Add en-GB strings for settings sync

.dockerignore

@@ -5,7 +5,6 @@ frontend/dist
 frontend/build
 frontend/.vite
 frontend/.tauri
-frontend/src-tauri/target
 
 # Gradle build artifacts
 .gradle

.github/scripts/check_language_json.py

@@ -1,6 +1,6 @@
 """
 Author: Ludy87
-Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
+Description: This script processes JSON translation files for localization checks. It compares translation files in a branch with
 a reference file to ensure consistency. The script performs two main checks:
 1. Verifies that the number of translation keys in the translation files matches the reference file.
 2. Ensures that all keys in the translation files are present in the reference file and vice versa.
@@ -9,10 +9,10 @@ The script also provides functionality to update the translation files to match
 adjusting the format.
 
 Usage:
-    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+    python check_language_json.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_json.py --reference-file frontend/public/locales/en-GB/translation.json --branch "" --files frontend/public/locales/de-DE/translation.json frontend/public/locales/fr-FR/translation.json
 
 import copy
 import glob
@@ -20,14 +20,12 @@ import os
 import argparse
 import re
 import json
-import tomllib  # Python 3.11+ (stdlib)
-import tomli_w  # For writing TOML files
 
 
 def find_duplicate_keys(file_path, keys=None, prefix=""):
     """
-    Identifies duplicate keys in a TOML file (including nested keys).
-    :param file_path: Path to the TOML file.
+    Identifies duplicate keys in a JSON file (including nested keys).
+    :param file_path: Path to the JSON file.
     :param keys: Dictionary to track keys (used for recursion).
     :param prefix: Prefix for nested keys.
     :return: List of tuples (key, first_occurrence_path, duplicate_path).
@@ -37,9 +35,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
 
     duplicates = []
 
-    # Load TOML file
-    with open(file_path, 'rb') as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def process_dict(obj, current_prefix=""):
         for key, value in obj.items():
@@ -57,18 +54,18 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for TOML files (e.g., 500 KB)
+# Maximum size for JSON files (e.g., 500 KB)
 MAX_FILE_SIZE = 500 * 1024
 
 
-def parse_toml_file(file_path):
+def parse_json_file(file_path):
     """
-    Parses a TOML translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the TOML file.
+    Parses a JSON translation file and returns a flat dictionary of all keys.
+    :param file_path: Path to the JSON file.
     :return: Dictionary with flattened keys.
     """
-    with open(file_path, 'rb') as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
         items = {}
@@ -102,37 +99,38 @@ def unflatten_dict(d, sep="."):
     return result
 
 
-def write_toml_file(file_path, updated_properties):
+def write_json_file(file_path, updated_properties):
     """
-    Writes updated properties back to the TOML file.
-    :param file_path: Path to the TOML file.
+    Writes updated properties back to the JSON file.
+    :param file_path: Path to the JSON file.
     :param updated_properties: Dictionary of updated properties to write.
     """
     nested_data = unflatten_dict(updated_properties)
 
-    with open(file_path, "wb") as file:
-        tomli_w.dump(nested_data, file)
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        json.dump(nested_data, file, ensure_ascii=False, indent=2)
+        file.write("\n")  # Add trailing newline
 
 
 def update_missing_keys(reference_file, file_list, branch=""):
     """
     Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference TOML file.
+    :param reference_file: Path to the reference JSON file.
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_properties = parse_toml_file(reference_file)
+    reference_properties = parse_json_file(reference_file)
 
     for file_path in file_list:
         basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
             basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".toml")
+            or not file_path.endswith(".json")
             or not os.path.dirname(file_path).endswith("locales")
         ):
             continue
 
-        current_properties = parse_toml_file(os.path.join(branch, file_path))
+        current_properties = parse_json_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -143,16 +141,16 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_toml_file(os.path.join(branch, file_path), updated_properties)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
     update_missing_keys(reference_file, file_list, branch)
 
 
-def read_toml_keys(file_path):
+def read_json_keys(file_path):
     if os.path.isfile(file_path) and os.path.exists(file_path):
-        return parse_toml_file(file_path)
+        return parse_json_file(file_path)
     return {}
 
 
@@ -162,7 +160,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_toml_keys(reference_file)
+    reference_keys = read_json_keys(reference_file)
     has_differences = False
 
     only_reference_file = True
@@ -199,12 +197,12 @@ def check_for_differences(reference_file, file_list, branch, actor):
         ):
             continue
 
-        if not file_normpath.endswith(".toml") or basename_current_file != "translation.toml":
+        if not file_normpath.endswith(".json") or basename_current_file != "translation.json":
             continue
 
         only_reference_file = False
         report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_toml_keys(os.path.join(branch, file_path))
+        current_keys = read_json_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -274,7 +272,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.json](https://github.com/Stirling-Tools/Stirling-PDF/blob/V2/frontend/public/locales/en-GB/translation.json)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -288,7 +286,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
+    parser = argparse.ArgumentParser(description="Find missing keys")
     parser.add_argument(
         "--actor",
         required=False,
@@ -339,9 +337,9 @@ if __name__ == "__main__":
                     "public",
                     "locales",
                     "*",
-                    "translation.toml",
+                    "translation.json",
                 )
             )
         update_missing_keys(args.reference_file, file_list)
     else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_properties.py

