, compliance officers, and
-                organizations requiring intelligent document content discovery and organization.
+                Typical uses:
+                • Reject files that are too big or too small
+                • Detect image-only PDFs that should go through OCR
+                • Ensure a document has enough pages before it enters a workflow
+                • Check orientation of pages before printing or merging
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,21 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Core PDF processing operations for fundamental document manipulation workflows.
+                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
+                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
 
-                This endpoint group provides essential PDF functionality that forms the foundation
-                of most document processing workflows across various industries.
-
-                Common use cases:
-                • Document preparation for archival systems and content organization
-                • File preparation for distribution, accessibility compliance, and batch processing
-                • Document consolidation for reporting and legal compliance workflows
-
-                Typical applications:
-                • Content management, publishing workflows, and educational content distribution
-                • Business process automation and archive management
-
-                Target users: Content managers, document processors, and organizations requiring
-                reliable foundational PDF manipulation capabilities.
+                Typical uses:
+                • Split a large PDF into smaller files (by pages, chapters, or size)
+                • Merge several PDFs into one report or pack
+                • Rotate or reorder pages before sending or archiving
+                • Turn a multi-page document into one long scrolling page
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -0,0 +1,37 @@
+package stirling.software.common.annotations.api;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+/**
+ * Combined annotation for Invite management controllers.
+ * Includes @RestController, @RequestMapping("/api/v1/invite"), and OpenAPI @Tag.
+ */
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@RestController
+@RequestMapping("/api/v1/invite")
+@Tag(
+        name = "Invite",
+        description =
+                """
+                Invite-link generation and acceptance endpoints for onboarding new users.
+
+                Provides the ability to issue invitation tokens, send optional email invites,
+                validate and accept invite links, and manage pending invitations for teams.
+
+                Typical use cases include:
+                • Admin workflows for issuing time-limited invitations to external users
+                • Self-service invite acceptance and team assignment
+                • License limit enforcement when provisioning new accounts
+
+                Target users: administrators and automation scripts orchestrating user onboarding.
+                """)
+public @interface InviteApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,25 +22,15 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Specialized utilities and supplementary tools for enhanced document processing workflows.
+                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
+                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
 
-                This endpoint group provides utility operations that support core document processing
-                tasks and address specific workflow needs in real-world scenarios.
-
-                Common use cases:
-                • Document optimization for bandwidth-limited environments and storage cost management
-                • Document repair, content extraction, and validation for quality assurance
-                • Accessibility improvement and custom processing for specialized needs
-
-                Business applications:
-                • Web publishing optimization, email attachment management, and archive efficiency
-                • Mobile compatibility, print production, and legacy document recovery
-
-                Operational scenarios:
-                • Batch processing, quality control, and performance optimization
-                • Troubleshooting and recovery of problematic documents
-
-                Target users: System administrators, document specialists, and organizations requiring
-                specialized document processing and optimization tools.
+                Typical uses:
+                • Repair a damaged PDF or remove blank pages
+                • Run OCR on scanned PDFs so they become searchable
+                • Compress large PDFs for email or web download
+                • Extract embedded images or scans
+                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
+                • Update PDF metadata (title, author, etc.)
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,25 +22,12 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Automated document processing workflows for complex multi-stage business operations.
+                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
+                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
 
-                This endpoint group enables organizations to create sophisticated document processing
-                workflows that combine multiple operations into streamlined, repeatable processes.
-
-                Common use cases:
-                • Invoice processing, legal document review, and healthcare records standardization
-                • Government processing, educational content preparation, and publishing automation
-                • Contract lifecycle management and approval processes
-
-                Business applications:
-                • Automated compliance reporting, large-scale migration, and quality assurance
-                • Archive preparation, content delivery, and document approval workflows
-
-                Operational scenarios:
-                • Scheduled batch processing and event-driven document processing
-                • Multi-department coordination and business system integration
-
-                Target users: Business process managers, IT automation specialists, and organizations
-                requiring consistent, repeatable document processing workflows.
+                Typical uses:
+                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
+                • Normalise documents before they enter an archive
+                • Wrap a complex document flow behind a single API call for your own apps
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Document security and protection services for confidential and sensitive content.
+                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
+                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
 
-                This endpoint group provides essential security operations for organizations handling
-                sensitive documents and materials requiring controlled access.
-
-                Common use cases:
-                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
-                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
-                • Contract security for business transactions
-
-                Business applications:
-                • Document authentication, confidential sharing, and secure archiving
-                • Content watermarking, access control, and privacy protection through redaction
-
-                Industry scenarios:
-                • Legal discovery, medical records exchange, financial audit documentation
-                • Enterprise policy enforcement and data governance
-
-                Target users: Legal professionals, healthcare administrators, compliance officers,
-                government agencies, and enterprises handling sensitive content.
+                Typical uses:
+                • Add or remove a password on a PDF
+                • Redact personal or confidential information (manually or automatically)
+                • Validate or remove digital signatures
+                • Sanitize a PDF to strip scripts and embedded content
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/configuration/AppConfig.java

@@ -37,10 +37,6 @@ public class AppConfig {
 
     private final ApplicationProperties applicationProperties;
 
-    @Getter
-    @Value("${baseUrl:http://localhost}")
-    private String baseUrl;
-
     @Getter
     @Value("${server.servlet.context-path:/}")
     private String contextPath;
@@ -49,6 +45,17 @@ public class AppConfig {
     @Value("${server.port:8080}")
     private String serverPort;
 
+    /**
+     * Get the backend URL from system configuration. Falls back to http://localhost if not
+     * configured.
+     *
+     * @return The backend base URL for SAML/OAuth/API callbacks
+     */
+    public String getBackendUrl() {
+        String backendUrl = applicationProperties.getSystem().getBackendUrl();
+        return (backendUrl != null && !backendUrl.isBlank()) ? backendUrl : "http://localhost";
+    }
+
     @Value("${v2}")
     public boolean v2Enabled;
 

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -68,6 +68,7 @@ public class ApplicationProperties {
 
     private AutoPipeline autoPipeline = new AutoPipeline();
     private ProcessExecutor processExecutor = new ProcessExecutor();
+    private PdfEditor pdfEditor = new PdfEditor();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -100,6 +101,46 @@ public class ApplicationProperties {
         private String outputFolder;
     }
 
+    @Data
+    public static class PdfEditor {
+        private Cache cache = new Cache();
+        private FontNormalization fontNormalization = new FontNormalization();
+        private CffConverter cffConverter = new CffConverter();
+        private Type3 type3 = new Type3();
+        private String fallbackFont = "classpath:/static/fonts/NotoSans-Regular.ttf";
+
+        @Data
+        public static class Cache {
+            private long maxBytes = -1;
+            private int maxPercent = 20;
+        }
+
+        @Data
+        public static class FontNormalization {
+            private boolean enabled = false;
+        }
+
+        @Data
+        public static class CffConverter {
+            private boolean enabled = true;
+            private String method = "python";
+            private String pythonCommand = "/opt/venv/bin/python3";
+            private String pythonScript = "/scripts/convert_cff_to_ttf.py";
+            private String fontforgeCommand = "fontforge";
+        }
+
+        @Data
+        public static class Type3 {
+            private Library library = new Library();
+
+            @Data
+            public static class Library {
+                private boolean enabled = true;
+                private String index = "classpath:/type3/library/index.json";
+            }
+        }
+    }
+
     @Data
     public static class Legal {
         private String termsAndConditions;
@@ -112,7 +153,6 @@ public class ApplicationProperties {
     @Data
     public static class Security {
         private Boolean enableLogin;
-        private Boolean csrfDisabled;
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
@@ -358,6 +398,7 @@ public class ApplicationProperties {
         private Boolean enableAnalytics;
         private Boolean enablePosthog;
         private Boolean enableScarf;
+        private Boolean enableDesktopInstallSlide;
         private Datasource datasource;
         private Boolean disableSanitize;
         private int maxDPI;
@@ -368,6 +409,12 @@ public class ApplicationProperties {
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
         private List<String> corsAllowedOrigins = new ArrayList<>();
+        private String backendUrl; // Backend base URL for SAML/OAuth/API callbacks (e.g.
+        // 'http://localhost:8080', 'https://api.example.com'). Required for
+        // SSO.
+        private String frontendUrl; // Frontend URL for invite email links (e.g.
+
+        // 'https://app.example.com'). If not set, falls back to backendUrl.
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -501,10 +548,19 @@ public class ApplicationProperties {
     public static class Ui {
         private String appNameNavbar;
         private List<String> languages;
+        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
 
         public String getAppNameNavbar() {
             return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
         }
+
+        public String getLogoStyle() {
+            // Validate and return either "modern" or "classic"
+            if ("modern".equalsIgnoreCase(logoStyle)) {
+                return "modern";
+            }
+            return "classic"; // default
+        }
     }
 
     @Data
@@ -523,6 +579,7 @@ public class ApplicationProperties {
         @ToString.Exclude private String key;
         private String UUID;
         private String appVersion;
+        private Boolean isNewServer;
     }
 
     // TODO: Remove post migration
@@ -556,11 +613,22 @@ public class ApplicationProperties {
     public static class Mail {
         private boolean enabled;
         private boolean enableInvites = false;
+        private int inviteLinkExpiryHours = 72; // Default: 72 hours (3 days)
         private String host;
         private int port;
         private String username;
         @ToString.Exclude private String password;
         private String from;
+        // STARTTLS upgrades a plain SMTP connection to TLS after connecting (RFC 3207)
+        private Boolean startTlsEnable = true;
+        private Boolean startTlsRequired;
+        // SSL/TLS wrapper for implicit TLS (typically port 465)
+        private Boolean sslEnable;
+        // Hostnames or patterns (e.g., "smtp.example.com" or "*") to trust for TLS certificates;
+        // defaults to "*" (trust all) when not set
+        private String sslTrust;
+        // Enables hostname verification for TLS connections
+        private Boolean sslCheckServerIdentity;
     }
 
     @Data
@@ -629,6 +697,7 @@ public class ApplicationProperties {
             private int weasyPrintSessionLimit;
             private int installAppSessionLimit;
             private int calibreSessionLimit;
+            private int imageMagickSessionLimit;
             private int qpdfSessionLimit;
             private int tesseractSessionLimit;
             private int ghostscriptSessionLimit;
@@ -666,6 +735,10 @@ public class ApplicationProperties {
                 return calibreSessionLimit > 0 ? calibreSessionLimit : 1;
             }
 
+            public int getImageMagickSessionLimit() {
+                return imageMagickSessionLimit > 0 ? imageMagickSessionLimit : 4;
+            }
+
             public int getGhostscriptSessionLimit() {
                 return ghostscriptSessionLimit > 0 ? ghostscriptSessionLimit : 8;
             }
@@ -695,6 +768,8 @@ public class ApplicationProperties {
             @JsonProperty("calibretimeoutMinutes")
             private long calibreTimeoutMinutes;
 
+            private long imageMagickTimeoutMinutes;
+
             private long tesseractTimeoutMinutes;
             private long qpdfTimeoutMinutes;
             private long ghostscriptTimeoutMinutes;
@@ -732,6 +807,10 @@ public class ApplicationProperties {
                 return calibreTimeoutMinutes > 0 ? calibreTimeoutMinutes : 30;
             }
 
+            public long getImageMagickTimeoutMinutes() {
+                return imageMagickTimeoutMinutes > 0 ? imageMagickTimeoutMinutes : 30;
+            }
+
             public long getGhostscriptTimeoutMinutes() {
                 return ghostscriptTimeoutMinutes > 0 ? ghostscriptTimeoutMinutes : 30;
             }

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -41,7 +41,7 @@ public class CustomPDFDocumentFactory {
 
     // Memory thresholds and limits
 
-    private static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
+    public static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
     // Files smaller than this threshold are loaded entirely in memory for better performance.
     // These files use IOUtils.createMemoryOnlyStreamCache() which keeps all document data in RAM.
     // No temp files are created for document data, reducing I/O operations but consuming more

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -9,6 +9,7 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;
 
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -37,6 +38,9 @@ public class JobExecutorService {
     private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
     private final long effectiveTimeoutMs;
 
+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
+
     public JobExecutorService(
             TaskManager taskManager,
             FileStorage fileStorage,
@@ -98,11 +102,17 @@ public class JobExecutorService {
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
-        String jobId = UUID.randomUUID().toString();
+        // Generate base UUID
+        String baseJobId = UUID.randomUUID().toString();
 
-        // Store the job ID in the request for potential use by other components
+        // Scope job to authenticated user if security is enabled
+        String scopedJobKey = getScopedJobKey(baseJobId);
+
+        log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
+
+        // Store the scoped job ID in the request for potential use by other components
         if (request != null) {
-            request.setAttribute("jobId", jobId);
+            request.setAttribute("jobId", scopedJobKey);
 
             // Also track this job ID in the user's session for authorization purposes
             // This ensures users can only cancel their own jobs
@@ -116,11 +126,13 @@ public class JobExecutorService {
                     request.getSession().setAttribute("userJobIds", userJobIds);
                 }
 
-                userJobIds.add(jobId);
-                log.debug("Added job ID {} to user session", jobId);
+                userJobIds.add(scopedJobKey);
+                log.debug("Added scoped job ID {} to user session", scopedJobKey);
             }
         }
 
+        String jobId = scopedJobKey;
+
         // Determine which timeout to use
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
@@ -149,17 +161,31 @@ public class JobExecutorService {
             taskManager.createTask(jobId);
 
             // Create a specialized wrapper that updates the TaskManager
+            final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
+                            // Set jobId in ThreadLocal context for the queued job
+                            stirling.software.common.util.JobContext.setJobId(
+                                    capturedJobIdForQueue);
+                            log.debug(
+                                    "Set jobId {} in JobContext for queued job execution",
+                                    capturedJobIdForQueue);
+
                             Object result = work.get();
-                            processJobResult(jobId, result);
+                            processJobResult(capturedJobIdForQueue, result);
                             return result;
                         } catch (Exception e) {
                             log.error(
-                                    "Error executing queued job {}: {}", jobId, e.getMessage(), e);
-                            taskManager.setError(jobId, e.getMessage());
+                                    "Error executing queued job {}: {}",
+                                    capturedJobIdForQueue,
+                                    e.getMessage(),
+                                    e);
+                            taskManager.setError(capturedJobIdForQueue, e.getMessage());
                             throw e;
+                        } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
+                            stirling.software.common.util.JobContext.clear();
                         }
                     };
 
@@ -171,21 +197,36 @@ public class JobExecutorService {
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
+
+            // Capture the jobId for the async thread
+            final String capturedJobId = jobId;
+
             executor.execute(
                     () -> {
                         try {
                             log.debug(
-                                    "Running async job {} with timeout {} ms", jobId, timeoutToUse);
+                                    "Running async job {} with timeout {} ms",
+                                    capturedJobId,
+                                    timeoutToUse);
+
+                            // Set jobId in ThreadLocal context for the async thread
+                            stirling.software.common.util.JobContext.setJobId(capturedJobId);
+                            log.debug(
+                                    "Set jobId {} in JobContext for async execution",
+                                    capturedJobId);
 
                             // Execute with timeout
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
-                            processJobResult(jobId, result);
+                            processJobResult(capturedJobId, result);
                         } catch (TimeoutException te) {
                             log.error("Job {} timed out after {} ms", jobId, timeoutToUse);
                             taskManager.setError(jobId, "Job timed out");
                         } catch (Exception e) {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
+                        } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
+                            stirling.software.common.util.JobContext.clear();
                         }
                     });
 