@@ -0,0 +1,403 @@
+"""
+Author: Ludy87
+Description: This script processes .properties files for localization checks. It compares translation files in a branch with
+a reference file to ensure consistency. The script performs two main checks:
+1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
+2. Ensures that all keys in the translation files are present in the reference file and vice versa.
+
+The script also provides functionality to update the translation files to match the reference file by adding missing keys and
+adjusting the format.
+
+Usage:
+    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+"""
+# Sample for Windows:
+# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
+
+import copy
+import glob
+import os
+import argparse
+import re
+
+
+def find_duplicate_keys(file_path):
+    """
+    Identifies duplicate keys in a .properties file.
+    :param file_path: Path to the .properties file.
+    :return: List of tuples (key, first_occurrence_line, duplicate_line).
+    """
+    keys = {}
+    duplicates = []
+
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Skip empty lines and comments
+            if not stripped_line or stripped_line.startswith("#"):
+                continue
+
+            # Split the line into key and value
+            if "=" in stripped_line:
+                key, _ = stripped_line.split("=", 1)
+                key = key.strip()
+
+                # Check if the key already exists
+                if key in keys:
+                    duplicates.append((key, keys[key], line_number))
+                else:
+                    keys[key] = line_number
+
+    return duplicates
+
+
+# Maximum size for properties files (e.g., 200 KB)
+MAX_FILE_SIZE = 200 * 1024
+
+
+def parse_properties_file(file_path):
+    """
+    Parses a .properties file and returns a structured list of its contents.
+    :param file_path: Path to the .properties file.
+    :return: List of dictionaries representing each line in the file.
+    """
+    properties_list = []
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Handle empty lines
+            if not stripped_line:
+                properties_list.append(
+                    {"line_number": line_number, "type": "empty", "content": ""}
+                )
+                continue
+
+            # Handle comments
+            if stripped_line.startswith("#"):
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "comment",
+                        "content": stripped_line,
+                    }
+                )
+                continue
+
+            # Handle key-value pairs
+            match = re.match(r"^([^=]+)=(.*)$", line)
+            if match:
+                key, value = match.groups()
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "entry",
+                        "key": key.strip(),
+                        "value": value.strip(),
+                    }
+                )
+
+    return properties_list
+
+
+def write_json_file(file_path, updated_properties):
+    """
+    Writes updated properties back to the file in their original format.
+    :param file_path: Path to the .properties file.
+    :param updated_properties: List of updated properties to write.
+    """
+    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
+
+    # Sort lines by their numbers and retain comments and empty lines
+    all_lines = sorted(set(updated_lines.keys()))
+
+    original_format = []
+    for line in all_lines:
+        if line in updated_lines:
+            entry = updated_lines[line]
+        else:
+            entry = None
+        ref_entry = updated_lines[line]
+        if ref_entry["type"] in ["comment", "empty"]:
+            original_format.append(ref_entry)
+        elif entry is None:
+            # Add missing entries from the reference file
+            original_format.append(ref_entry)
+        elif entry["type"] == "entry":
+            # Replace entries with those from the current JSON
+            original_format.append(entry)
+
+    # Write the updated content back to the file
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        for entry in original_format:
+            if entry["type"] == "comment":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "empty":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "entry":
+                file.write(f"{entry['key']}={entry['value']}\n")
+
+
+def update_missing_keys(reference_file, file_list, branch=""):
+    """
+    Updates missing keys in the translation files based on the reference file.
+    :param reference_file: Path to the reference .properties file.
+    :param file_list: List of translation files to update.
+    :param branch: Branch where the files are located.
+    """
+    reference_properties = parse_properties_file(reference_file)
+    for file_path in file_list:
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
+        if (
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+
+        current_properties = parse_properties_file(os.path.join(branch, file_path))
+        updated_properties = []
+        for ref_entry in reference_properties:
+            ref_entry_copy = copy.deepcopy(ref_entry)
+            for current_entry in current_properties:
+                if current_entry["type"] == "entry":
+                    if ref_entry_copy["type"] != "entry":
+                        continue
+                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
+                        ref_entry_copy["value"] = current_entry["value"]
+            updated_properties.append(ref_entry_copy)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
+
+
+def check_for_missing_keys(reference_file, file_list, branch):
+    update_missing_keys(reference_file, file_list, branch)
+
+
+def read_properties(file_path):
+    if os.path.isfile(file_path) and os.path.exists(file_path):
+        with open(file_path, "r", encoding="utf-8") as file:
+            return file.read().splitlines()
+    return [""]
+
+
+def check_for_differences(reference_file, file_list, branch, actor):
+    reference_branch = reference_file.split("/")[0]
+    basename_reference_file = os.path.basename(reference_file)
+
+    report = []
+    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
+    reference_lines = read_properties(reference_file)
+    has_differences = False
+
+    only_reference_file = True
+
+    file_arr = file_list
+
+    if len(file_list) == 1:
+        file_arr = file_list[0].split()
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "app", "core", "src", "main", "resources")
+    )
+
+    for file_path in file_arr:
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)
+        # Verify that file is within the expected directory
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")
+        # Verify file size before processing
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
+            )
+
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        if (
+            basename_current_file == basename_reference_file
+            or (
+                # only local windows command
+                not file_normpath.startswith(
+                    os.path.join(
+                        "", "app", "core", "src", "main", "resources", "messages_"
+                    )
+                )
+                and not file_normpath.startswith(
+                    os.path.join(
+                        os.getcwd(),
+                        "app",
+                        "core",
+                        "src",
+                        "main",
+                        "resources",
+                        "messages_",
+                    )
+                )
+            )
+            or not file_normpath.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+        only_reference_file = False
+        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
+        current_lines = read_properties(os.path.join(branch, file_path))
+        reference_line_count = len(reference_lines)
+        current_line_count = len(current_lines)
+
+        if reference_line_count != current_line_count:
+            report.append("")
+            report.append("1. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            has_differences = True
+            if reference_line_count > current_line_count:
+                report.append(
+                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
+                )
+            elif reference_line_count < current_line_count:
+                report.append(
+                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
+                )
+        else:
+            report.append("1. **Test Status:** ✅ **_Passed_**")
+
+        # Check for missing or extra keys
+        current_keys = []
+        reference_keys = []
+        for line in current_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                current_keys.append(key)
+        for line in reference_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                reference_keys.append(key)
+
+        current_keys_set = set(current_keys)
+        reference_keys_set = set(reference_keys)
+        missing_keys = current_keys_set.difference(reference_keys_set)
+        extra_keys = reference_keys_set.difference(current_keys_set)
+        missing_keys_list = list(missing_keys)
+        extra_keys_list = list(extra_keys)
+
+        if missing_keys_list or extra_keys_list:
+            has_differences = True
+            missing_keys_str = "`, `".join(missing_keys_list)
+            extra_keys_str = "`, `".join(extra_keys_list)
+            report.append("2. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            if missing_keys_list:
+                spaces_keys_list = []
+                for key in missing_keys_list:
+                    if " " in key:
+                        spaces_keys_list.append(key)
+                if spaces_keys_list:
+                    spaces_keys_str = "`, `".join(spaces_keys_list)
+                    report.append(
+                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
+                    )
+                report.append(
+                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
+                )
+            if extra_keys_list:
+                report.append(
+                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
+                )
+        else:
+            report.append("2. **Test Status:** ✅ **_Passed_**")
+
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
+            has_differences = True
+            output = "\n".join(
+                [
+                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
+                    for key, first, duplicate in find_duplicate_keys(
+                        os.path.join(branch, file_normpath)
+                    )
+                ]
+            )
+            report.append("3. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            report.append("    - duplicate entries were found:")
+            report.append(output)
+        else:
+            report.append("3. **Test Status:** ✅ **_Passed_**")
+
+        report.append("")
+        report.append("---")
+        report.append("")
+    if has_differences:
+        report.append("## ❌ Overall Check Status: **_Failed_**")
+        report.append("")
+        report.append(
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/resources/messages_en_GB.properties)"
+        )
+    else:
+        report.append("## ✅ Overall Check Status: **_Success_**")
+        report.append("")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )
+
+    if not only_reference_file:
+        print("\n".join(report))
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser.add_argument(
+        "--actor",
+        required=False,
+        help="Actor from PR.",
+    )
+    parser.add_argument(
+        "--reference-file",
+        required=True,
+        help="Path to the reference file.",
+    )
+    parser.add_argument(
+        "--branch",
+        type=str,
+        required=True,
+        help="Branch name.",
+    )
+    parser.add_argument(
+        "--check-file",
+        type=str,
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    parser.add_argument(
+        "--files",
+        nargs="+",
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    args = parser.parse_args()
+
+    # Sanitize --actor input to avoid injection attacks
+    if args.actor:
+        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
+
+    # Sanitize --branch input to avoid injection attacks
+    if args.branch:
+        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
+
+    file_list = args.files
+    if file_list is None:
+        if args.check_file:
+            file_list = [args.check_file]
+        else:
+            file_list = glob.glob(
+                os.path.join(
+                    os.getcwd(),
+                    "app",
+                    "core",
+                    "src",
+                    "main",
+                    "resources",
+                    "messages_*.properties",
+                )
+            )
+        update_missing_keys(args.reference_file, file_list)
+    else:
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -52,6 +52,7 @@ jobs:
             core.setOutput('repository', pr.head.repo.full_name);
             core.setOutput('ref', pr.head.ref);
             core.setOutput('is_fork', String(pr.head.repo.fork));
+            core.setOutput('base_ref', pr.base.ref);
             core.setOutput('author', pr.user.login);
             core.setOutput('state', pr.state);
 