@@ -194,6 +235,10 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
+                // Make jobId available to downstream components on the worker thread
+                stirling.software.common.util.JobContext.setJobId(jobId);
+                log.debug("Set jobId {} in JobContext for sync execution", jobId);
+
                 // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
@@ -213,6 +258,8 @@ public class JobExecutorService {
                 // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
+            } finally {
+                stirling.software.common.util.JobContext.clear();
             }
         }
     }
@@ -466,8 +513,23 @@ public class JobExecutorService {
             throws TimeoutException, Exception {
         // Use the same executor as other async jobs for consistency
         // This ensures all operations run on the same thread pool
+        String currentJobId = stirling.software.common.util.JobContext.getJobId();
+
         java.util.concurrent.CompletableFuture<T> future =
-                java.util.concurrent.CompletableFuture.supplyAsync(supplier, executor);
+                java.util.concurrent.CompletableFuture.supplyAsync(
+                        () -> {
+                            if (currentJobId != null) {
+                                stirling.software.common.util.JobContext.setJobId(currentJobId);
+                            }
+                            try {
+                                return supplier.get();
+                            } finally {
+                                if (currentJobId != null) {
+                                    stirling.software.common.util.JobContext.clear();
+                                }
+                            }
+                        },
+                        executor);
 
         try {
             return future.get(timeoutMs, TimeUnit.MILLISECONDS);
@@ -483,4 +545,18 @@ public class JobExecutorService {
             throw new Exception("Execution was interrupted", e);
         }
     }
+
+    /**
+     * Get a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param baseJobId the base job identifier
+     * @return scoped job key, or just baseJobId if no ownership service available
+     */
+    private String getScopedJobKey(String baseJobId) {
+        if (jobOwnershipService != null) {
+            return jobOwnershipService.createScopedJobKey(baseJobId);
+        }
+        // Security disabled, return unsecured job key
+        return baseJobId;
+    }
 }

app/common/src/main/java/stirling/software/common/service/JobOwnershipService.java

@@ -0,0 +1,42 @@
+package stirling.software.common.service;
+
+import java.util.Optional;
+
+/**
+ * Service interface for managing job ownership and access control. Implementations can provide
+ * user-scoped job isolation when security is enabled, or no-op behavior when security is disabled.
+ */
+public interface JobOwnershipService {
+
+    /**
+     * Get the current authenticated user's identifier.
+     *
+     * @return Optional containing user identifier, or empty if not authenticated
+     */
+    Optional<String> getCurrentUserId();
+
+    /**
+     * Create a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param jobId the base job identifier
+     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
+     */
+    String createScopedJobKey(String jobId);
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param scopedJobKey the scoped job key to validate
+     * @return true if current user owns the job or no authentication is required
+     * @throws SecurityException if current user does not own the job
+     */
+    boolean validateJobAccess(String scopedJobKey);
+
+    /**
+     * Extract the base job ID from a scoped job key.
+     *
+     * @param scopedJobKey the scoped job key
+     * @return the base job ID without user prefix
+     */
+    String extractJobId(String scopedJobKey);
+}

app/common/src/main/java/stirling/software/common/service/LineArtConversionService.java

@@ -0,0 +1,12 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+
+public interface LineArtConversionService {
+    PDImageXObject convertImageToLineArt(
+            PDDocument doc, PDImageXObject originalImage, double threshold, int edgeLevel)
+            throws IOException;
+}

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -0,0 +1,21 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+
+/**
+ * Interface for personal signature access (proprietary feature). Implemented only in proprietary
+ * module to provide authenticated users access to their personal signatures.
+ */
+public interface PersonalSignatureServiceInterface {
+
+    /**
+     * Get a personal signature from the user's folder. Only checks personal folder, not shared
+     * folder.
+     *
+     * @param username Username of the signature owner
+     * @param fileName Signature filename
+     * @return Personal signature image bytes
+     * @throws IOException If file not found or read error
+     */
+    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
+}

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -254,10 +254,7 @@ public class PostHogService {
                 properties,
                 "security_enableLogin",
                 applicationProperties.getSecurity().getEnableLogin());
-        addIfNotEmpty(
-                properties,
-                "security_csrfDisabled",
-                applicationProperties.getSecurity().getCsrfDisabled());
+        addIfNotEmpty(properties, "security_csrfDisabled", true);
         addIfNotEmpty(
                 properties,
                 "security_loginAttemptCount",

app/common/src/main/java/stirling/software/common/service/UserServiceInterface.java

@@ -8,4 +8,6 @@ public interface UserServiceInterface {
     long getTotalUsersCount();
 
     boolean isCurrentUserAdmin();
+
+    boolean isCurrentUserFirstLogin();
 }

app/common/src/main/java/stirling/software/common/util/FormUtils.java

@@ -1,658 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDResources;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.font.PDType1Font;
-import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
-import org.apache.pdfbox.pdmodel.interactive.form.*;
-
-import lombok.extern.slf4j.Slf4j;
-
-@Slf4j
-public final class FormUtils {
-
-    private FormUtils() {}
-
-    public static boolean hasAnyRotatedPage(PDDocument document) {
-        try {
-            for (PDPage page : document.getPages()) {
-                int rot = page.getRotation();
-                int norm = ((rot % 360) + 360) % 360;
-                if (norm != 0) {
-                    return true;
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to inspect page rotations: {}", e.getMessage(), e);
-        }
-        return false;
-    }
-
-    public static void copyAndTransformFormFields(
-            PDDocument sourceDocument,
-            PDDocument newDocument,
-            int totalPages,
-            int pagesPerSheet,
-            int cols,
-            int rows,
-            float cellWidth,
-            float cellHeight)
-            throws IOException {
-
-        PDDocumentCatalog sourceCatalog = sourceDocument.getDocumentCatalog();
-        PDAcroForm sourceAcroForm = sourceCatalog.getAcroForm();
-
-        if (sourceAcroForm == null || sourceAcroForm.getFields().isEmpty()) {
-            return;
-        }
-
-        PDDocumentCatalog newCatalog = newDocument.getDocumentCatalog();
-        PDAcroForm newAcroForm = new PDAcroForm(newDocument);
-        newCatalog.setAcroForm(newAcroForm);
-
-        PDResources dr = new PDResources();
-        PDType1Font helvetica = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
-        PDType1Font zapfDingbats = new PDType1Font(Standard14Fonts.FontName.ZAPF_DINGBATS);
-        dr.put(COSName.getPDFName("Helv"), helvetica);
-        dr.put(COSName.getPDFName("ZaDb"), zapfDingbats);
-        newAcroForm.setDefaultResources(dr);
-        newAcroForm.setDefaultAppearance("/Helv 12 Tf 0 g");
-
-        // Do not mutate the source AcroForm; skip bad widgets during copy
-        newAcroForm.setNeedAppearances(true);
-
-        Map<String, Integer> fieldNameCounters = new HashMap<>();
-
-        // Build widget -> field map once for efficient lookups
-        Map<PDAnnotationWidget, PDField> widgetFieldMap = buildWidgetFieldMap(sourceAcroForm);
-
-        for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-            PDPage sourcePage = sourceDocument.getPage(pageIndex);
-            List<PDAnnotation> annotations = sourcePage.getAnnotations();
-
-            if (annotations.isEmpty()) {
-                continue;
-            }
-
-            int destinationPageIndex = pageIndex / pagesPerSheet;
-            int adjustedPageIndex = pageIndex % pagesPerSheet;
-            int rowIndex = adjustedPageIndex / cols;
-            int colIndex = adjustedPageIndex % cols;
-
-            if (destinationPageIndex >= newDocument.getNumberOfPages()) {
-                continue;
-            }
-
-            PDPage destinationPage = newDocument.getPage(destinationPageIndex);
-            PDRectangle sourceRect = sourcePage.getMediaBox();
-
-            float scaleWidth = cellWidth / sourceRect.getWidth();
-            float scaleHeight = cellHeight / sourceRect.getHeight();
-            float scale = Math.min(scaleWidth, scaleHeight);
-
-            float x = colIndex * cellWidth + (cellWidth - sourceRect.getWidth() * scale) / 2;
-            float y =
-                    destinationPage.getMediaBox().getHeight()
-                            - ((rowIndex + 1) * cellHeight
-                                    - (cellHeight - sourceRect.getHeight() * scale) / 2);
-
-            copyBasicFormFields(
-                    sourceAcroForm,
-                    newAcroForm,
-                    sourcePage,
-                    destinationPage,
-                    x,
-                    y,
-                    scale,
-                    pageIndex,
-                    fieldNameCounters,
-                    widgetFieldMap);
-        }
-
-        // Refresh appearances to ensure widgets render correctly across viewers
-        try {
-            // Use reflection to avoid compile-time dependency on PDFBox version
-            Method m = newAcroForm.getClass().getMethod("refreshAppearances");
-            m.invoke(newAcroForm);
-        } catch (NoSuchMethodException nsme) {
-            log.warn(
-                    "AcroForm.refreshAppearances() not available in this PDFBox version; relying on NeedAppearances.");
-        } catch (Throwable t) {
-            log.warn("Failed to refresh field appearances via AcroForm: {}", t.getMessage(), t);
-        }
-    }
-
-    private static void copyBasicFormFields(
-            PDAcroForm sourceAcroForm,
-            PDAcroForm newAcroForm,
-            PDPage sourcePage,
-            PDPage destinationPage,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters,
-            Map<PDAnnotationWidget, PDField> widgetFieldMap) {
-
-        try {
-            List<PDAnnotation> sourceAnnotations = sourcePage.getAnnotations();
-            List<PDAnnotation> destinationAnnotations = destinationPage.getAnnotations();
-
-            for (PDAnnotation annotation : sourceAnnotations) {
-                if (annotation instanceof PDAnnotationWidget widgetAnnotation) {
-                    if (widgetAnnotation.getRectangle() == null) {
-                        continue;
-                    }
-                    PDField sourceField =
-                            widgetFieldMap != null ? widgetFieldMap.get(widgetAnnotation) : null;
-                    if (sourceField == null) {
-                        continue; // skip widgets without a matching field
-                    }
-                    if (sourceField instanceof PDTextField pdtextfield) {
-                        createSimpleTextField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdtextfield,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDCheckBox pdCheckBox) {
-                        createSimpleCheckBoxField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdCheckBox,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDRadioButton pdRadioButton) {
-                        createSimpleRadioButtonField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdRadioButton,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDComboBox pdComboBox) {
-                        createSimpleComboBoxField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdComboBox,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDListBox pdlistbox) {
-                        createSimpleListBoxField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdlistbox,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDSignatureField pdSignatureField) {
-                        createSimpleSignatureField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdSignatureField,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    } else if (sourceField instanceof PDPushButton pdPushButton) {
-                        createSimplePushButtonField(
-                                newAcroForm,
-                                destinationPage,
-                                destinationAnnotations,
-                                pdPushButton,
-                                widgetAnnotation,
-                                offsetX,
-                                offsetY,
-                                scale,
-                                pageIndex,
-                                fieldNameCounters);
-                    }
-                }
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to copy basic form fields for page {}: {}",
-                    pageIndex,
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleTextField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDTextField sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDTextField newTextField = new PDTextField(newAcroForm);
-            newTextField.setDefaultAppearance("/Helv 12 Tf 0 g");
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newTextField,
-                            sourceField.getPartialName(),
-                            "textField",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getValueAsString() != null) {
-                newTextField.setValue(sourceField.getValueAsString());
-            }
-
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create text field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleCheckBoxField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDCheckBox sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDCheckBox newCheckBox = new PDCheckBox(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newCheckBox,
-                            sourceField.getPartialName(),
-                            "checkBox",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.isChecked()) {
-                newCheckBox.check();
-            } else {
-                newCheckBox.unCheck();
-            }
-
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create checkbox field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleRadioButtonField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDRadioButton sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDRadioButton newRadioButton = new PDRadioButton(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newRadioButton,
-                            sourceField.getPartialName(),
-                            "radioButton",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getExportValues() != null) {
-                newRadioButton.setExportValues(sourceField.getExportValues());
-            }
-            if (sourceField.getValue() != null) {
-                newRadioButton.setValue(sourceField.getValue());
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create radio button field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleComboBoxField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDComboBox sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDComboBox newComboBox = new PDComboBox(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newComboBox,
-                            sourceField.getPartialName(),
-                            "comboBox",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getOptions() != null) {
-                newComboBox.setOptions(sourceField.getOptions());
-            }
-            if (sourceField.getValue() != null && !sourceField.getValue().isEmpty()) {
-                newComboBox.setValue(sourceField.getValue());
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create combo box field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleListBoxField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDListBox sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDListBox newListBox = new PDListBox(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newListBox,
-                            sourceField.getPartialName(),
-                            "listBox",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            if (sourceField.getOptions() != null) {
-                newListBox.setOptions(sourceField.getOptions());
-            }
-            if (sourceField.getValue() != null && !sourceField.getValue().isEmpty()) {
-                newListBox.setValue(sourceField.getValue());
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create list box field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimpleSignatureField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDSignatureField sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDSignatureField newSignatureField = new PDSignatureField(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newSignatureField,
-                            sourceField.getPartialName(),
-                            "signature",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create signature field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static void createSimplePushButtonField(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDPushButton sourceField,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDPushButton newPushButton = new PDPushButton(newAcroForm);
-
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newPushButton,
-                            sourceField.getPartialName(),
-                            "pushButton",
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to create push button field '{}': {}",
-                    sourceField.getPartialName(),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private static <T extends PDTerminalField> boolean initializeFieldWithWidget(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            T newField,
-            String originalName,
-            String fallbackName,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        String baseName = (originalName != null) ? originalName : fallbackName;
-        String newFieldName = generateUniqueFieldName(baseName, pageIndex, fieldNameCounters);
-        newField.setPartialName(newFieldName);
-
-        PDAnnotationWidget newWidget = new PDAnnotationWidget();
-        PDRectangle sourceRect = sourceWidget.getRectangle();
-        if (sourceRect == null) {
-            return false;
-        }
-
-        float newX = (sourceRect.getLowerLeftX() * scale) + offsetX;
-        float newY = (sourceRect.getLowerLeftY() * scale) + offsetY;
-        float newWidth = sourceRect.getWidth() * scale;
-        float newHeight = sourceRect.getHeight() * scale;
-        newWidget.setRectangle(new PDRectangle(newX, newY, newWidth, newHeight));
-        newWidget.setPage(destinationPage);
-
-        newField.getWidgets().add(newWidget);
-        newWidget.setParent(newField);
-        newAcroForm.getFields().add(newField);
-        destinationAnnotations.add(newWidget);
-        return true;
-    }
-
-    private static String generateUniqueFieldName(
-            String originalName, int pageIndex, Map<String, Integer> fieldNameCounters) {
-        String baseName = "page" + pageIndex + "_" + originalName;
-
-        Integer counter = fieldNameCounters.get(baseName);
-        if (counter == null) {
-            counter = 0;
-        } else {
-            counter++;
-        }
-        fieldNameCounters.put(baseName, counter);
-
-        return counter == 0 ? baseName : baseName + "_" + counter;
-    }
-
-    private static Map<PDAnnotationWidget, PDField> buildWidgetFieldMap(PDAcroForm acroForm) {
-        Map<PDAnnotationWidget, PDField> map = new HashMap<>();
-        if (acroForm == null) {
-            return map;
-        }
-        try {
-            for (PDField field : acroForm.getFieldTree()) {
-                List<PDAnnotationWidget> widgets = field.getWidgets();
-                if (widgets != null) {
-                    for (PDAnnotationWidget w : widgets) {
-                        if (w != null) {
-                            map.put(w, field);
-                        }
-                    }
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to build widget->field map: {}", e.getMessage(), e);
-        }
-        return map;
-    }
-}

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -38,6 +38,7 @@ public class GeneralUtils {
             Set.of(
                     "OCR images.json",
                     "Prepare-pdfs-for-email.json",
+                    "Pre-publish-sanitization.json",
                     "split-rotate-auto-rename.json");
 
     private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";

app/common/src/main/java/stirling/software/common/util/JarPathUtil.java

@@ -43,26 +43,45 @@ public class JarPathUtil {
     }
 
     /**
-     * Gets the path to the restart-helper.jar file Expected to be in the same directory as the main
-     * JAR
+     * Gets the path to the restart-helper.jar file. Checks multiple possible locations: 1. Same
+     * directory as the main JAR (production deployment) 2. ./build/libs/restart-helper.jar
+     * (development build) 3. app/common/build/libs/restart-helper.jar (multi-module build)
      *
      * @return Path to restart-helper.jar, or null if not found
      */
     public static Path restartHelperJar() {
         Path appJar = currentJar();
-        if (appJar == null) {
-            return null;
+
+        // Define possible locations to check (in order of preference)
+        Path[] possibleLocations = new Path[4];
+
+        // Location 1: Same directory as main JAR (production)
+        if (appJar != null) {
+            possibleLocations[0] = appJar.getParent().resolve("restart-helper.jar");
         }
 