@@ -64,6 +65,10 @@ jobs:
           IS_FORK: ${{ steps.resolve.outputs.is_fork }}
           # nur bei workflow_dispatch gesetzt:
           ALLOW_FORK_INPUT: ${{ inputs.allow_fork }}
+          # für Auto-PR-Logik:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_BASE: ${{ steps.resolve.outputs.base_ref }}
           PR_AUTHOR: ${{ steps.resolve.outputs.author }}
         run: |
           set -e
@@ -84,8 +89,14 @@ jobs:
           else
             auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
             is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
-            if [ "$is_auth" = true ]; then
+            if [ "$PR_BASE" = "V2" ] && [ "$is_auth" = true ]; then
               should=true
+            else
+              title_has_v2=false; echo "$PR_TITLE" | grep -qiE 'v2|version.?2|version.?two' && title_has_v2=true
+              branch_has_kw=false; echo "$PR_BRANCH" | grep -qiE 'v2|react' && branch_has_kw=true
+              if [ "$is_auth" = true ] && { [ "$title_has_v2" = true ] || [ "$branch_has_kw" = true ]; }; then
+                should=true
+              fi
             fi
           fi
 
@@ -163,7 +174,7 @@ jobs:
               owner,
               repo,
               issue_number: prNumber,
-              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment for approved V2 contributors._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
+              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment triggered by V2/version2 keywords in the PR title or V2/React keywords in the branch name._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
             });
             return newComment.id;
 
@@ -295,10 +306,8 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
               environment:
-                DISABLE_ADDITIONAL_FEATURES: "false"
-                SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
                 SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
@@ -383,7 +392,7 @@ jobs:
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                               `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
-                              `🔄 **Auto-deployed** for approved V2 contributors.`;
+                              `🔄 **Auto-deployed** because PR title or branch name contains V2/version2/React keywords.`;
 
             await github.rest.issues.createComment({
               owner,

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -14,7 +14,6 @@ jobs:
     permissions:
       issues: write
     if: |
-      vars.CI_PROFILE != 'lite' &&
       github.event.issue.pull_request &&
       (
         contains(github.event.comment.body, 'prdeploy') ||
@@ -181,7 +180,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha

.github/workflows/build.yml

@@ -262,13 +262,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
+        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -278,13 +272,6 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
@@ -314,7 +301,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./${{ matrix.docker-rev }}
+          file: ./docker/backend/${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -326,7 +313,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
+          name: reports-docker-${{ matrix.docker-rev }}
           path: |
             build/reports/tests/
             build/test-results/

.github/workflows/check_properties.yml

@@ -1,14 +1,19 @@
-name: Check TOML Translation Files on PR
-
-# This workflow validates TOML translation files
+name: Check Properties Files on PR
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
-      - "frontend/public/locales/*/translation.toml"
+      - "app/core/src/main/resources/messages_*.properties"
 
 # cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
   cancel-in-progress: true
@@ -68,22 +73,22 @@ jobs:
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
-          # Check if PR number exists
-          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-            echo "Error: PR number is empty"
-            exit 1
-          fi
-          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
-          # Check if any files were found
-          if [ ! -s changed_files.txt ]; then
-            echo "No TOML translation files changed in this PR"
-            echo "Workflow will exit early as no relevant files to check"
-            exit 0
-          fi
-          echo "Found $(wc -l < changed_files.txt) matching TOML files"
+                   # Check if PR number exists
+            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+              echo "Error: PR number is empty"
+              exit 1
+            fi
+            # Get changed files and filter for properties files, handle case where no matches are found
+            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
+            # Check if any files were found
+            if [ ! -s changed_files.txt ]; then
+              echo "No properties files changed in this PR"
+              echo "Workflow will exit early as no relevant files to check"
+              exit 0
+            fi
+            echo "Found $(wc -l < changed_files.txt) matching properties files"
 
-      - name: Determine reference file
+      - name: Determine reference file test
         id: determine-file
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -120,11 +125,11 @@ jobs:
               pull_number: prNumber,
             });
 
-            // Filter for relevant TOML files based on the PR changes
+            // Filter for relevant files based on the PR changes
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^app\/core\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -164,16 +169,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
+            if (changedFiles.includes("app/core/src/main/resources/messages_en_GB.properties")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-GB.toml";
+              referenceFilePath = "pr-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -181,11 +186,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-GB.toml";
+              referenceFilePath = "main-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -193,20 +198,11 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Python dependencies
-        run: |
-          pip install tomli-w
-
       - name: Run Python script to check files
         id: run-check
         run: |
-          echo "Running Python script to check TOML files..."
-          python .github/scripts/check_language_toml.py \
+          echo "Running Python script to check files..."
+          python .github/scripts/check_language_properties.py \
             --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
@@ -217,7 +213,7 @@ jobs:
         id: capture-output
         run: |
           if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Capturing output..."
+            echo "Test, capturing output..."
             SCRIPT_OUTPUT=$(cat result.txt)
             echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
             echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
@@ -231,7 +227,7 @@ jobs:
               echo "FAIL_JOB=false" >> $GITHUB_ENV
             fi
           else
-            echo "No output found."
+            echo "No update found."
             echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
             echo "FAIL_JOB=false" >> $GITHUB_ENV
           fi
@@ -253,7 +249,7 @@ jobs:
               issue_number: issueNumber
             });
 
-            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
+            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
 
             // Only update or create comments by the action user
             const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
@@ -264,7 +260,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 comment_id: comment.id,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Updated existing comment.");
             } else if (!comment) {
@@ -273,7 +269,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 issue_number: issueNumber,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Created new comment.");
             } else {
@@ -291,6 +287,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
+          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/multiOSReleases.yml

@@ -1,4 +1,4 @@
-name: Multi-OS Tauri Releases
+name: Test Installers Build
 
 on:
   workflow_dispatch:
@@ -6,23 +6,7 @@ on:
       test_mode:
         description: "Run in test mode (skip release step)"
         required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo, V2-master]
+        default: "false"
   release:
     types: [created]
 
@@ -30,90 +14,60 @@ permissions:
   contents: read
 
 jobs:
-  determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
+  read_versions:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
+      versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
+          distribution: 'temurin'
+          java-version: '21'
 
+      # ✅ Get version from Gradle
       - name: Get version number
         id: versionNumber
         run: |
-          echo "Running gradlew printVersion..."
-          ./gradlew printVersion --quiet
           VERSION=$(./gradlew printVersion --quiet | tail -1)
-          echo "Extracted version: $VERSION"
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      # ✅ Get Mac-specific version from Gradle
+      - name: Get version number mac
+        id: versionNumberMac
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          VERSION_MAC=$(./gradlew printMacVersion --quiet | tail -1)
+          echo "versionNumberMac=$VERSION_MAC" >> $GITHUB_OUTPUT
 