-        Path helperJar = appJar.getParent().resolve("restart-helper.jar");
+        // Location 2: ./build/libs/ (development build)
+        possibleLocations[1] = Paths.get("build", "libs", "restart-helper.jar").toAbsolutePath();
 
-        if (Files.isRegularFile(helperJar)) {
-            log.debug("Restart helper JAR located at: {}", helperJar);
-            return helperJar;
-        } else {
-            log.warn("Restart helper JAR not found at: {}", helperJar);
-            return null;
+        // Location 3: app/common/build/libs/ (multi-module build)
+        possibleLocations[2] =
+                Paths.get("app", "common", "build", "libs", "restart-helper.jar").toAbsolutePath();
+
+        // Location 4: Current working directory
+        possibleLocations[3] = Paths.get("restart-helper.jar").toAbsolutePath();
+
+        // Check each location
+        for (Path location : possibleLocations) {
+            if (location != null && Files.isRegularFile(location)) {
+                log.info("Restart helper JAR found at: {}", location);
+                return location;
+            } else if (location != null) {
+                log.debug("Restart helper JAR not found at: {}", location);
+            }
         }
+
+        log.warn("Restart helper JAR not found in any expected location");
+        return null;
     }
 
     /**

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -0,0 +1,18 @@
+package stirling.software.common.util;
+
+/** Thread-local context for passing job ID across async boundaries */
+public class JobContext {
+    private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
+
+    public static void setJobId(String jobId) {
+        CURRENT_JOB_ID.set(jobId);
+    }
+
+    public static String getJobId() {
+        return CURRENT_JOB_ID.get();
+    }
+
+    public static void clear() {
+        CURRENT_JOB_ID.remove();
+    }
+}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -86,6 +86,11 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getCalibreSessionLimit();
+                                case IMAGEMAGICK ->
+                                        applicationProperties
+                                                .getProcessExecutor()
+                                                .getSessionLimit()
+                                                .getImageMagickSessionLimit();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -96,6 +101,7 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getOcrMyPdfSessionLimit();
+                                case CFF_CONVERTER -> 1;
                             };
 
                     long timeoutMinutes =
@@ -140,6 +146,11 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getCalibreTimeoutMinutes();
+                                case IMAGEMAGICK ->
+                                        applicationProperties
+                                                .getProcessExecutor()
+                                                .getTimeoutMinutes()
+                                                .getImageMagickTimeoutMinutes();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -150,6 +161,7 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getOcrMyPdfTimeoutMinutes();
+                                case CFF_CONVERTER -> 5L;
                             };
                     return new ProcessExecutor(semaphoreLimit, liveUpdates, timeoutMinutes);
                 });
@@ -299,10 +311,12 @@ public class ProcessExecutor {
         WEASYPRINT,
         INSTALL_APP,
         CALIBRE,
+        IMAGEMAGICK,
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,
-        OCR_MY_PDF
+        OCR_MY_PDF,
+        CFF_CONVERTER
     }
 
     @Setter

app/common/src/main/java/stirling/software/common/util/RegexPatternUtils.java

@@ -1,5 +1,6 @@
 package stirling.software.common.util;
 
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Pattern;
 import java.util.regex.PatternSyntaxException;
@@ -241,6 +242,11 @@ public final class RegexPatternUtils {
         return getPattern("\\s+");
     }
 
+    /** Pattern for matching punctuation characters */
+    public Pattern getPunctuationPattern() {
+        return getPattern("[\\p{Punct}]+");
+    }
+
     /** Pattern for matching newlines (Windows and Unix style) */
     public Pattern getNewlinesPattern() {
         return getPattern("\\r?\\n");
@@ -286,6 +292,24 @@ public final class RegexPatternUtils {
         return getPattern("[^a-zA-Z0-9 ]");
     }
 
+    /** Pattern for removing bracketed indices like [0], [Child], etc. in field names */
+    public Pattern getFormFieldBracketPattern() {
+        return getPattern("\\[[^\\]]*\\]");
+    }
+
+    /** Pattern that replaces underscores or hyphens with spaces */
+    public Pattern getUnderscoreHyphenPattern() {
+        return getPattern("[-_]+");
+    }
+
+    /**
+     * Pattern that matches camelCase or alpha-numeric boundaries to allow inserting spaces.
+     * Examples: firstName -> first Name, field1 -> field 1, A5Size -> A5 Size
+     */
+    public Pattern getCamelCaseBoundaryPattern() {
+        return getPattern("(?<=[a-z])(?=[A-Z])|(?<=[A-Za-z])(?=\\d)|(?<=\\d)(?=[A-Za-z])");
+    }
+
     /** Pattern for removing angle brackets */
     public Pattern getAngleBracketsPattern() {
         return getPattern("[<>]");
@@ -335,6 +359,26 @@ public final class RegexPatternUtils {
         return getPattern("[1-9][0-9]{0,2}");
     }
 
+    /**
+     * Pattern for very simple generic field tokens such as "field", "text", "checkbox" with
+     * optional numeric suffix (e.g. "field 1"). Case-insensitive.
+     */
+    public Pattern getGenericFieldNamePattern() {
+        return getPattern(
+                "^(field|text|checkbox|radio|button|signature|name|value|option|select|choice)(\\s*\\d+)?$",
+                Pattern.CASE_INSENSITIVE);
+    }
+
+    /** Pattern for short identifiers like t1, f2, a10 etc. */
+    public Pattern getSimpleFormFieldPattern() {
+        return getPattern("^[A-Za-z]{1,2}\\s*\\d{1,3}$");
+    }
+
+    /** Pattern for optional leading 't' followed by digits, e.g., t1, 1, t 12. */
+    public Pattern getOptionalTNumericPattern() {
+        return getPattern("^(?:t\\s*)?\\d+$", Pattern.CASE_INSENSITIVE);
+    }
+
     /** Pattern for validating mathematical expressions */
     public Pattern getMathExpressionPattern() {
         return getPattern("[0-9n+\\-*/() ]+");
@@ -467,6 +511,11 @@ public final class RegexPatternUtils {
         return getPattern("/");
     }
 
+    /** Supported logical types when creating new fields programmatically */
+    public Set<String> getSupportedNewFieldTypes() {
+        return Set.of("text", "checkbox", "combobox", "listbox", "radio", "button", "signature");
+    }
+
     /**
      * Pre-compile commonly used patterns for immediate availability. This eliminates first-call
      * compilation overhead for frequent patterns.

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -7,23 +7,106 @@ public class RequestUriUtils {
     }
 
     public static boolean isStaticResource(String contextPath, String requestURI) {
-        return requestURI.startsWith(contextPath + "/css/")
-                || requestURI.startsWith(contextPath + "/fonts/")
-                || requestURI.startsWith(contextPath + "/js/")
-                || requestURI.endsWith(contextPath + "robots.txt")
-                || requestURI.startsWith(contextPath + "/images/")
-                || requestURI.startsWith(contextPath + "/public/")
-                || requestURI.startsWith(contextPath + "/pdfjs/")
-                || requestURI.startsWith(contextPath + "/pdfjs-legacy/")
-                || requestURI.startsWith(contextPath + "/login")
-                || requestURI.startsWith(contextPath + "/error")
-                || requestURI.startsWith(contextPath + "/favicon")
-                || requestURI.endsWith(".svg")
-                || requestURI.endsWith(".png")
-                || requestURI.endsWith(".ico")
-                || requestURI.endsWith(".txt")
-                || requestURI.endsWith(".webmanifest")
-                || requestURI.startsWith(contextPath + "/api/v1/info/status");
+        if (requestURI == null) {
+            return false;
+        }
+
+        String normalizedUri = stripContextPath(contextPath, requestURI);
+
+        // API routes are never static except for the public status endpoint
+        if (normalizedUri.startsWith("/api/")) {
+            return normalizedUri.startsWith("/api/v1/info/status");
+        }
+
+        // Well-known static asset directories (backend + React build artifacts)
+        if (normalizedUri.startsWith("/css/")
+                || normalizedUri.startsWith("/fonts/")
+                || normalizedUri.startsWith("/js/")
+                || normalizedUri.startsWith("/images/")
+                || normalizedUri.startsWith("/public/")
+                || normalizedUri.startsWith("/pdfjs/")
+                || normalizedUri.startsWith("/pdfjs-legacy/")
+                || normalizedUri.startsWith("/pdfium/")
+                || normalizedUri.startsWith("/assets/")
+                || normalizedUri.startsWith("/locales/")
+                || normalizedUri.startsWith("/Login/")
+                || normalizedUri.startsWith("/samples/")
+                || normalizedUri.startsWith("/classic-logo/")
+                || normalizedUri.startsWith("/modern-logo/")
+                || normalizedUri.startsWith("/og_images/")) {
+            return true;
+        }
+
+        // Specific static files bundled with the frontend
+        if (normalizedUri.equals("/robots.txt")
+                || normalizedUri.equals("/favicon.ico")
+                || normalizedUri.equals("/manifest.json")
+                || normalizedUri.equals("/site.webmanifest")
+                || normalizedUri.equals("/manifest-classic.json")
+                || normalizedUri.equals("/index.html")) {
+            return true;
+        }
+
+        // Login/error pages remain public
+        if (normalizedUri.startsWith("/login") || normalizedUri.startsWith("/error")) {
+            return true;
+        }
+
+        // Treat common static file extensions as static resources
+        return normalizedUri.endsWith(".svg")
+                || normalizedUri.endsWith(".png")
+                || normalizedUri.endsWith(".ico")
+                || normalizedUri.endsWith(".txt")
+                || normalizedUri.endsWith(".webmanifest")
+                || normalizedUri.endsWith(".js")
+                || normalizedUri.endsWith(".css")
+                || normalizedUri.endsWith(".mjs")
+                || normalizedUri.endsWith(".html")
+                || normalizedUri.endsWith(".toml")
+                || normalizedUri.endsWith(".wasm");
+    }
+
+    public static boolean isFrontendRoute(String contextPath, String requestURI) {
+        if (requestURI == null) {
+            return false;
+        }
+
+        String normalizedUri = stripContextPath(contextPath, requestURI);
+
+        // APIs are never treated as frontend routes
+        if (normalizedUri.startsWith("/api/")) {
+            return false;
+        }
+
+        // Blocklist of backend/non-frontend paths that should still go through filters
+        String[] backendOnlyPrefixes = {
+            "/register",
+            "/invite",
+            "/pipeline",
+            "/pdfjs",
+            "/pdfjs-legacy",
+            "/fonts",
+            "/images",
+            "/files",
+            "/css",
+            "/js",
+            "/swagger",
+            "/v1/api-docs",
+            "/actuator"
+        };
+
+        for (String prefix : backendOnlyPrefixes) {
+            if (normalizedUri.equals(prefix) || normalizedUri.startsWith(prefix + "/")) {
+                return false;
+            }
+        }
+
+        if (normalizedUri.isBlank()) {
+            return false;
+        }
+
+        // Allow root and any extensionless path (React Router will handle these)
+        return !normalizedUri.contains(".");
     }
 
     public static boolean isTrackableResource(String requestURI) {
@@ -43,10 +126,55 @@ public class RequestUriUtils {
                 || requestURI.endsWith(".svg")
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
+                || requestURI.endsWith(".toml")
+                || requestURI.endsWith(".wasm")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
                 || requestURI.startsWith("/fonts")
-                || requestURI.startsWith("/pdfjs"));
+                || requestURI.startsWith("/pdfjs")
+                || requestURI.startsWith("/pdfium"));
+    }
+
+    /**
+     * Checks if the request URI is a public authentication endpoint that doesn't require
+     * authentication. This includes login, signup, OAuth callbacks, and public config endpoints.
+     *
+     * @param requestURI The full request URI
+     * @param contextPath The servlet context path
+     * @return true if the endpoint is public and doesn't require authentication
+     */
+    public static boolean isPublicAuthEndpoint(String requestURI, String contextPath) {
+        // Remove context path from URI to normalize path matching
+        String trimmedUri =
+                requestURI.startsWith(contextPath)
+                        ? requestURI.substring(contextPath.length())
+                        : requestURI;
+
+        // Public auth endpoints that don't require authentication
+        return trimmedUri.startsWith("/login")
+                || trimmedUri.startsWith("/auth/")
+                || trimmedUri.startsWith("/oauth2")
+                || trimmedUri.startsWith("/saml2")
+                || trimmedUri.contains("/login/oauth2/code/") // Spring Security OAuth2 callback
+                || trimmedUri.contains("/oauth2/authorization/") // OAuth2 authorization endpoint
+                || trimmedUri.startsWith("/api/v1/auth/login")
+                || trimmedUri.startsWith("/api/v1/auth/refresh")
+                || trimmedUri.startsWith("/api/v1/auth/logout")
+                || trimmedUri.startsWith(
+                        "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
+                // enableLogin)
+                || trimmedUri.startsWith(
+                        "/api/v1/ui-data/footer-info") // Public footer configuration
+                || trimmedUri.startsWith("/api/v1/invite/validate")
+                || trimmedUri.startsWith("/api/v1/invite/accept")
+                || trimmedUri.startsWith("/v1/api-docs");
+    }
+
+    private static String stripContextPath(String contextPath, String requestURI) {
+        if (contextPath != null && !contextPath.isBlank() && requestURI.startsWith(contextPath)) {
+            return requestURI.substring(contextPath.length());
+        }
+        return requestURI;
     }
 }

app/common/src/main/java/stirling/software/common/util/YamlHelper.java

@@ -10,6 +10,7 @@ import java.util.Arrays;
 import java.util.Deque;
 import java.util.LinkedHashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
@@ -135,6 +136,17 @@ public class YamlHelper {
                 } else if ("true".equals(newValue) || "false".equals(newValue)) {
                     newValueNode =
                             new ScalarNode(Tag.BOOL, String.valueOf(newValue), ScalarStyle.PLAIN);
+                } else if (newValue instanceof Map<?, ?> map) {
+                    // Handle Map objects - convert to MappingNode
+                    List<NodeTuple> mapTuples = new ArrayList<>();
+                    for (Map.Entry<?, ?> entry : map.entrySet()) {
+                        ScalarNode mapKeyNode =
+                                new ScalarNode(
+                                        Tag.STR, String.valueOf(entry.getKey()), ScalarStyle.PLAIN);
+                        Node mapValueNode = convertValueToNode(entry.getValue());
+                        mapTuples.add(new NodeTuple(mapKeyNode, mapValueNode));
+                    }
+                    newValueNode = new MappingNode(Tag.MAP, mapTuples, FlowStyle.BLOCK);
                 } else if (newValue instanceof List<?> list) {
                     List<Node> sequenceNodes = new ArrayList<>();
                     for (Object item : list) {
@@ -458,6 +470,43 @@ public class YamlHelper {
         return isInteger(object) || isShort(object) || isByte(object) || isLong(object);
     }
 
+    /**
+     * Converts a Java value to a YAML Node.
+     *
+     * @param value The value to convert.
+     * @return The corresponding YAML Node.
+     */
+    private Node convertValueToNode(Object value) {
+        if (value == null) {
+            return new ScalarNode(Tag.NULL, "null", ScalarStyle.PLAIN);
+        } else if (isAnyInteger(value)) {
+            return new ScalarNode(Tag.INT, String.valueOf(value), ScalarStyle.PLAIN);
+        } else if (isFloat(value)) {
+            Object floatValue = Float.valueOf(String.valueOf(value));
+            return new ScalarNode(Tag.FLOAT, String.valueOf(floatValue), ScalarStyle.PLAIN);
+        } else if (value instanceof Boolean || "true".equals(value) || "false".equals(value)) {
+            return new ScalarNode(Tag.BOOL, String.valueOf(value), ScalarStyle.PLAIN);
+        } else if (value instanceof Map<?, ?> map) {
+            // Recursively handle nested maps
+            List<NodeTuple> mapTuples = new ArrayList<>();
+            for (Map.Entry<?, ?> entry : map.entrySet()) {
+                ScalarNode mapKeyNode =
+                        new ScalarNode(Tag.STR, String.valueOf(entry.getKey()), ScalarStyle.PLAIN);
+                Node mapValueNode = convertValueToNode(entry.getValue());
+                mapTuples.add(new NodeTuple(mapKeyNode, mapValueNode));
+            }
+            return new MappingNode(Tag.MAP, mapTuples, FlowStyle.BLOCK);
+        } else if (value instanceof List<?> list) {
+            List<Node> sequenceNodes = new ArrayList<>();
+            for (Object item : list) {
+                sequenceNodes.add(convertValueToNode(item));
+            }
+            return new SequenceNode(Tag.SEQ, sequenceNodes, FlowStyle.FLOW);
+        } else {
+            return new ScalarNode(Tag.STR, String.valueOf(value), ScalarStyle.PLAIN);
+        }
+    }
+
     /**
      * Copies comments from an old node to a new one.
      *

app/common/src/test/java/stirling/software/common/service/JobExecutorServiceTest.java