-  build-jars:
-    needs: determine-matrix
+  build-portable:
+    needs: read_versions
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        variant:
-          - name: "default"
-            disable_security: true
-            build_frontend: true
-            file_suffix: ""
-          - name: "with-login"
-            disable_security: false
-            build_frontend: true
+        disable_security: [true, false]
+        include:
+          - disable_security: false
             file_suffix: "-with-login"
-          - name: "server-only"
-            disable_security: true
-            build_frontend: false
-            file_suffix: "-server"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           java-version: "21"
           distribution: "temurin"
@@ -122,409 +76,226 @@ jobs:
         with:
           gradle-version: 8.14
 
-      - name: Setup Node.js
-        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Build JAR
-        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
         env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Rename JAR
+      - name: Rename binaries
         run: |
-          echo "Version from determine-matrix: ${{ needs.determine-matrix.outputs.version }}"
-          echo "Looking for: app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar"
-          ls -la app/core/build/libs/
-          mkdir -p ./jar-dist
-          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
-
-      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: jar${{ matrix.variant.file_suffix }}
-          path: ./jar-dist/*.jar
-          retention-days: 1
-
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on release or V2-master
-          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
+          mkdir ./binaries
+          mv ./build/launch4j/Stirling-PDF.exe ./binaries/win-Stirling-PDF-portable-Server${{ matrix.file_suffix }}.exe
+          mv ./app/core/build/libs/stirling-pdf-${{ needs.read_versions.outputs.version }}.jar ./binaries/Stirling-PDF${{ matrix.file_suffix }}.jar
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
           retention-days: 1
+          if-no-files-found: error
+          name: stirling${{ matrix.file_suffix }}-binaries
+          path: |
+            ./binaries/*
+
+  sign_verify-portable:
+    needs: [build-portable, read_versions]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "with-login-"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: stirling-${{ matrix.file_suffix }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: stirling-${{ matrix.file_suffix }}signed
+          path: |
+            ./*
+            !cosign.*
+
+  build-installers:
+    needs: read_versions
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      # Install Windows dependencies
+      - name: Install WiX Toolset
+        if: matrix.os == 'windows-latest'
+        run: |
+          curl -L -o wix.exe https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314.exe
+          .\wix.exe /install /quiet
+
+      # Build installer
+      - name: Build Installer
+        run: ./gradlew build jpackage -x test --info
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: true
+          BROWSER_OPEN: true
+
+      - name: Set up JDK (x86_64)
+        if: matrix.os == 'macos-latest'
+        run: |
+          curl -L -o jdk.tar.gz https://cdn.azul.com/zulu/bin/zulu17.56.15-ca-jdk17.0.14-macosx_x64.tar.gz
+          mkdir -p zulu17
+          tar -xzf jdk.tar.gz -C zulu17 --strip-components=1
+          echo "JAVA_HOME=$PWD/zulu17" >> $GITHUB_ENV
+          echo "$PWD/zulu17/bin" >> $GITHUB_PATH
+
+      -   name: Verify JDK architecture
+          if: matrix.os == 'macos-latest'
+          run: file $JAVA_HOME/bin/java
+
+      -   name: Build project and run jpackage (x86_64)
+          if: matrix.os == 'macos-latest'
+          run: arch -x86_64 ./gradlew jpackageMacX64
+
+      # Rename and collect artifacts based on OS
+      - name: Prepare artifacts
+        id: prepare
+        shell: bash
+        run: |
+          ls -lah ./build/jpackage/
+          mkdir ./binaries
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.version }}.exe" "./binaries/Stirling-PDF-win-installer.exe"
+          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-installer.dmg"
+            mv "./build/jpackage/x86_64/Stirling PDF (x86_64)-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-x86_64-installer.dmg"
+          else
+            mv "./build/jpackage/stirling-pdf_${{ needs.read_versions.outputs.version }}-1_amd64.deb" "./binaries/Stirling-PDF-linux-installer.deb"
+          fi
+
+      - name: Display structure of downloaded files
+        run: ls -R ./binaries
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}binaries
+          path: |
+            ./binaries/*
+
+  sign_verify:
+    needs: [read_versions, build-installers]
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: ${{ matrix.platform }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        if: matrix.os == 'windows-latest'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+
+      - name: Generate key pair
+        if: matrix.os == 'windows-latest'
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        if: matrix.os == 'windows-latest'
+        run: |
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./Stirling-PDF-win-installer.exe.intoto.jsonl \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}signed
+          path: |
+            ./Stirling-PDF-${{ matrix.platform }}installer.*
+            ./Stirling-PDF-${{ matrix.platform }}x86_64-installer.*
+            !cosign.*
 
   create-release:
-    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-    needs: [determine-matrix, build, build-jars]
+    if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_mode != 'true'
+    needs: [read_versions, sign_verify, sign_verify-portable]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -534,43 +305,14 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Download all Tauri artifacts
+      - name: Download signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          pattern: Stirling-PDF-*
-          path: ./artifacts/tauri
-
-      - name: Download JAR artifact (default)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (with login)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar-with-login
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (server only)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar-server
-          path: ./artifacts/jars
-
       - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Upload binaries to Release
+        run: ls -R
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.read_versions.outputs.version }}
           generate_release_notes: true
           files: |
-            ./artifacts/**/*.jar
-            ./artifacts/**/*.msi
-            ./artifacts/**/*.dmg
-            ./artifacts/**/*.deb
-            ./artifacts/**/*.AppImage
-          draft: false
-          prerelease: false
+            ./*signed/*