@@ -78,6 +78,23 @@ class JobExecutorServiceTest {
         verify(request).setAttribute(eq("jobId"), anyString());
     }
 
+    @Test
+    void shouldExposeJobIdInJobContextDuringSyncExecution() throws Exception {
+        // Given
+        Supplier<Object> work = stirling.software.common.util.JobContext::getJobId;
+
+        // When
+        ResponseEntity<?> response = jobExecutorService.runJobGeneric(false, work);
+
+        // Then
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertNotNull(response.getBody());
+
+        var requestJobIdCaptor = ArgumentCaptor.forClass(String.class);
+        verify(request).setAttribute(eq("jobId"), requestJobIdCaptor.capture());
+        assertEquals(requestJobIdCaptor.getValue(), response.getBody());
+    }
+
     @Test
     void shouldRunAsyncJobSuccessfully() throws Exception {
         // Given

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -24,6 +24,9 @@ public class RequestUriUtilsTest {
         assertTrue(
                 RequestUriUtils.isStaticResource("/pdfjs/pdf.worker.js"),
                 "PDF.js files should be static");
+        assertTrue(
+                RequestUriUtils.isStaticResource("/pdfium/pdfium.wasm"),
+                "PDFium wasm should be static");
         assertTrue(
                 RequestUriUtils.isStaticResource("/api/v1/info/status"),
                 "API status should be static");
@@ -49,6 +52,27 @@ public class RequestUriUtilsTest {
                 "API products should not be static");
     }
 
+    @Test
+    void testIsFrontendRoute() {
+        assertTrue(
+                RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
+        assertTrue(
+                RequestUriUtils.isFrontendRoute("", "/app/dashboard"),
+                "React routes without extensions should be frontend routes");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/api/v1/users"),
+                "API routes should not be frontend routes");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/register"),
+                "Register should not be treated as a frontend route");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/pipeline/jobs"),
+                "Pipeline should not be treated as a frontend route");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/files/download"),
+                "Files path should not be treated as a frontend route");
+    }
+
     @Test
     void testIsStaticResourceWithContextPath() {
         String contextPath = "/myapp";
@@ -83,12 +107,14 @@ public class RequestUriUtilsTest {
                 "/favicon.ico",
                 "/icon.svg",
                 "/image.png",
+                "/locales/en/translation.toml",
                 "/site.webmanifest",
                 "/app/logo.svg",
                 "/downloads/document.png",
                 "/assets/brand.ico",
                 "/any/path/with/image.svg",
-                "/deep/nested/folder/icon.png"
+                "/deep/nested/folder/icon.png",
+                "/pdfium/pdfium.wasm"
             })
     void testIsStaticResourceWithFileExtensions(String path) {
         assertTrue(
@@ -126,6 +152,9 @@ public class RequestUriUtilsTest {
         assertFalse(
                 RequestUriUtils.isTrackableResource("/script.js"),
                 "JS files should not be trackable");
+        assertFalse(
+                RequestUriUtils.isTrackableResource("/pdfium/pdfium.wasm"),
+                "PDFium wasm should not be trackable");
         assertFalse(
                 RequestUriUtils.isTrackableResource("/swagger/index.html"),
                 "Swagger files should not be trackable");
@@ -202,7 +231,8 @@ public class RequestUriUtilsTest {
                 "/api/v1/info/health",
                 "/site.webmanifest",
                 "/fonts/roboto.woff",
-                "/pdfjs/viewer.js"
+                "/pdfjs/viewer.js",
+                "/pdfium/pdfium.wasm"
             })
     void testNonTrackableResources(String path) {
         assertFalse(

app/core/build.gradle

@@ -1,5 +1,7 @@
 apply plugin: 'org.springframework.boot'
 
+import org.apache.tools.ant.taskdefs.condition.Os
+
 repositories {
     maven { url = 'https://build.shibboleth.net/maven/releases' }
     maven { url = 'https://maven.pkg.github.com/jcefmaven/jcefmaven' }
@@ -15,6 +17,7 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
+        targetExclude 'src/main/resources/static/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
@@ -25,12 +28,14 @@ spotless {
     }
     yaml {
         target '**/*.yml', '**/*.yaml'
+        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
     }
     format 'gradle', {
         target '**/gradle/*.gradle', '**/*.gradle'
+        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -41,7 +46,6 @@ dependencies {
     if (System.getenv('STIRLING_PDF_DESKTOP_UI') != 'false'
         || (project.hasProperty('STIRLING_PDF_DESKTOP_UI')
         && project.getProperty('STIRLING_PDF_DESKTOP_UI') != 'false')) {
-        implementation 'me.friwi:jcefmaven:132.3.1'
         implementation 'org.openjfx:javafx-controls:21'
         implementation 'org.openjfx:javafx-swing:21'
     }
@@ -158,5 +162,137 @@ springBoot {
     mainClass = 'stirling.software.SPDF.SPDFApplication'
 }
 
+// Frontend build tasks - only enabled with -PbuildWithFrontend=true
+def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
+def frontendDir = file('../../frontend')
+def frontendDistDir = file('../../frontend/dist')
+def resourcesStaticDir = file('src/main/resources/static')
+def generatedFrontendPaths = [
+    'assets',
+    'index.html',
+    'locales',
+    'Login',
+    'classic-logo',
+    'modern-logo',
+    'og_images',
+    'samples',
+    'manifest-classic.json'
+]
+
+tasks.register('npmInstall', Exec) {
+    enabled = buildWithFrontend
+    group = 'frontend'
+    description = 'Install frontend dependencies'
+    workingDir frontendDir
+    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
+    inputs.file(new File(frontendDir, 'package.json'))
+    inputs.file(new File(frontendDir, 'package-lock.json'))
+    outputs.dir(new File(frontendDir, 'node_modules'))
+
+    // Show live output
+    standardOutput = System.out
+    errorOutput = System.err
+
+    // Skip if node_modules exists and is up-to-date
+    onlyIf {
+        def nodeModules = new File(frontendDir, 'node_modules')
+        if (!nodeModules.exists()) {
+            println "node_modules not found, will install..."
+            return true
+        }
+        def packageJson = new File(frontendDir, 'package.json')
+        def packageLock = new File(frontendDir, 'package-lock.json')
+        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
+                        nodeModules.lastModified() < packageLock.lastModified()
+        if (isOutdated) {
+            println "package.json or package-lock.json changed, will reinstall..."
+        } else {
+            println "node_modules is up-to-date, skipping npm install"
+        }
+        return isOutdated
+    }
+
+    doFirst {
+        println "Installing npm dependencies in ${frontendDir}..."
+    }
+}
+
+tasks.register('npmBuild', Exec) {
+    enabled = buildWithFrontend
+    group = 'frontend'
+    description = 'Build frontend application'
+    workingDir frontendDir
+    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
+    dependsOn npmInstall
+    inputs.dir(new File(frontendDir, 'src'))
+    inputs.file(new File(frontendDir, 'package.json'))
+    outputs.dir(frontendDistDir)
+
+    // Show live output
+    standardOutput = System.out
+    errorOutput = System.err
+
+    // Override VITE_API_BASE_URL to use relative paths for production builds
+    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
+    environment 'VITE_API_BASE_URL', '/'
+
+    doFirst {
+        println "Building frontend application for production (VITE_API_BASE_URL=/)"
+    }
+}
+
+tasks.register('copyFrontendAssets', Copy) {
+    enabled = buildWithFrontend
+    group = 'frontend'
+    description = 'Copy frontend build to static resources'
+    dependsOn npmBuild
+    from(frontendDistDir) {
+        // Exclude files that conflict with backend static resources
+        exclude 'robots.txt'  // Backend already has this
+        exclude 'favicon.ico' // Backend already has this
+    }
+    into resourcesStaticDir
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
+    doFirst {
+        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
+        println "Backend static resources will be preserved"
+    }
+    doLast {
+        println "Frontend assets copied successfully!"
+    }
+}
+
+tasks.register('cleanFrontendAssets', Delete) {
+    group = 'frontend'
+    description = 'Remove previously generated frontend assets from static resources'
+    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
+}
+
+tasks.register('copyApiLandingPage', Copy) {
+    group = 'frontend'
+    description = 'Copy API landing page to index.html for backend-only mode'
+    from(new File(resourcesStaticDir, 'api-landing.html'))
+    into(resourcesStaticDir)
+    rename('api-landing.html', 'index.html')
+    dependsOn cleanFrontendAssets
+    doFirst {
+        println "Copying API landing page to index.html for backend-only mode..."
+    }
+}
+
+// Ensure copyFrontendAssets runs after spotless tasks
+tasks.named('copyFrontendAssets').configure {
+    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
+}
+
+if (buildWithFrontend) {
+    println "Frontend build enabled - JAR will include React frontend"
+    processResources.dependsOn copyFrontendAssets
+} else {
+    println "Frontend build disabled - JAR will be backend-only with API landing page"
+    // When not building the UI, ensure any stale frontend assets are removed and use API landing page
+    processResources.dependsOn copyApiLandingPage
+}
+
 bootJar.dependsOn ':common:jar'
 bootJar.dependsOn ':proprietary:jar'

app/core/src/main/java/stirling/software/SPDF/Factories/ReplaceAndInvertColorFactory.java

@@ -5,6 +5,7 @@ import org.springframework.web.multipart.MultipartFile;
 
 import lombok.RequiredArgsConstructor;
 
+import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.common.model.api.misc.HighContrastColorCombination;
 import stirling.software.common.model.api.misc.ReplaceAndInvert;
 import stirling.software.common.util.TempFileManager;
@@ -18,6 +19,7 @@ import stirling.software.common.util.misc.ReplaceAndInvertColorStrategy;
 public class ReplaceAndInvertColorFactory {
 
     private final TempFileManager tempFileManager;
+    private final EndpointConfiguration endpointConfiguration;
 
     public ReplaceAndInvertColorStrategy replaceAndInvert(
             MultipartFile file,
@@ -26,6 +28,13 @@ public class ReplaceAndInvertColorFactory {
             String backGroundColor,
             String textColor) {
 
+        // Check Ghostscript availability for CMYK conversion
+        if (replaceAndInvertOption == ReplaceAndInvert.COLOR_SPACE_CONVERSION
+                && !endpointConfiguration.isGroupEnabled("Ghostscript")) {
+            throw new IllegalStateException(
+                    "CMYK color space conversion requires Ghostscript, which is not available on this system");
+        }
+
         return switch (replaceAndInvertOption) {
             case CUSTOM_COLOR, HIGH_CONTRAST_COLOR ->
                     new CustomColorReplaceStrategy(

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -12,6 +12,8 @@ import java.util.Properties;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
@@ -136,14 +138,21 @@ public class SPDFApplication {
 
     @PostConstruct
     public void init() {
-        String baseUrl = appConfig.getBaseUrl();
+        String backendUrl = appConfig.getBackendUrl();
         String contextPath = appConfig.getContextPath();
         String serverPort = appConfig.getServerPort();
-        baseUrlStatic = baseUrl;
+        baseUrlStatic = backendUrl;
         contextPathStatic = contextPath;
         serverPortStatic = serverPort;
-        String url = baseUrl + ":" + getStaticPort() + contextPath;
+        String url = backendUrl + ":" + getStaticPort() + contextPath;
 
+        // Log Tauri mode information
+        if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_TAURI_MODE", "false"))) {
+            String parentPid = System.getenv("TAURI_PARENT_PID");
+            log.info(
+                    "Running in Tauri mode. Parent process PID: {}",
+                    parentPid != null ? parentPid : "not set");
+        }
         // Desktop UI initialization removed - webBrowser dependency eliminated
         // Keep backwards compatibility for STIRLING_PDF_DESKTOP_UI system property
         if (Boolean.parseBoolean(System.getProperty("STIRLING_PDF_DESKTOP_UI", "false"))) {
@@ -191,6 +200,14 @@ public class SPDFApplication {
         // }
     }
 
+    @EventListener
+    public void onWebServerInitialized(WebServerInitializedEvent event) {
+        int actualPort = event.getWebServer().getPort();
+        serverPortStatic = String.valueOf(actualPort);
+        // Log the actual runtime port for Tauri to parse
+        log.info("Stirling-PDF running on port: {}", actualPort);
+    }
+
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
         String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -12,6 +12,7 @@ import jakarta.annotation.PostConstruct;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.RegexPatternUtils;
 
@@ -24,6 +25,7 @@ public class ExternalAppDepConfig {
     private final String weasyprintPath;
     private final String unoconvPath;
     private final Map<String, List<String>> commandToGroupMapping;
+    private volatile boolean dependenciesChecked = false;
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -44,6 +46,7 @@ public class ExternalAppDepConfig {
                         put("qpdf", List.of("qpdf"));
                         put("tesseract", List.of("tesseract"));
                         put("rar", List.of("rar")); // Required for real CBR output
+                        put("magick", List.of("ImageMagick"));
                     }
                 };
     }
@@ -97,7 +100,7 @@ public class ExternalAppDepConfig {
             if (affectedGroups != null) {
                 for (String group : affectedGroups) {
                     List<String> affectedFeatures = getAffectedFeatures(group);
-                    endpointConfiguration.disableGroup(group);
+                    endpointConfiguration.disableGroup(group, DisableReason.DEPENDENCY);
                     log.warn(
                             "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                             command,
@@ -110,6 +113,10 @@ public class ExternalAppDepConfig {
         }
     }
 
+    public boolean isDependenciesChecked() {
+        return dependenciesChecked;
+    }
+
     @PostConstruct
     public void checkDependencies() {
         // Check core dependencies
@@ -122,13 +129,14 @@ public class ExternalAppDepConfig {
         checkDependencyAndDisableGroup("pdftohtml");
         checkDependencyAndDisableGroup(unoconvPath);
         checkDependencyAndDisableGroup("rar");
+        checkDependencyAndDisableGroup("magick");
         // Special handling for Python/OpenCV dependencies
         boolean pythonAvailable = isCommandAvailable("python3") || isCommandAvailable("python");
         if (!pythonAvailable) {
             List<String> pythonFeatures = getAffectedFeatures("Python");
             List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup("Python");
-            endpointConfiguration.disableGroup("OpenCV");
+            endpointConfiguration.disableGroup("Python", DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
             log.warn(
                     "Missing dependency: Python - Disabling Python features: {} and OpenCV features: {}",
                     String.join(", ", pythonFeatures),
@@ -146,14 +154,14 @@ public class ExternalAppDepConfig {
                 int exitCode = process.waitFor();
                 if (exitCode != 0) {
                     List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                    endpointConfiguration.disableGroup("OpenCV");
+                    endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                     log.warn(
                             "OpenCV not available in Python - Disabling OpenCV features: {}",
                             String.join(", ", openCVFeatures));
                 }
             } catch (Exception e) {
                 List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                endpointConfiguration.disableGroup("OpenCV");
+                endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                 log.warn(
                         "Error checking OpenCV: {} - Disabling OpenCV features: {}",
                         e.getMessage(),
@@ -161,5 +169,7 @@ public class ExternalAppDepConfig {
             }
         }
         endpointConfiguration.logDisabledEndpointsSummary();
+        dependenciesChecked = true;
+        log.info("Dependency checks completed");
     }
 }

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -28,11 +28,12 @@ public class InitialSetup {
 
     private final ApplicationProperties applicationProperties;
 
+    private static boolean isNewServer = false;
+
     @PostConstruct
     public void init() throws IOException {
         initUUIDKey();
         initSecretKey();
-        initEnableCSRFSecurity();
         initLegalUrls();
         initSetAppVersion();
         GeneralUtils.extractPipeline();
@@ -58,18 +59,6 @@ public class InitialSetup {
         }
     }
 
-    public void initEnableCSRFSecurity() throws IOException {
-        if (GeneralUtils.isVersionHigher(
-                "0.46.0", applicationProperties.getAutomaticallyGenerated().getAppVersion())) {
-            Boolean csrf = applicationProperties.getSecurity().getCsrfDisabled();
-            if (!csrf) {
-                GeneralUtils.saveKeyToSettings("security.csrfDisabled", false);
-                GeneralUtils.saveKeyToSettings("system.enableAnalytics", true);
-                applicationProperties.getSecurity().setCsrfDisabled(false);
-            }
-        }
-    }
-
     public void initLegalUrls() throws IOException {
         // Initialize Terms and Conditions
         String termsUrl = applicationProperties.getLegal().getTermsAndConditions();
@@ -88,6 +77,13 @@ public class InitialSetup {
     }
 
     public void initSetAppVersion() throws IOException {
+        // Check if this is a new server before setting the version
+        String existingVersion = applicationProperties.getAutomaticallyGenerated().getAppVersion();
+        isNewServer =
+                existingVersion == null
+                        || existingVersion.isEmpty()
+                        || "0.0.0".equals(existingVersion);
+
         String appVersion = "0.0.0";
         Resource resource = new ClassPathResource("version.properties");
         Properties props = new Properties();
@@ -98,5 +94,10 @@ public class InitialSetup {
         }
         GeneralUtils.saveKeyToSettings("AutomaticallyGenerated.appVersion", appVersion);
         applicationProperties.getAutomaticallyGenerated().setAppVersion(appVersion);
+        applicationProperties.getAutomaticallyGenerated().setIsNewServer(isNewServer);
+    }
+
+    public static boolean isNewServer() {
+        return isNewServer;
     }
 }

app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java

@@ -62,10 +62,15 @@ public class OpenApiConfig {
 
         // Add server configuration from environment variable
         String swaggerServerUrl = System.getenv("SWAGGER_SERVER_URL");
+        Server server;
         if (swaggerServerUrl != null && !swaggerServerUrl.trim().isEmpty()) {
-            Server server = new Server().url(swaggerServerUrl).description("API Server");
-            openAPI.addServersItem(server);
+            server = new Server().url(swaggerServerUrl).description("API Server");
+        } else {
+            // Use relative path so Swagger uses the current browser origin to avoid CORS issues
+            // when accessing via different ports
+            server = new Server().url("/").description("Current Server");
         }
+        openAPI.addServersItem(server);
 
         // Add ErrorResponse schema to components
         Schema<?> errorResponseSchema =

app/core/src/main/java/stirling/software/SPDF/config/SpringDocConfig.java

@@ -21,6 +21,9 @@ public class SpringDocConfig {
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
                         "/api/v1/team/**",
+                        "/api/v1/auth/**",
+                        "/api/v1/invite/**",
+                        "/api/v1/audit/**",
                         "/api/v1/ui-data/**",
                         "/api/v1/proprietary/ui-data/**",
                         "/api/v1/info/**",
@@ -33,7 +36,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - Processing API")
                                             .description(
-                                                    "API documentation for PDF processing operations including conversion, manipulation, security, and utilities."));
+                                                    "APIs for converting, editing, securing, and analysing PDF documents. Use these endpoints to automate common PDF tasks (like split, merge, convert, OCR) and plug them into your own apps and backend jobs."));
                         })
                 .build();
     }
@@ -47,14 +50,17 @@ public class SpringDocConfig {
                         "/api/v1/admin/**",
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
-                        "/api/v1/team/**")
+                        "/api/v1/team/**",
+                        "/api/v1/auth/**",
+                        "/api/v1/invite/**",
+                        "/api/v1/audit/**")
                 .addOpenApiCustomizer(
                         openApi -> {
                             openApi.info(
                                     openApi.getInfo()
-                                            .title("Stirling PDF - Admin API")
+                                            .title("Stirling PDF - Management API")
                                             .description(
-                                                    "API documentation for administrative functions, user management, and system configuration."));
+                                                    "Endpoints for authentication, user management, invitations, audit logging, and system configuration."));
                         })
                 .build();
     }
@@ -76,7 +82,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - System API")
                                             .description(
-                                                    "API documentation for system information, UI data, and utility endpoints."));
+                                                    "System information, UI metadata, job status, and file management endpoints."));
                         })
                 .build();
     }

app/core/src/main/java/stirling/software/SPDF/config/TauriProcessMonitor.java

@@ -0,0 +1,157 @@
+package stirling.software.SPDF.config;
+
+import java.lang.management.ManagementFactory;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.stereotype.Component;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+
+/**
+ * Monitor for Tauri parent process to detect orphaned Java backend processes. When running in Tauri
+ * mode, this component periodically checks if the parent Tauri process is still alive. If the
+ * parent process terminates unexpectedly, this will trigger a graceful shutdown of the Java backend
+ * to prevent orphaned processes.
+ */
+@Component
+@ConditionalOnProperty(name = "STIRLING_PDF_TAURI_MODE", havingValue = "true")
+public class TauriProcessMonitor {
+
+    private static final Logger logger = LoggerFactory.getLogger(TauriProcessMonitor.class);
+
+    private final ApplicationContext applicationContext;
+    private String parentProcessId;
+    private ScheduledExecutorService scheduler;
+    private volatile boolean monitoring = false;
+
+    public TauriProcessMonitor(ApplicationContext applicationContext) {
+        this.applicationContext = applicationContext;
+    }
+
+    @PostConstruct
+    public void init() {
+        parentProcessId = System.getenv("TAURI_PARENT_PID");
+
+        if (parentProcessId != null && !parentProcessId.trim().isEmpty()) {
+            logger.info("Tauri mode detected. Parent process ID: {}", parentProcessId);
+            startMonitoring();
+        } else {
+            logger.warn(
+                    "TAURI_PARENT_PID environment variable not found. Tauri process monitoring disabled.");
+        }
+    }
+
+    private void startMonitoring() {
+        scheduler =
+                Executors.newSingleThreadScheduledExecutor(
+                        r -> {
+                            Thread t = new Thread(r, "tauri-process-monitor");
+                            t.setDaemon(true);
+                            return t;
+                        });
+
+        monitoring = true;
+
+        // Check every 5 seconds
+        scheduler.scheduleAtFixedRate(this::checkParentProcess, 5, 5, TimeUnit.SECONDS);
+
+        logger.info("Started monitoring parent Tauri process (PID: {})", parentProcessId);
+    }
+
+    private void checkParentProcess() {
+        if (!monitoring) {
+            return;
+        }
+
+        try {
+            if (!isProcessAlive(parentProcessId)) {
+                logger.warn(
+                        "Parent Tauri process (PID: {}) is no longer alive. Initiating graceful shutdown...",
+                        parentProcessId);
+                initiateGracefulShutdown();
+            }
+        } catch (Exception e) {
+            logger.error("Error checking parent process status", e);
+        }
+    }
+
+    private boolean isProcessAlive(String pid) {
+        try {
+            long processId = Long.parseLong(pid);
+
+            // Check if process exists using ProcessHandle (Java 9+)
+            return ProcessHandle.of(processId).isPresent();
+
+        } catch (NumberFormatException e) {
+            logger.error("Invalid parent process ID format: {}", pid);
+            return false;
+        } catch (Exception e) {
+            logger.error("Error checking if process {} is alive", pid, e);
+            return false;
+        }
+    }
+
+    private void initiateGracefulShutdown() {
+        monitoring = false;
+
+        logger.info("Orphaned Java backend detected. Shutting down gracefully...");
+
+        // Shutdown asynchronously to avoid blocking the monitor thread
+        CompletableFuture.runAsync(
+                () -> {
+                    try {
+                        // Give a small delay to ensure logging completes
+                        Thread.sleep(1000);
+
+                        if (applicationContext instanceof ConfigurableApplicationContext) {
+                            ((ConfigurableApplicationContext) applicationContext).close();
+                        } else {
+                            // Fallback to system exit
+                            logger.warn(
+                                    "Unable to shutdown Spring context gracefully, using System.exit");
+                            System.exit(0);
+                        }
+                    } catch (Exception e) {
+                        logger.error("Error during graceful shutdown", e);
+                        System.exit(1);
+                    }
+                });
+    }
+
+    @PreDestroy
+    public void cleanup() {
+        monitoring = false;
+
+        if (scheduler != null && !scheduler.isShutdown()) {
+            logger.info("Shutting down Tauri process monitor");
+            scheduler.shutdown();
+
+            try {
+                if (!scheduler.awaitTermination(2, TimeUnit.SECONDS)) {
+                    scheduler.shutdownNow();
+                }
+            } catch (InterruptedException e) {
+                scheduler.shutdownNow();
+                Thread.currentThread().interrupt();
+            }
+        }
+    }
+
+    /** Get the current Java process ID for logging/debugging purposes */
+    public static String getCurrentProcessId() {
+        try {
+            return ManagementFactory.getRuntimeMXBean().getName().split("@")[0];
+        } catch (Exception e) {
+            return "unknown";
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/config/WAUTrackingFilter.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.config;
+
+import java.io.IOException;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
+
+/**
+ * Filter to track browser IDs for Weekly Active Users (WAU) counting. Only active when security is
+ * disabled (no-login mode).
+ */
+@Component
+@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
+@RequiredArgsConstructor
+@Slf4j
+public class WAUTrackingFilter implements Filter {
+
+    private final WeeklyActiveUsersService wauService;
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        if (request instanceof HttpServletRequest httpRequest) {
+            // Extract browser ID from header
+            String browserId = httpRequest.getHeader("X-Browser-Id");
+
+            if (browserId != null && !browserId.trim().isEmpty()) {
+                // Record browser access
+                wauService.recordBrowserAccess(browserId);
+            }
+        }
+
+        // Continue the filter chain
+        chain.doFilter(request, response);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -1,8 +1,14 @@
 package stirling.software.SPDF.config;
 
+import java.util.concurrent.TimeUnit;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.CacheControl;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import lombok.RequiredArgsConstructor;
@@ -16,17 +22,94 @@ public class WebMvcConfig implements WebMvcConfigurer {
     private final EndpointInterceptor endpointInterceptor;
     private final ApplicationProperties applicationProperties;
 
+    private static final Logger logger = LoggerFactory.getLogger(WebMvcConfig.class);
+
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(endpointInterceptor);
     }
 
+    @Override
+    public void addResourceHandlers(ResourceHandlerRegistry registry) {
+        // Cache hashed assets (JS/CSS with content hashes) for 1 year
+        // These files have names like index-ChAS4tCC.js that change when content changes
+        // Check customFiles/static first, then fall back to classpath
+        registry.addResourceHandler("/assets/**")
+                .addResourceLocations(
+                        "file:"
+                                + stirling.software.common.configuration.InstallationPathConfig
+                                        .getStaticPath()
+                                + "assets/",
+                        "classpath:/static/assets/")
+                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS).cachePublic());
+
+        // Don't cache index.html - it needs to be fresh to reference latest hashed assets
+        // Note: index.html is handled by ReactRoutingController for dynamic processing
+        registry.addResourceHandler("/index.html")
+                .addResourceLocations(
+                        "file:"
+                                + stirling.software.common.configuration.InstallationPathConfig
+                                        .getStaticPath(),
+                        "classpath:/static/")
+                .setCacheControl(CacheControl.noCache().mustRevalidate());
+
+        // Handle all other static resources (js, css, images, fonts, etc.)
+        // Check customFiles/static first for user overrides
+        registry.addResourceHandler("/**")
+                .addResourceLocations(
+                        "file:"
+                                + stirling.software.common.configuration.InstallationPathConfig
+                                        .getStaticPath(),
+                        "classpath:/static/")
+                .setCacheControl(CacheControl.maxAge(1, TimeUnit.HOURS));
+    }
+
     @Override
     public void addCorsMappings(CorsRegistry registry) {
-        // Only configure CORS if allowed origins are specified
-        if (applicationProperties.getSystem() != null
-                && applicationProperties.getSystem().getCorsAllowedOrigins() != null
-                && !applicationProperties.getSystem().getCorsAllowedOrigins().isEmpty()) {
+        // Check if running in Tauri mode
+        boolean isTauriMode =
+                Boolean.parseBoolean(System.getProperty("STIRLING_PDF_TAURI_MODE", "false"));
+
+        // Check if user has configured custom origins
+        boolean hasConfiguredOrigins =
+                applicationProperties.getSystem() != null
+                        && applicationProperties.getSystem().getCorsAllowedOrigins() != null
+                        && !applicationProperties.getSystem().getCorsAllowedOrigins().isEmpty();
+
+        if (isTauriMode) {
+            // Automatically enable CORS for Tauri desktop app
+            // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
+            logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
+            registry.addMapping("/**")
+                    .allowedOriginPatterns(
+                            "tauri://localhost",
+                            "http://tauri.localhost",
+                            "https://tauri.localhost")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
+                    .allowCredentials(true)
+                    .maxAge(3600);
+        } else if (hasConfiguredOrigins) {
+            // Use user-configured origins
+            logger.info(
+                    "Configuring CORS with allowed origins: {}",
+                    applicationProperties.getSystem().getCorsAllowedOrigins());
 
             String[] allowedOrigins =
                     applicationProperties
@@ -35,21 +118,53 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             .toArray(new String[0]);
 
             registry.addMapping("/**")
-                    .allowedOrigins(allowedOrigins)
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedOriginPatterns(allowedOrigins)
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
+                    .allowCredentials(true)
+                    .maxAge(3600);
+        } else {
+            // Default to allowing all origins when nothing is configured
+            logger.info(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            registry.addMapping("/**")
+                    .allowedOriginPatterns("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         }
-        // If no origins are configured, CORS is not enabled (secure by default)
     }
-
-    // @Override
-    // public void addResourceHandlers(ResourceHandlerRegistry registry) {
-    //     // Handler for external static resources - DISABLED in backend-only mode
-    //     registry.addResourceHandler("/**")
-    //             .addResourceLocations(
-    //                     "file:" + InstallationPathConfig.getStaticPath(), "classpath:/static/");
-    //     // .setCachePeriod(0); // Optional: disable caching
-    // }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/CropController.java

@@ -22,6 +22,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.general.CropPdfForm;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -37,6 +38,11 @@ import stirling.software.common.util.WebResponseUtils;
 public class CropController {
 
     private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final EndpointConfiguration endpointConfiguration;
+
+    private boolean isGhostscriptEnabled() {
+        return endpointConfiguration.isGroupEnabled("Ghostscript");
+    }
 
     @AutoJobPostMapping(value = "/crop", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @StandardPdfResponse
@@ -46,9 +52,13 @@ public class CropController {
                     "This operation takes an input PDF file and crops it according to the given"
                             + " coordinates. Input:PDF Output:PDF Type:SISO")
     public ResponseEntity<byte[]> cropPdf(@ModelAttribute CropPdfForm request) throws IOException {
-        if (request.isRemoveDataOutsideCrop()) {
+        if (request.isRemoveDataOutsideCrop() && isGhostscriptEnabled()) {
             return cropWithGhostscript(request);
         } else {
+            if (request.isRemoveDataOutsideCrop()) {
+                log.warn(
+                        "Ghostscript not available - 'removeDataOutsideCrop' option requires Ghostscript. Falling back to visual crop only.");
+            }
             return cropWithPDFBox(request);
         }
     }

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -29,7 +29,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.SPDF.config.swagger.JsonDataResponse;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.EditTableOfContentsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -49,13 +48,12 @@ public class EditTableOfContentsController {
     @AutoJobPostMapping(
             value = "/extract-bookmarks",
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
-    @JsonDataResponse
     @Operation(
             summary = "Extract PDF Bookmarks",
             description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
     @ResponseBody
-    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
-            throws Exception {
+    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
+            @RequestParam("file") MultipartFile file) throws Exception {
         PDDocument document = null;
         try {
             document = pdfDocumentFactory.load(file);
@@ -63,10 +61,10 @@ public class EditTableOfContentsController {
 
             if (outline == null) {
                 log.info("No outline/bookmarks found in PDF");
-                return new ArrayList<>();
+                return ResponseEntity.ok(new ArrayList<>());
             }
 