.github/workflows/push-docker-v2.yml

@@ -1,246 +0,0 @@
-name: Push Docker Image - V2 Branch
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - V2-master
-      - alljavadocker
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-
-      - name: Get version number
-        id: versionNumber
-        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for latest (V2-master branch - production)
-        id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Generate tags for latest (alljavadocker branch - test)
-        id: meta-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign regular images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --yes \
-              --key env://COSIGN_PRIVATE_KEY \
-              "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for latest-fat (V2-master branch - production)
-        id: meta-fat
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Generate tags for latest-fat (alljavadocker branch - test)
-        id: meta-fat-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Build and push Unified Dockerfile (fat variant)
-        id: build-push-fat
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.fat
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign fat images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite (V2-master branch - production)
-        id: meta-lite
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Generate tags for ultra-lite (alljavadocker branch - test)
-        id: meta-lite-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done

.github/workflows/push-docker.yml

@@ -24,7 +24,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -108,7 +107,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -153,7 +152,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
+          file: ./Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -184,7 +183,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/releaseArtifacts.yml

@@ -2,445 +2,85 @@ name: Release Artifacts
 
 on:
   workflow_dispatch:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo]
+  release:
+    types: [created]
 
 permissions:
   contents: read
 
 jobs:
-  determine-matrix:
+  build:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
+
       - name: Get version number
         id: versionNumber
         run: |
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      - name: Rename binaries
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
+      - name: Debug build artifacts
         run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
+          echo "Current Directory: $(pwd)"
+          ls -R ./build/libs
+          ls -R ./build/launch4j
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
-          retention-days: 30
+          name: binaries${{ matrix.file_suffix }}
+          path: |
+            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
 
   sign_verify:
     needs: build
     runs-on: ubuntu-latest
-    if: success()
     strategy:
-      fail-fast: false
       matrix:
-        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -450,8 +90,7 @@ jobs:
       - name: Download build artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-
+          name: binaries${{ matrix.file_suffix }}
       - name: Display structure of downloaded files
         run: ls -R
 
@@ -462,74 +101,80 @@ jobs:
         run: cosign generate-key-pair
 
       - name: Sign and generate attestations
-        shell: bash
         run: |
-          # Sign all artifacts for this platform
-          for file in *; do
-            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
-              echo "Signing: $file"
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Sign the artifact
-              cosign sign-blob \
-                --key ./cosign.key \
-                --yes \
-                --output-signature "${file}.sig" \
-                "$file"
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Generate attestation
-              cosign attest-blob \
-                --predicate - \
-                --key ./cosign.key \
-                --yes \
-                --output-attestation "${file}.intoto.jsonl" \
-                "$file"
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Verify the signature
-              cosign verify-blob \
-                --key ./cosign.pub \
-                --signature "${file}.sig" \
-                "$file"
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
 
-              echo "✅ Signed and verified: $file"
-            fi
-          done
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
 
       - name: Upload signed artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}-signed
+          name: signed${{ matrix.file_suffix }}
           path: |
-            *
-            !cosign.key
-            !cosign.pub
-          retention-days: 30
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
 
   release:
-    needs: [determine-matrix, build, sign_verify]
+    needs: [build, sign_verify]
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     permissions:
       contents: write
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download all signed artifacts
+      - name: Download signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          pattern: Stirling-PDF-*-signed
-          path: ./artifacts
+          name: signed${{ matrix.file_suffix }}
 
-      - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Create GitHub Release
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.build.outputs.version }}
           generate_release_notes: true
-          files: ./artifacts/**/*
-          draft: false
-          prerelease: false
+          files: |
+            ./libs/Stirling-PDF*
+            ./launch4j/Stirling-PDF-Server*

.github/workflows/scorecards.yml

@@ -17,7 +17,6 @@ permissions: read-all
 
 jobs:
   analysis:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:

.github/workflows/sonarqube.yml

@@ -27,7 +27,6 @@ permissions:
 
 jobs:
   sonarqube:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/stale.yml

@@ -10,7 +10,6 @@ permissions:
 
 jobs:
   stale:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/swagger.yml

@@ -23,7 +23,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/sync_files.yml

@@ -0,0 +1,122 @@
+name: Sync Files
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+      - "README.md"
+      - "app/core/src/main/resources/messages_*.properties"
+      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
+      - "scripts/ignore_translation.toml"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-files:
+    runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+
+      - name: Sync translation property files
+        run: |
+          python .github/scripts/check_language_properties.py --reference-file "app/core/src/main/resources/messages_en_GB.properties" --branch main
+
+      - name: Commit translation files
+        run: |
+          git add app/core/src/main/resources/messages_*.properties
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+
+      - name: Install dependencies
+        # Wheels-only + Hash-Pinning
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+
+      - name: Sync README.md
+        run: |
+          python scripts/counter_translation.py
+
+      - name: Run git add
+        run: |
+          git add README.md scripts/ignore_translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
+
+      - name: Create Pull Request
+        if: always()
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: Update files
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: sync_readme
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          body: |
+            ### Description of Changes
+
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+
+            #### **1. Synchronization of Translation Files**
+            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
+            - Ensured consistency and synchronization across all supported language files.
+            - Highlighted any missing or incomplete translations.
+
+            #### **2. Update README.md**
+            - Generated the translation progress table in `README.md`.
+            - Added a summary of the current translation status for all supported languages.
+            - Included up-to-date statistics on translation coverage.
+
+            #### **Why these changes are necessary**
+            - Keeps translation files aligned with the latest reference updates.
+            - Ensures the documentation reflects the current translation progress.
+
+            ---
+
+            Auto-generated by [create-pull-request][1].
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
+          add-paths: |
+            README.md
+            app/core/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,15 +1,15 @@
-name: Sync Files (TOML)
+name: Sync Files V2
 
 on:
   workflow_dispatch:
   push:
     branches:
-      - main
+      - V2
       - syncLangTest
     paths:
       - "build.gradle"
       - "README.md"
-      - "frontend/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.json"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
       - "scripts/ignore_translation.toml"
 
@@ -52,25 +52,21 @@ jobs:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
-      - name: Install Python dependencies
+      - name: Sync translation JSON files
         run: |
-          pip install tomli-w
-
-      - name: Sync translation TOML files
-        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
+          python .github/scripts/check_language_json.py --reference-file "frontend/public/locales/en-GB/translation.json" --branch V2
 
       - name: Commit translation files
         run: |
-          git add frontend/public/locales/*/translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
+          git add frontend/public/locales/*/translation.json
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
 
-      - name: Install README dependencies
+      - name: Install dependencies
         run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Sync README.md
         run: |
-          python scripts/counter_translation_v3.py
+          python scripts/counter_translation_v2.py
 
       - name: Run git add
         run: |
@@ -86,22 +82,21 @@ jobs:
           committer: ${{ steps.setup-bot.outputs.committer }}
           author: ${{ steps.setup-bot.outputs.committer }}
           signoff: true
-          branch: sync_readme_v3
-          base: main
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          branch: sync_readme_v2
+          base: V2
+          title: ":globe_with_meridians: [V2] Sync Translations + Update README Progress Table"
           body: |
             ### Description of Changes
 
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation for the **V2 branch**. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.json`) to reflect changes in the reference file `en-GB/translation.json`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
-            - **Format**: TOML
 
             #### **2. Update README.md**
-            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
+            - Generated the translation progress table in `README.md`.
             - Added a summary of the current translation status for all supported languages.
             - Included up-to-date statistics on translation coverage.
 
@@ -120,5 +115,4 @@ jobs:
           sign-commits: true
           add-paths: |
             README.md
-            frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            frontend/public/locales/*/translation.json

.github/workflows/tauri-build.yml

@@ -14,7 +14,7 @@ on:
           - macos
           - linux
   pull_request:
-    branches: [main, V2, V2-tauri-windows]
+    branches: [main, V2]
     paths:
       - 'frontend/src-tauri/**'
       - 'frontend/src/desktop/**'
@@ -28,7 +28,6 @@ permissions:
 
 jobs:
   determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -62,9 +61,6 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
     runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
@@ -93,6 +89,8 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
+
+
       - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
@@ -176,84 +174,6 @@ jobs:
         working-directory: ./frontend
         run: npm install
 
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
       - name: Import Apple Developer Certificate
         if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         env:
@@ -309,177 +229,13 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          SIGN: 1
           CI: true
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
           args: ${{ matrix.args }}
 