-            return extractBookmarkItems(document, outline);
+            return ResponseEntity.ok(extractBookmarkItems(document, outline));
         } finally {
             if (document != null) {
                 document.close();

app/core/src/main/java/stirling/software/SPDF/controller/api/MultiPageLayoutController.java

@@ -26,7 +26,6 @@ import stirling.software.SPDF.model.api.general.MergeMultiplePagesRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.FormUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;
 
@@ -137,26 +136,6 @@ public class MultiPageLayoutController {
 
         contentStream.close();
 
-        // If any source page is rotated, skip form copying/transformation entirely
-        boolean hasRotation = FormUtils.hasAnyRotatedPage(sourceDocument);
-        if (hasRotation) {
-            log.info("Source document has rotated pages; skipping form field copying.");
-        } else {
-            try {
-                FormUtils.copyAndTransformFormFields(
-                        sourceDocument,
-                        newDocument,
-                        totalPages,
-                        pagesPerSheet,
-                        cols,
-                        rows,
-                        cellWidth,
-                        cellHeight);
-            } catch (Exception e) {
-                log.warn("Failed to copy and transform form fields: {}", e.getMessage(), e);
-            }
-        }
-
         sourceDocument.close();
 
         ByteArrayOutputStream baos = new ByteArrayOutputStream();

app/core/src/main/java/stirling/software/SPDF/controller/api/SettingsController.java

@@ -124,7 +124,6 @@ public class SettingsController {
         ApplicationProperties.Security security = applicationProperties.getSecurity();
 
         settings.put("enableLogin", security.getEnableLogin());
-        settings.put("csrfDisabled", security.getCsrfDisabled());
         settings.put("loginMethod", security.getLoginMethod());
         settings.put("loginAttemptCount", security.getLoginAttemptCount());
         settings.put("loginResetTimeMinutes", security.getLoginResetTimeMinutes());
@@ -159,12 +158,6 @@ public class SettingsController {
                     .getSecurity()
                     .setEnableLogin((Boolean) settings.get("enableLogin"));
         }
-        if (settings.containsKey("csrfDisabled")) {
-            GeneralUtils.saveKeyToSettings("security.csrfDisabled", settings.get("csrfDisabled"));
-            applicationProperties
-                    .getSecurity()
-                    .setCsrfDisabled((Boolean) settings.get("csrfDisabled"));
-        }
         if (settings.containsKey("loginMethod")) {
             GeneralUtils.saveKeyToSettings("security.loginMethod", settings.get("loginMethod"));
             applicationProperties

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -26,7 +26,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.Dependency;
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SignatureService;
+import stirling.software.SPDF.service.SharedSignatureService;
 import stirling.software.common.annotations.api.UiDataApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
@@ -40,14 +40,14 @@ import stirling.software.common.util.GeneralUtils;
 public class UIDataController {
 
     private final ApplicationProperties applicationProperties;
-    private final SignatureService signatureService;
+    private final SharedSignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
-            SignatureService signatureService,
+            SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {
@@ -58,6 +58,21 @@ public class UIDataController {
         this.runtimePathConfig = runtimePathConfig;
     }
 
+    @GetMapping("/footer-info")
+    @Operation(summary = "Get public footer configuration data")
+    public ResponseEntity<FooterData> getFooterData() {
+        FooterData data = new FooterData();
+        data.setAnalyticsEnabled(applicationProperties.getSystem().getEnableAnalytics());
+        data.setTermsAndConditions(applicationProperties.getLegal().getTermsAndConditions());
+        data.setPrivacyPolicy(applicationProperties.getLegal().getPrivacyPolicy());
+        data.setAccessibilityStatement(
+                applicationProperties.getLegal().getAccessibilityStatement());
+        data.setCookiePolicy(applicationProperties.getLegal().getCookiePolicy());
+        data.setImpressum(applicationProperties.getLegal().getImpressum());
+
+        return ResponseEntity.ok(data);
+    }
+
     @GetMapping("/home")
     @Operation(summary = "Get home page data")
     public ResponseEntity<HomeData> getHomeData() {
@@ -237,6 +252,16 @@ public class UIDataController {
     }
 
     // Data classes
+    @Data
+    public static class FooterData {
+        private Boolean analyticsEnabled;
+        private String termsAndConditions;
+        private String privacyPolicy;
+        private String accessibilityStatement;
+        private String cookiePolicy;
+        private String impressum;
+    }
+
     @Data
     public static class HomeData {
         private boolean showSurveyFromDocker;

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -0,0 +1,225 @@
+package stirling.software.SPDF.controller.api.converters;
+
+import java.util.Optional;
+import java.util.UUID;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.multipart.MultipartFile;
+
+import io.github.pixee.security.Filenames;
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.config.swagger.StandardPdfResponse;
+import stirling.software.SPDF.model.json.PdfJsonDocument;
+import stirling.software.SPDF.model.json.PdfJsonMetadata;
+import stirling.software.SPDF.service.PdfJsonConversionService;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.ConvertApi;
+import stirling.software.common.model.api.GeneralFile;
+import stirling.software.common.model.api.PDFFile;
+import stirling.software.common.service.JobOwnershipService;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.WebResponseUtils;
+
+@Slf4j
+@ConvertApi
+@RequiredArgsConstructor
+public class ConvertPdfJsonController {
+
+    private final PdfJsonConversionService pdfJsonConversionService;
+
+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
+
+    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor")
+    @Operation(
+            summary = "Convert PDF to Text Editor Format",
+            description =
+                    "Extracts PDF text, fonts, and metadata into an editable JSON structure for the text editor tool. Input:PDF Output:JSON Type:SISO")
+    public ResponseEntity<byte[]> convertPdfToJson(
+            @ModelAttribute PDFFile request,
+            @RequestParam(value = "lightweight", defaultValue = "false") boolean lightweight)
+            throws Exception {
+        MultipartFile inputFile = request.getFileInput();
+        if (inputFile == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        byte[] jsonBytes = pdfJsonConversionService.convertPdfToJson(inputFile, lightweight);
+        String originalName = inputFile.getOriginalFilename();
+        String baseName =
+                (originalName != null && !originalName.isBlank())
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        : "document";
+        String docName = baseName + ".json";
+        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+    }
+
+    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/text-editor/pdf")
+    @StandardPdfResponse
+    @Operation(
+            summary = "Convert Text Editor Format to PDF",
+            description =
+                    "Rebuilds a PDF from the editable JSON structure generated by the text editor tool. Input:JSON Output:PDF Type:SISO")
+    public ResponseEntity<byte[]> convertJsonToPdf(@ModelAttribute GeneralFile request)
+            throws Exception {
+        MultipartFile jsonFile = request.getFileInput();
+        if (jsonFile == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        byte[] pdfBytes = pdfJsonConversionService.convertJsonToPdf(jsonFile);
+        String originalName = jsonFile.getOriginalFilename();
+        String baseName =
+                (originalName != null && !originalName.isBlank())
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        : "document";
+        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
+        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
+    }
+
+    @PostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor/metadata")
+    @Operation(
+            summary = "Extract PDF metadata for text editor lazy loading",
+            description =
+                    "Extracts document metadata, fonts, and page dimensions for the text editor tool. Caches the document for"
+                            + " subsequent page requests. Returns a server-generated jobId scoped to the"
+                            + " authenticated user. Input:PDF Output:JSON Type:SISO")
+    public ResponseEntity<byte[]> extractPdfMetadata(@ModelAttribute PDFFile request)
+            throws Exception {
+        MultipartFile inputFile = request.getFileInput();
+        if (inputFile == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        // Generate server-side UUID for job
+        String baseJobId = UUID.randomUUID().toString();
+
+        // Scope job to authenticated user if security is enabled
+        String scopedJobKey = getScopedJobKey(baseJobId);
+
+        log.info("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);
+
+        byte[] jsonBytes =
+                pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey);
+        String originalName = inputFile.getOriginalFilename();
+        String baseName =
+                (originalName != null && !originalName.isBlank())
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        : "document";
+        String docName = baseName + "_metadata.json";
+
+        // Return jobId in response header for client
+        return ResponseEntity.ok()
+                .header("X-Job-Id", scopedJobKey)
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(jsonBytes);
+    }
+
+    @PostMapping(
+            value = "/pdf/text-editor/partial/{jobId}",
+            consumes = MediaType.APPLICATION_JSON_VALUE)
+    @StandardPdfResponse
+    @Operation(
+            summary = "Apply incremental edits from text editor to a cached PDF",
+            description =
+                    "Applies edits for the specified pages of a cached PDF and returns an updated PDF."
+                            + " Requires the PDF to have been previously cached via the text editor metadata endpoint."
+                            + " The jobId must be obtained from the metadata extraction endpoint.")
+    public ResponseEntity<byte[]> exportPartialPdf(
+            @PathVariable String jobId,
+            @RequestBody PdfJsonDocument document,
+            @RequestParam(value = "filename", required = false) String filename)
+            throws Exception {
+        if (document == null) {
+            throw ExceptionUtils.createNullArgumentException("document");
+        }
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        byte[] pdfBytes = pdfJsonConversionService.exportUpdatedPages(jobId, document);
+
+        String baseName =
+                (filename != null && !filename.isBlank())
+                        ? Filenames.toSimpleFileName(filename).replaceFirst("[.][^.]+$", "")
+                        : Optional.ofNullable(document.getMetadata())
+                                .map(PdfJsonMetadata::getTitle)
+                                .filter(title -> title != null && !title.isBlank())
+                                .orElse("document");
+        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
+        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
+    }
+
+    @GetMapping(value = "/pdf/text-editor/page/{jobId}/{pageNumber}")
+    @Operation(
+            summary = "Extract single page from cached PDF for text editor",
+            description =
+                    "Retrieves a single page's content from a previously cached PDF document for the text editor tool."
+                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
+                            + " authenticated user. Output:JSON")
+    public ResponseEntity<byte[]> extractSinglePage(
+            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        byte[] jsonBytes = pdfJsonConversionService.extractSinglePage(jobId, pageNumber);
+        String docName = "page_" + pageNumber + ".json";
+        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+    }
+
+    @PostMapping(value = "/pdf/text-editor/clear-cache/{jobId}")
+    @Operation(
+            summary = "Clear cached PDF document for text editor",
+            description =
+                    "Manually clears a cached PDF document used by the text editor to free up server resources."
+                            + " Called automatically after 30 minutes. The jobId must belong to the"
+                            + " authenticated user.")
+    public ResponseEntity<Void> clearCache(@PathVariable String jobId) {
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        pdfJsonConversionService.clearCachedDocument(jobId);
+        return ResponseEntity.ok().build();
+    }
+
+    /**
+     * Get a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param baseJobId the base job identifier
+     * @return scoped job key, or just baseJobId if no ownership service available
+     */
+    private String getScopedJobKey(String baseJobId) {
+        if (jobOwnershipService != null) {
+            return jobOwnershipService.createScopedJobKey(baseJobId);
+        }
+        // Security disabled, return unsecured job key
+        return baseJobId;
+    }
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param jobId the job identifier to validate
+     * @throws SecurityException if current user does not own the job
+     */
+    private void validateJobAccess(String jobId) {
+        if (jobOwnershipService != null) {
+            jobOwnershipService.validateJobAccess(jobId);
+        }
+        // If jobOwnershipService is null (security disabled), allow all access
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -0,0 +1,60 @@
+package stirling.software.SPDF.controller.api.converters;
+
+import java.nio.charset.StandardCharsets;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.exception.CacheUnavailableException;
+
+@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
+@Slf4j
+@RequiredArgsConstructor
+public class ConvertPdfJsonExceptionHandler {
+
+    private final ObjectMapper objectMapper;
+
+    @ExceptionHandler(CacheUnavailableException.class)
+    @ResponseBody
+    public ResponseEntity<byte[]> handleCacheUnavailable(CacheUnavailableException ex) {
+        try {
+            byte[] body =
+                    objectMapper.writeValueAsBytes(
+                            java.util.Map.of(
+                                    "error", "cache_unavailable",
+                                    "action", "reupload",
+                                    "message", ex.getMessage()));
+            return ResponseEntity.status(HttpStatus.GONE)
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .body(body);
+        } catch (Exception e) {
+            log.warn("Failed to serialize cache_unavailable response", e);
+            var fallbackBody =
+                    java.util.Map.of(
+                            "error", "cache_unavailable",
+                            "action", "reupload",
+                            "message", String.valueOf(ex.getMessage()));
+            try {
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .body(objectMapper.writeValueAsBytes(fallbackBody));
+            } catch (Exception ignored) {
+                // Truly last-ditch fallback
+                return ResponseEntity.status(HttpStatus.GONE)
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .body(
+                                "{\"error\":\"cache_unavailable\",\"action\":\"reupload\",\"message\":\"Cache unavailable\"}"
+                                        .getBytes(StandardCharsets.UTF_8));
+            }
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/CompressController.java

@@ -28,10 +28,13 @@ import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.graphics.PDXObject;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -44,6 +47,7 @@ import stirling.software.SPDF.model.api.misc.OptimizePdfRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.MiscApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.service.LineArtConversionService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
@@ -58,6 +62,9 @@ public class CompressController {
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final EndpointConfiguration endpointConfiguration;
 
+    @Autowired(required = false)
+    private LineArtConversionService lineArtConversionService;
+
     private boolean isQpdfEnabled() {
         return endpointConfiguration.isGroupEnabled("qpdf");
     }
@@ -66,6 +73,10 @@ public class CompressController {
         return endpointConfiguration.isGroupEnabled("Ghostscript");
     }
 
+    private boolean isImageMagickEnabled() {
+        return endpointConfiguration.isGroupEnabled("ImageMagick");
+    }
+
     @Data
     @AllArgsConstructor
     @NoArgsConstructor
@@ -660,6 +671,9 @@ public class CompressController {
         Integer optimizeLevel = request.getOptimizeLevel();
         String expectedOutputSizeString = request.getExpectedOutputSize();
         Boolean convertToGrayscale = request.getGrayscale();
+        Boolean convertToLineArt = request.getLineArt();
+        Double lineArtThreshold = request.getLineArtThreshold();
+        Integer lineArtEdgeLevel = request.getLineArtEdgeLevel();
         if (expectedOutputSizeString == null && optimizeLevel == null) {
             throw new Exception("Both expected output size and optimize level are not specified");
         }
@@ -689,6 +703,26 @@ public class CompressController {
                 optimizeLevel = determineOptimizeLevel(sizeReductionRatio);
             }
 
+            if (Boolean.TRUE.equals(convertToLineArt)) {
+                if (lineArtConversionService == null) {
+                    throw new ResponseStatusException(
+                            HttpStatus.FORBIDDEN,
+                            "Line art conversion is unavailable - ImageMagick service not found");
+                }
+                if (!isImageMagickEnabled()) {
+                    throw new IOException(
+                            "ImageMagick is not enabled but line art conversion was requested");
+                }
+                double thresholdValue =
+                        lineArtThreshold == null
+                                ? 55d
+                                : Math.min(100d, Math.max(0d, lineArtThreshold));
+                int edgeLevel =
+                        lineArtEdgeLevel == null ? 1 : Math.min(3, Math.max(1, lineArtEdgeLevel));
+                currentFile =
+                        applyLineArtConversion(currentFile, tempFiles, thresholdValue, edgeLevel);
+            }
+
             boolean sizeMet = false;
             boolean imageCompressionApplied = false;
             boolean externalCompressionApplied = false;
@@ -810,6 +844,75 @@ public class CompressController {
         }
     }
 
+    private Path applyLineArtConversion(
+            Path currentFile, List<Path> tempFiles, double threshold, int edgeLevel)
+            throws IOException {
+
+        Path lineArtFile = Files.createTempFile("lineart_output_", ".pdf");
+        tempFiles.add(lineArtFile);
+
+        try (PDDocument doc = pdfDocumentFactory.load(currentFile.toFile())) {
+            Map<String, List<ImageReference>> uniqueImages = findImages(doc);
+            CompressionStats stats = new CompressionStats();
+            stats.uniqueImagesCount = uniqueImages.size();
+            calculateImageStats(uniqueImages, stats);
+
+            Map<String, PDImageXObject> convertedImages =
+                    createLineArtImages(doc, uniqueImages, stats, threshold, edgeLevel);
+
+            replaceImages(doc, uniqueImages, convertedImages, stats);
+
+            log.info(
+                    "Applied line art conversion to {} unique images ({} total references)",
+                    stats.uniqueImagesCount,
+                    stats.totalImages);
+
+            doc.save(lineArtFile.toString());
+            return lineArtFile;
+        }
+    }
+
+    private Map<String, PDImageXObject> createLineArtImages(
+            PDDocument doc,
+            Map<String, List<ImageReference>> uniqueImages,
+            CompressionStats stats,
+            double threshold,
+            int edgeLevel)
+            throws IOException {
+
+        Map<String, PDImageXObject> convertedImages = new HashMap<>();
+
+        for (Entry<String, List<ImageReference>> entry : uniqueImages.entrySet()) {
+            String imageHash = entry.getKey();
+            List<ImageReference> references = entry.getValue();
+            if (references.isEmpty()) continue;
+
+            PDImageXObject originalImage = getOriginalImage(doc, references.get(0));
+
+            int originalSize = (int) originalImage.getCOSObject().getLength();
+            stats.totalOriginalBytes += originalSize;
+
+            PDImageXObject converted =
+                    lineArtConversionService.convertImageToLineArt(
+                            doc, originalImage, threshold, edgeLevel);
+            convertedImages.put(imageHash, converted);
+            stats.compressedImages++;
+
+            int convertedSize = (int) converted.getCOSObject().getLength();
+            stats.totalCompressedBytes += convertedSize * references.size();
+
+            double reductionPercentage = 100.0 - ((convertedSize * 100.0) / originalSize);
+            log.info(
+                    "Image hash {}: Line art conversion {} → {} (reduced by {}%)",
+                    imageHash,
+                    GeneralUtils.formatBytes(originalSize),
+                    GeneralUtils.formatBytes(convertedSize),
+                    String.format("%.1f", reductionPercentage));
+        }
+
+        return convertedImages;
+    }
+
     // Run Ghostscript compression
     private void applyGhostscriptCompression(
             OptimizePdfRequest request, int optimizeLevel, Path currentFile, List<Path> tempFiles)

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -1,6 +1,7 @@
 package stirling.software.SPDF.controller.api.misc;
 
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.springframework.context.ApplicationContext;
@@ -10,7 +11,14 @@ import org.springframework.web.bind.annotation.RequestParam;
 
 import io.swagger.v3.oas.annotations.Hidden;
 
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
+import lombok.extern.slf4j.Slf4j;
+
 import stirling.software.SPDF.config.EndpointConfiguration;
+import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
+import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
 import stirling.software.common.model.ApplicationProperties;
@@ -19,6 +27,7 @@ import stirling.software.common.service.UserServiceInterface;
 
 @ConfigApi
 @Hidden
+@Slf4j
 public class ConfigController {
 
     private final ApplicationProperties applicationProperties;
@@ -26,6 +35,7 @@ public class ConfigController {
     private final EndpointConfiguration endpointConfiguration;
     private final ServerCertificateServiceInterface serverCertificateService;
     private final UserServiceInterface userService;
+    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;
 
     public ConfigController(
             ApplicationProperties applicationProperties,
@@ -34,12 +44,14 @@ public class ConfigController {
             @org.springframework.beans.factory.annotation.Autowired(required = false)
                     ServerCertificateServiceInterface serverCertificateService,
             @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    UserServiceInterface userService) {
+                    UserServiceInterface userService,
+            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
         this.applicationProperties = applicationProperties;
         this.applicationContext = applicationContext;
         this.endpointConfiguration = endpointConfiguration;
         this.serverCertificateService = serverCertificateService;
         this.userService = userService;
+        this.externalAppDepConfig = externalAppDepConfig;
     }
 
     @GetMapping("/app-config")
@@ -47,23 +59,36 @@ public class ConfigController {
         Map<String, Object> configData = new HashMap<>();
 
         try {
+            // Add dependency check status
+            configData.put("dependenciesReady", externalAppDepConfig.isDependenciesChecked());
+
             // Get AppConfig bean
             AppConfig appConfig = applicationContext.getBean(AppConfig.class);
 
             // Extract key configuration values from AppConfig
-            configData.put("baseUrl", appConfig.getBaseUrl());
+            // Note: Frontend expects "baseUrl" field name for compatibility
+            configData.put("baseUrl", appConfig.getBackendUrl());
             configData.put("contextPath", appConfig.getContextPath());
             configData.put("serverPort", appConfig.getServerPort());
 
             // Extract values from ApplicationProperties
             configData.put("appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
             configData.put("languages", applicationProperties.getUi().getLanguages());
+            configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
+            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());
 
             // Security settings
-            configData.put("enableLogin", applicationProperties.getSecurity().getEnableLogin());
+            // enableLogin requires both the config flag AND proprietary features to be loaded
+            // If userService is null, proprietary module isn't loaded
+            // (DISABLE_ADDITIONAL_FEATURES=true or DOCKER_ENABLE_SECURITY=false)
+            boolean enableLogin =
+                    applicationProperties.getSecurity().getEnableLogin() && userService != null;
+            configData.put("enableLogin", enableLogin);
 
-            // Mail settings
-            configData.put("enableEmailInvites", applicationProperties.getMail().isEnableInvites());
+            // Mail settings - check both SMTP enabled AND invites enabled
+            boolean smtpEnabled = applicationProperties.getMail().isEnabled();
+            boolean invitesEnabled = applicationProperties.getMail().isEnableInvites();
+            configData.put("enableEmailInvites", smtpEnabled && invitesEnabled);
 
             // Check if user is admin using UserServiceInterface
             boolean isAdmin = false;
@@ -76,6 +101,22 @@ public class ConfigController {
             }
             configData.put("isAdmin", isAdmin);
 
+            // Check if this is a new server (version was 0.0.0 before initialization)
+            configData.put("isNewServer", InitialSetup.isNewServer());
+
+            // Check if the current user is a first-time user
+            boolean isNewUser =
+                    false; // Default to false when security is disabled or user not found
+            if (userService != null) {
+                try {
+                    isNewUser = userService.isCurrentUserFirstLogin();
+                } catch (Exception e) {
+                    // If there's an error, assume not new user for safety
+                    isNewUser = false;
+                }
+            }
+            configData.put("isNewUser", isNewUser);
+
             // System settings
             configData.put(
                     "enableAlphaFunctionality",
@@ -84,6 +125,9 @@ public class ConfigController {
                     "enableAnalytics", applicationProperties.getSystem().getEnableAnalytics());
             configData.put("enablePosthog", applicationProperties.getSystem().getEnablePosthog());
             configData.put("enableScarf", applicationProperties.getSystem().getEnableScarf());
+            configData.put(
+                    "enableDesktopInstallSlide",
+                    applicationProperties.getSystem().getEnableDesktopInstallSlide());
 
             // Premium/Enterprise settings
             configData.put("premiumEnabled", applicationProperties.getPremium().isEnabled());
@@ -126,6 +170,25 @@ public class ConfigController {
                 // EE features not available, continue without them
             }
 
+            // Add version and machine info for update checking
+            try {
+                if (applicationContext.containsBean("appVersion")) {
+                    configData.put(
+                            "appVersion", applicationContext.getBean("appVersion", String.class));
+                }
+                if (applicationContext.containsBean("machineType")) {
+                    configData.put(
+                            "machineType", applicationContext.getBean("machineType", String.class));
+                }
+                if (applicationContext.containsBean("activeSecurity")) {
+                    configData.put(
+                            "activeSecurity",
+                            applicationContext.getBean("activeSecurity", Boolean.class));
+                }
+            } catch (Exception e) {
+                // Version/machine info not available
+            }
+
             return ResponseEntity.ok(configData);
 
         } catch (Exception e) {
@@ -153,4 +216,25 @@ public class ConfigController {
         }
         return ResponseEntity.ok(result);
     }
+
+    @GetMapping("/endpoints-availability")
+    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
+            @RequestParam(name = "endpoints")
+                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
+                    List<@NotBlank String> endpoints) {
+        Map<String, EndpointAvailability> result = new HashMap<>();
+        for (String endpoint : endpoints) {
+            String trimmedEndpoint = endpoint.trim();
+            result.put(
+                    trimmedEndpoint,
+                    endpointConfiguration.getEndpointAvailability(trimmedEndpoint));
+        }
+        return ResponseEntity.ok(result);
+    }
+
+    @GetMapping("/group-enabled")
+    public ResponseEntity<Boolean> isGroupEnabled(@RequestParam(name = "group") String group) {
+        boolean enabled = endpointConfiguration.isGroupEnabled(group);
+        return ResponseEntity.ok(enabled);
+    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java

@@ -196,9 +196,9 @@ public class StampController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/Meiryo.ttf";
-                    case "korean" -> "static/fonts/malgun.ttf";
-                    case "chinese" -> "static/fonts/SimSun.ttf";
+                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
+                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
+                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     case "roman" -> "static/fonts/NotoSans-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";

app/core/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java

@@ -191,6 +191,12 @@ public class CertSignController {
 
         switch (certType) {
             case "PEM":
+                privateKeyFile =
+                        validateFilePresent(
+                                privateKeyFile, "PEM private key", "private key file is required");
+                certFile =
+                        validateFilePresent(
+                                certFile, "PEM certificate", "certificate file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(null);
                 PrivateKey privateKey = getPrivateKeyFromPEM(privateKeyFile.getBytes(), password);
@@ -200,10 +206,16 @@ public class CertSignController {
                 break;
             case "PKCS12":
             case "PFX":
+                p12File =
+                        validateFilePresent(
+                                p12File, "PKCS12 keystore", "PKCS12/PFX keystore file is required");
                 ks = KeyStore.getInstance("PKCS12");
                 ks.load(p12File.getInputStream(), password.toCharArray());
                 break;
             case "JKS":
+                jksfile =
+                        validateFilePresent(
+                                jksfile, "JKS keystore", "JKS keystore file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(jksfile.getInputStream(), password.toCharArray());
                 break;
@@ -251,6 +263,17 @@ public class CertSignController {
                 GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_signed.pdf"));
     }
 
+    private MultipartFile validateFilePresent(
+            MultipartFile file, String argumentName, String errorDescription) {
+        if (file == null || file.isEmpty()) {
+            throw ExceptionUtils.createIllegalArgumentException(
+                    "error.invalidArgument",
+                    "Invalid argument: {0}",
+                    argumentName + " - " + errorDescription);
+        }
+        return file;
+    }
+
     private PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
             throws IOException, OperatorCreationException, PKCSException {
         try (PEMParser pemParser =

app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java

@@ -171,9 +171,9 @@ public class WatermarkController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/Meiryo.ttf";
-                    case "korean" -> "static/fonts/malgun.ttf";
-                    case "chinese" -> "static/fonts/SimSun.ttf";
+                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
+                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
+                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";
                 };

app/core/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java

@@ -25,7 +25,7 @@ import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SignatureService;
+import stirling.software.SPDF.service.SharedSignatureService;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.UserServiceInterface;
@@ -37,13 +37,13 @@ import stirling.software.common.util.GeneralUtils;
 @Slf4j
 public class GeneralWebController {
 
-    private final SignatureService signatureService;
+    private final SharedSignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public GeneralWebController(
-            SignatureService signatureService,
+            SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java

@@ -23,6 +23,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointInspector;
 import stirling.software.SPDF.config.StartupApplicationListener;
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
 import stirling.software.common.annotations.api.InfoApi;
 import stirling.software.common.model.ApplicationProperties;
 
@@ -34,6 +35,7 @@ public class MetricsController {
     private final ApplicationProperties applicationProperties;
     private final MeterRegistry meterRegistry;
     private final EndpointInspector endpointInspector;
+    private final Optional<WeeklyActiveUsersService> wauService;
     private boolean metricsEnabled;
 
     @PostConstruct
@@ -352,6 +354,36 @@ public class MetricsController {
         return ResponseEntity.ok(formatDuration(uptime));
     }
 
+    @GetMapping("/wau")
+    @Operation(
+            summary = "Weekly Active Users statistics",
+            description =
+                    "Returns WAU (Weekly Active Users) count and total unique browsers. "
+                            + "Only available when security is disabled (no-login mode). "
+                            + "Tracks unique browsers via client-generated UUID in localStorage.")
+    public ResponseEntity<?> getWeeklyActiveUsers() {
+        if (!metricsEnabled) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("This endpoint is disabled.");
+        }
+
+        // Check if WAU service is available (only when security.enableLogin=false)
+        if (wauService.isEmpty()) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                    .body(
+                            "WAU tracking is only available when security is disabled (no-login mode)");
+        }
+
+        WeeklyActiveUsersService service = wauService.get();
+
+        Map<String, Object> wauStats = new HashMap<>();
+        wauStats.put("weeklyActiveUsers", service.getWeeklyActiveUsers());
+        wauStats.put("totalUniqueBrowsers", service.getTotalUniqueBrowsers());
+        wauStats.put("daysOnline", service.getDaysOnline());
+        wauStats.put("trackingSince", service.getStartTime().toString());
+
+        return ResponseEntity.ok(wauStats);
+    }
+
     private String formatDuration(Duration duration) {
         long days = duration.toDays();
         long hours = duration.toHoursPart();

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,17 +1,129 @@
 package stirling.software.SPDF.controller.web;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
+import jakarta.annotation.PostConstruct;
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Slf4j
+@Controller
 public class ReactRoutingController {
 
-    @GetMapping("/{path:^(?!api|static|robots\\.txt|favicon\\.ico)[^\\.]*$}")
-    public String forwardRootPaths() {
-        return "forward:/index.html";
+    @Value("${server.servlet.context-path:/}")
+    private String contextPath;
+
+    private String cachedIndexHtml;
+    private boolean indexHtmlExists = false;
+    private boolean useExternalIndexHtml = false;
+
+    @PostConstruct
+    public void init() {
+        log.info("Static files custom path: {}", InstallationPathConfig.getStaticPath());
+
+        // Check for external index.html first (customFiles/static/)
+        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
+        log.debug("Checking for custom index.html at: {}", externalIndexPath);
+        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
+            log.info("Using custom index.html from: {}", externalIndexPath);
+            try {
+                this.cachedIndexHtml = processIndexHtml();
+                this.indexHtmlExists = true;
+                this.useExternalIndexHtml = true;
+                return;
+            } catch (IOException e) {
+                log.warn("Failed to load custom index.html, falling back to classpath", e);
+            }
+        }
+
+        // Fall back to classpath index.html
+        ClassPathResource resource = new ClassPathResource("static/index.html");
+        if (resource.exists()) {
+            try {
+                this.cachedIndexHtml = processIndexHtml();
+                this.indexHtmlExists = true;
+                this.useExternalIndexHtml = false;
+            } catch (IOException e) {
+                // Failed to cache, will process on each request
+                log.warn("Failed to cache index.html", e);
+                this.indexHtmlExists = false;
+            }
+        }
     }
 
-    @GetMapping("/{path:^(?!api|static)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
-    public String forwardNestedPaths() {
-        return "forward:/index.html";
+    private String processIndexHtml() throws IOException {
+        Resource resource = getIndexHtmlResource();
+
+        try (InputStream inputStream = resource.getInputStream()) {
+            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+
+            // Replace %BASE_URL% with the actual context path for base href
+            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+            html = html.replace("%BASE_URL%", baseUrl);
+            // Also rewrite any existing <base> tag (Vite may have baked one in)
+            html =
+                    html.replaceFirst(
+                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
+                            "<base href=\\\"" + baseUrl + "\\\" />");
+
+            // Inject context path as a global variable for API calls
+            String contextPathScript =
+                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
+            html = html.replace("</head>", contextPathScript + "</head>");
+
+            return html;
+        }
+    }
+
+    private Resource getIndexHtmlResource() throws IOException {
+        // Check external location first
+        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
+        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
+            return new FileSystemResource(externalIndexPath.toFile());
+        }
+
+        // Fall back to classpath
+        return new ClassPathResource("static/index.html");
+    }
+
+    @GetMapping(
+            value = {"/", "/index.html"},
+            produces = MediaType.TEXT_HTML_VALUE)
+    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
+        if (indexHtmlExists && cachedIndexHtml != null) {
+            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
+        }
+        // Fallback: process on each request (dev mode or cache failed)
+        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
+    }
+
+    @GetMapping(
+            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
+    public ResponseEntity<String> forwardRootPaths(HttpServletRequest request) throws IOException {
+        return serveIndexHtml(request);
+    }
+
+    @GetMapping(
+            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
+            throws IOException {
+        return serveIndexHtml(request);
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java

@@ -1,48 +0,0 @@
-package stirling.software.SPDF.controller.web;
-
-import java.io.IOException;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-
-import stirling.software.SPDF.service.SignatureService;
-import stirling.software.common.service.UserServiceInterface;
-
-// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
-@RequestMapping("/api/v1/general")
-public class SignatureController {
-
-    private final SignatureService signatureService;
-
-    private final UserServiceInterface userService;
-
-    public SignatureController(
-            SignatureService signatureService,
-            @Autowired(required = false) UserServiceInterface userService) {
-        this.signatureService = signatureService;
-        this.userService = userService;
-    }
-
-    @GetMapping("/sign/{fileName}")
-    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
-            throws IOException {
-        String username = "NON_SECURITY_USER";
-        if (userService != null) {
-            username = userService.getCurrentUsername();
-        }
-        // Verify access permission
-        if (!signatureService.hasAccessToFile(username, fileName)) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-        }
-        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
-        return ResponseEntity.ok()
-                .contentType( // Adjust based on file type
-                        MediaType.IMAGE_JPEG)
-                .body(imageBytes);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureImageController.java

@@ -0,0 +1,84 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.common.service.PersonalSignatureServiceInterface;
+import stirling.software.common.service.UserServiceInterface;
+
+/**
+ * Unified signature image controller that works for both authenticated and unauthenticated users.
+ * Uses composition pattern: - Core SharedSignatureService (always available): reads shared
+ * signatures - PersonalSignatureService (proprietary, optional): reads personal signatures For
+ * authenticated signature management (save/delete), see proprietary SignatureController.
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/general")
+public class SignatureImageController {
+
+    private final SharedSignatureService sharedSignatureService;
+    private final PersonalSignatureServiceInterface personalSignatureService;
+    private final UserServiceInterface userService;
+
+    public SignatureImageController(
+            SharedSignatureService sharedSignatureService,
+            @Autowired(required = false) PersonalSignatureServiceInterface personalSignatureService,
+            @Autowired(required = false) UserServiceInterface userService) {
+        this.sharedSignatureService = sharedSignatureService;
+        this.personalSignatureService = personalSignatureService;
+        this.userService = userService;
+    }
+
+    /**
+     * Get a signature image (works for both authenticated and unauthenticated users). -
+     * Authenticated with proprietary: tries personal first, then shared - Unauthenticated or
+     * community: tries shared only
+     */
+    @GetMapping("/signatures/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName) {
+        try {
+            byte[] imageBytes = null;
+
+            // If proprietary service available and user authenticated, try personal folder first
+            if (personalSignatureService != null && userService != null) {
+                try {
+                    String username = userService.getCurrentUsername();
+                    imageBytes =
+                            personalSignatureService.getPersonalSignatureBytes(username, fileName);
+                } catch (Exception e) {
+                    // Not found in personal folder or not authenticated, will try shared
+                    log.debug("Personal signature not found, trying shared: {}", e.getMessage());
+                }
+            }
+
+            // If not found in personal (or no personal service), try shared
+            if (imageBytes == null) {
+                imageBytes = sharedSignatureService.getSharedSignatureBytes(fileName);
+            }
+
+            // Determine content type from file extension
+            MediaType contentType = MediaType.IMAGE_PNG; // Default
+            String lowerFileName = fileName.toLowerCase();
+            if (lowerFileName.endsWith(".jpg") || lowerFileName.endsWith(".jpeg")) {
+                contentType = MediaType.IMAGE_JPEG;
+            }
+
+            return ResponseEntity.ok().contentType(contentType).body(imageBytes);
+        } catch (IOException e) {
+            log.debug("Signature not found: {}", fileName);
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/exception/CacheUnavailableException.java

@@ -0,0 +1,8 @@
+package stirling.software.SPDF.exception;
+
+public class CacheUnavailableException extends RuntimeException {
+
+    public CacheUnavailableException(String message) {
+        super(message);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/model/api/PdfJsonConversionProgress.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.model.api;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PdfJsonConversionProgress {
+    private int percent;
+    private String stage;
+    private String message;
+    private boolean complete;
+    private Integer current; // Current item being processed (e.g., page number)
+    private Integer total; // Total items to process (e.g., total pages)
+
+    public static PdfJsonConversionProgress of(int percent, String stage, String message) {
+        return PdfJsonConversionProgress.builder()
+                .percent(percent)
+                .stage(stage)
+                .message(message)
+                .complete(false)
+                .build();
+    }
+
+    public static PdfJsonConversionProgress of(
+            int percent, String stage, String message, int current, int total) {
+        return PdfJsonConversionProgress.builder()
+                .percent(percent)
+                .stage(stage)
+                .message(message)
+                .current(current)
+                .total(total)
+                .complete(false)
+                .build();
+    }
+
+    public static PdfJsonConversionProgress complete() {
+        return PdfJsonConversionProgress.builder()
+                .percent(100)
+                .stage("complete")
+                .message("Conversion complete")
+                .complete(true)
+                .build();
+    }
+}

app/core/src/main/java/stirling/software/SPDF/model/api/misc/OptimizePdfRequest.java

@@ -45,4 +45,26 @@ public class OptimizePdfRequest extends PDFFile {
             requiredMode = Schema.RequiredMode.REQUIRED,
             defaultValue = "false")
     private Boolean grayscale = false;
+
+    @Schema(
+            description =
+                    "Whether to convert images to high-contrast line art using ImageMagick. Default is false.",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "false")
+    private Boolean lineArt = false;
+
+    @Schema(
+            description = "Threshold to use for line art conversion (0-100).",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "55")
+    private Double lineArtThreshold = 55d;
+
+    @Schema(
+            description =
+                    "Edge detection strength to use for line art conversion (1-3). This maps to"
+                            + " ImageMagick's -edge radius.",
+            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
+            defaultValue = "1",
+            allowableValues = {"1", "2", "3"})
+    private Integer lineArtEdgeLevel = 1;
 }

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureRequest.java

@@ -0,0 +1,18 @@
+package stirling.software.SPDF.model.api.signature;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class SavedSignatureRequest {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureResponse.java

@@ -0,0 +1,22 @@
+package stirling.software.SPDF.model.api.signature;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SavedSignatureResponse {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types (or URL to fetch image)
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+    private Long createdAt;
+    private Long updatedAt;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonAnnotation.java

@@ -0,0 +1,61 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * Represents a PDF annotation (comments, highlights, stamps, etc.). Annotations often contain OCR
+ * text layers or other metadata not visible in content streams.
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonAnnotation {
+
+    /** Annotation subtype (Text, Highlight, Link, Stamp, Widget, etc.) */
+    private String subtype;
+
+    /** Human-readable text content of the annotation */
+    private String contents;
+
+    /** Annotation rectangle [x1, y1, x2, y2] */
+    private List<Float> rect;
+
+    /** Annotation appearance characteristics */
+    private String appearanceState;
+
+    /** Color components (e.g., [r, g, b] for RGB) */
+    private List<Float> color;
+
+    /** Annotation flags (print, hidden, etc.) */
+    private Integer flags;
+
+    /** For link annotations: destination or action */
+    private String destination;
+
+    /** For text annotations: icon name */
+    private String iconName;
+
+    /** Subject/title of the annotation */
+    private String subject;
+
+    /** Author of the annotation */
+    private String author;
+
+    /** Creation date (ISO 8601 format) */
+    private String creationDate;
+
+    /** Modification date (ISO 8601 format) */
+    private String modificationDate;
+
+    /** Full annotation dictionary for lossless round-tripping */
+    private PdfJsonCosValue rawData;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonCosValue.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonCosValue {
+
+    public enum Type {
+        NULL,
+        BOOLEAN,
+        INTEGER,
+        FLOAT,
+        NAME,
+        STRING,
+        ARRAY,
+        DICTIONARY,
+        STREAM
+    }
+
+    private Type type;
+
+    /**
+     * Holds the decoded value for primitives (boolean, integer, float, name, string). For name
+     * values the stored value is the PDF name literal. For string values the content is Base64
+     * encoded to safely transport arbitrary binaries.
+     */
+    private Object value;
+
+    /** Reference to nested values for arrays. */
+    private List<PdfJsonCosValue> items;
+
+    /** Reference to nested values for dictionaries. */
+    private Map<String, PdfJsonCosValue> entries;
+
+    /** Stream payload when {@code type == STREAM}. */
+    private PdfJsonStream stream;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocument.java

@@ -0,0 +1,34 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonDocument {
+
+    private PdfJsonMetadata metadata;
+
+    /** Optional XMP metadata packet stored as Base64. */
+    private String xmpMetadata;
+
+    /** Indicates that images should be loaded lazily via API rather than embedded in the JSON. */
+    private Boolean lazyImages;
+
+    @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
+
+    @Builder.Default private List<PdfJsonPage> pages = new ArrayList<>();
+
+    /** Form fields (AcroForm) at document level */
+    @Builder.Default private List<PdfJsonFormField> formFields = new ArrayList<>();
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocumentMetadata.java

@@ -0,0 +1,34 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonDocumentMetadata {
+
+    private PdfJsonMetadata metadata;
+
+    /** Optional XMP metadata packet stored as Base64. */
+    private String xmpMetadata;
+
+    /** Indicates that images should be requested lazily via the page endpoint. */
+    private Boolean lazyImages;
+
+    @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
+
+    @Builder.Default private List<PdfJsonPageDimension> pageDimensions = new ArrayList<>();
+
+    /** Form fields (AcroForm) at document level */
+    @Builder.Default private List<PdfJsonFormField> formFields = new ArrayList<>();
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFont.java

@@ -0,0 +1,96 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFont {
+
+    /** PDF resource name (e.g. F1) used as the primary identifier. */
+    private String id;
+
+    /** Logical page number that owns this font resource. */
+    private Integer pageNumber;
+
+    /** Stable UID combining page number and resource for diagnostics. */
+    private String uid;
+
+    /** Reported PostScript/Base font name. */
+    private String baseName;
+
+    /** Declared subtype in the COS dictionary. */
+    private String subtype;
+
+    /** Encoding dictionary or name. */
+    private String encoding;
+
+    /** CID system info for Type0 fonts. */
+    private PdfJsonFontCidSystemInfo cidSystemInfo;
+
+    /** True when the original PDF embedded the font program. */
+    private Boolean embedded;
+
+    /** Font program bytes (TTF/OTF/CFF/PFB) encoded as Base64. */
+    private String program;
+
+    /** Hint describing the font program type (ttf, otf, cff, pfb, etc.). */
+    private String programFormat;
+
+    /** Web-optimized font program (e.g. converted TrueType) encoded as Base64. */
+    private String webProgram;
+
+    /** Format hint for the webProgram payload. */
+    private String webProgramFormat;
+
+    /** PDF-friendly font program (e.g. converted TrueType) encoded as Base64. */
+    private String pdfProgram;
+
+    /** Format hint for the pdfProgram payload. */
+    private String pdfProgramFormat;
+
+    /** Glyph metadata for Type3 fonts to enable precise text rewrites. */
+    private List<PdfJsonFontType3Glyph> type3Glyphs;
+
+    /** Per-strategy synthesized font payloads for Type3 normalization. */
+    private List<PdfJsonFontConversionCandidate> conversionCandidates;
+
+    /** ToUnicode stream encoded as Base64 when present. */
+    private String toUnicode;
+
+    /** Mapped Standard 14 font name when available. */
+    private String standard14Name;
+
+    /** Font descriptor flags copied from the source document. */
+    private Integer fontDescriptorFlags;
+
+    /** Font ascent in glyph units (typically 1/1000). */
+    private Float ascent;
+
+    /** Font descent in glyph units (typically negative). */
+    private Float descent;
+
+    /** Capital height when available. */
+    private Float capHeight;
+
+    /** x-height when available. */
+    private Float xHeight;
+
+    /** Italic angle reported by the font descriptor. */
+    private Float italicAngle;
+
+    /** Units per em extracted from the font matrix. */
+    private Integer unitsPerEm;
+
+    /** Serialized COS dictionary describing the original font resource. */
+    private PdfJsonCosValue cosDictionary;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontCidSystemInfo.java

@@ -0,0 +1,20 @@
+package stirling.software.SPDF.model.json;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFontCidSystemInfo {
+
+    private String registry;
+    private String ordering;
+    private Integer supplement;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionCandidate.java

@@ -0,0 +1,69 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFontConversionCandidate {
+
+    /** Stable identifier for the strategy that produced this candidate. */
+    private String strategyId;
+
+    /** Human-readable label for diagnostics and UI toggles. */
+    private String strategyLabel;
+
+    /** Outcome of the conversion attempt. */
+    private PdfJsonFontConversionStatus status;
+
+    /** Summary diagnostics or error details. */
+    private String message;
+
+    /** Count of glyphs successfully synthesized. */
+    private Integer synthesizedGlyphs;
+
+    /** Count of glyphs that could not be reproduced accurately. */
+    private Integer missingGlyphs;
+
+    /** Approximate width delta (in glyph units) across the test sample. */
+    private Double widthDelta;
+
+    /** Approximate bounding box delta (in glyph units). */
+    private Double bboxDelta;
+
+    /** Base64-encoded font program (typically TTF/OTF) produced by the strategy. */
+    private String program;
+
+    /** Format hint for {@link #program}. */
+    private String programFormat;
+
+    /** Web-optimized payload (e.g. TTF) for browser preview. */
+    private String webProgram;
+
+    /** Format for the web payload. */
+    private String webProgramFormat;
+
+    /** PDF-friendly payload for re-embedding during export. */
+    private String pdfProgram;
+
+    /** Format for the PDF payload. */
+    private String pdfProgramFormat;
+
+    /** Optional PNG preview of rendered glyphs (Base64). */
+    private String previewImage;
+
+    /** Additional structured diagnostics (JSON string). */
+    private String diagnostics;
+
+    /** Known unicode/codepoint coverage derived from the conversion strategy. */
+    private List<Integer> glyphCoverage;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionStatus.java

@@ -0,0 +1,9 @@
+package stirling.software.SPDF.model.json;
+
+public enum PdfJsonFontConversionStatus {
+    SUCCESS,
+    WARNING,
+    FAILURE,
+    SKIPPED,
+    UNSUPPORTED
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontType3Glyph.java

@@ -0,0 +1,27 @@
+package stirling.software.SPDF.model.json;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFontType3Glyph {
+    /** Character code used in the content stream to reference this glyph. */
+    private Integer charCode;
+
+    /** PostScript glyph name, when available. */
+    private String glyphName;
+
+    /** Unicode code point represented by this glyph, if it can be resolved. */
+    private Integer unicode;
+
+    /** Raw char code used in the Type3 font encoding (0-255). */
+    private Integer charCodeRaw;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFormField.java

@@ -0,0 +1,66 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** Represents a PDF form field (AcroForm). */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFormField {
+
+    /** Fully qualified field name (e.g., "form1.textfield1") */
+    private String name;
+
+    /** Partial field name (last component) */
+    private String partialName;
+
+    /** Field type (Tx=text, Btn=button, Ch=choice, Sig=signature) */
+    private String fieldType;
+
+    /** Field value as string */
+    private String value;
+
+    /** Default value */
+    private String defaultValue;
+
+    /** Field flags (readonly, required, multiline, etc.) */
+    private Integer flags;
+
+    /** Alternative field name (for accessibility) */
+    private String alternateFieldName;
+
+    /** Mapping name (for export) */
+    private String mappingName;
+
+    /** Page number where field appears (1-indexed) */
+    private Integer pageNumber;
+
+    /** Field rectangle [x1, y1, x2, y2] on the page */
+    private List<Float> rect;
+
+    /** For choice fields: list of options */
+    private List<String> options;
+
+    /** For choice fields: selected indices */
+    private List<Integer> selectedIndices;
+
+    /** For button fields: whether it's checked */
+    private Boolean checked;
+
+    /** Font information for text fields */
+    private String fontName;
+
+    private Float fontSize;
+
+    /** Full field dictionary for lossless round-tripping */
+    private PdfJsonCosValue rawData;
+}