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # List available certificates and check if they have certificates attached
-          Write-Host "Checking for available certificates..."
-          $certList = & smctl keypair ls 2>&1
-          Write-Host "Keypair list output:"
-          Write-Host $certList
-          Write-Host ""
-
-          # Parse the output to check certificate status
-          $lines = $certList -split "`n"
-          $foundKeypair = $false
-          $hasCertificate = $false
-
-          foreach ($line in $lines) {
-            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
-              $foundKeypair = $true
-              Write-Host "[SUCCESS] Found keypair in list"
-
-              # Check if this line has certificate info (not just empty spaces after alias)
-              $parts = $line -split "\s+"
-              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
-                $hasCertificate = $true
-                Write-Host "[SUCCESS] Certificate is associated with keypair"
-              }
-            }
-          }
-
-          if (-not $foundKeypair) {
-            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
-            Write-Host "Available keypairs are listed above"
-            Write-Host ""
-            Write-Host "Please verify:"
-            Write-Host "  1. Keypair alias is correct in GitHub secret"
-            Write-Host "  2. API key has access to this keypair"
-            exit 1
-          }
-
-          if (-not $hasCertificate) {
-            Write-Host "[ERROR] No certificate associated with keypair"
-            Write-Host "This usually means:"
-            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
-            Write-Host "  2. Certificate is pending approval"
-            Write-Host "  3. Certificate needs to be attached to the keypair"
-            Write-Host ""
-            Write-Host "Try running in DigiCert ONE portal:"
-            Write-Host "  smctl keypair sync"
-            exit 1
-          }
-
-          Write-Host "[SUCCESS] Certificate check passed"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              Write-Host ""
-              Write-Host "Possible issues:"
-              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
-              Write-Host "  2. Incorrect keypair alias"
-              Write-Host "  3. API key lacks signing permissions"
-              Write-Host ""
-              Write-Host "Please verify in DigiCert ONE portal:"
-              Write-Host "  - Certificate status is 'Issued' (not Pending)"
-              Write-Host "  - Keypair status is 'Online'"
-              Write-Host "  - 'Can sign' is set to 'Yes'"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
       - name: Verify notarization (macOS only)
         if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         run: |
@@ -513,66 +269,6 @@ jobs:
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
-      - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
-        shell: pwsh
-        run: |
-          Write-Host "Verifying Windows code signatures..."
-
-          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
-          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
-
-          $allSigned = $true
-          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
-          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
-
-          # Check EXE signature
-          if (Test-Path $exePath) {
-            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
-            Write-Host "EXE Signature Status: $($exeSig.Status)"
-            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
-            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
-
-            if ($exeSig.Status -ne "Valid") {
-              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
-              if ($usingKeyLocker -or $usingPfx) {
-                Write-Host "[ERROR] Certificate was provided but signing failed"
-                $allSigned = $false
-              } else {
-                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
-              }
-            } else {
-              Write-Host "[SUCCESS] EXE is properly signed"
-            }
-          }
-
-          # Check MSI signature
-          if (Test-Path $msiPath) {
-            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
-            Write-Host "MSI Signature Status: $($msiSig.Status)"
-            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
-            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
-
-            if ($msiSig.Status -ne "Valid") {
-              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
-              if ($usingKeyLocker -or $usingPfx) {
-                Write-Host "[ERROR] Certificate was provided but signing failed"
-                $allSigned = $false
-              } else {
-                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
-              }
-            } else {
-              Write-Host "[SUCCESS] MSI is properly signed"
-            }
-          }
-
-          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
-            Write-Host "[ERROR] Code signing verification failed"
-            exit 1
-          } else {
-            Write-Host "[SUCCESS] Code signature verification completed"
-          }
-
       - name: Upload artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -637,8 +333,6 @@ jobs:
           if [ "${{ needs.build.result }}" = "success" ]; then
             echo "✅ All Tauri builds completed successfully!"
             echo "Artifacts are ready for distribution."
-          elif [ "${{ needs.build.result }}" = "skipped" ]; then
-            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
           else
             echo "❌ Some Tauri builds failed."
             echo "Please check the logs and fix any issues."

.github/workflows/testdriver.yml

@@ -21,7 +21,6 @@ permissions:
 
 jobs:
   deploy:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -67,7 +66,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

.gitignore

@@ -17,8 +17,8 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/
-!pipeline/.gitkeep
+pipeline/watchedFolders/
+pipeline/finishedFolders/
 customFiles/
 configs/
 watchedFolders/
@@ -31,23 +31,8 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json
 
-# Frontend build artifacts copied to backend static resources
-# These are generated by npm build and should not be committed
-app/core/src/main/resources/static/assets/
-app/core/src/main/resources/static/index.html
-app/core/src/main/resources/static/locales/
-app/core/src/main/resources/static/Login/
-app/core/src/main/resources/static/classic-logo/
-app/core/src/main/resources/static/modern-logo/
-app/core/src/main/resources/static/og_images/
-app/core/src/main/resources/static/samples/
-app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/robots.txt
-# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
-
 # Gradle
 .gradle
-.gradle-home
 .lock
 
 # External tool builders
@@ -228,17 +213,3 @@ node_modules/
 test_batch.json
 *.backup.*.json
 frontend/public/locales/*/translation.backup*.json
-
-# Development/build artifacts
-.gradle-cache/
-scripts/pdf-collection/
-**/tmp/
-*.backup
-
-# Type3 development data
-docs/type3/signatures/
-
-
-# Type3 sample PDFs (development only)
-**/type3/samples/
-

ADDING_TOOLS.md

@@ -202,10 +202,10 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-GB/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.json`
 
 **Required Translation Keys**:
-```toml
+```json
 {
   "home": {
     "[toolName]": {
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-GB/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.json`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

LICENSE

@@ -6,10 +6,6 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "frontend/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
-* All content that resides under the "frontend/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

README.md

@@ -1,69 +1,173 @@
-<p align="center">
-  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
-</p>
+<p align="center"><img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80"></p>
+<h1 align="center">Stirling-PDF</h1>
 
-<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
+[![Docker Pulls](https://img.shields.io/docker/pulls/frooodle/s-pdf)](https://hub.docker.com/r/frooodle/s-pdf)
+[![Discord](https://img.shields.io/discord/1068636748814483718?label=Discord)](https://discord.gg/HYmhKj45pU)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge)](https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF)
+[![GitHub Repo stars](https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social)](https://github.com/Stirling-Tools/stirling-pdf)
 
-Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
+<a href="https://www.producthunt.com/posts/stirling-pdf?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-stirling&#0045;pdf" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=641239&theme=light" alt="Stirling&#0032;PDF - Open&#0032;source&#0032;locally&#0032;hosted&#0032;web&#0032;PDF&#0032;editor | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/apps/new?repo=https://github.com/Stirling-Tools/Stirling-PDF/tree/digitalOcean&refcode=c3210994b1af)
 
-<p align="center">
-  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
-    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
-  </a>
-  <a href="https://discord.gg/HYmhKj45pU">
-    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
-  </a>
-  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
-    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
-  </a>
-  <a href="https://github.com/Stirling-Tools/stirling-pdf">
-    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
-  </a>
-</p>
+[Stirling-PDF](https://www.stirlingpdf.com) is a robust, locally hosted web-based PDF manipulation tool using Docker. It enables you to carry out various operations on PDF files, including splitting, merging, converting, reorganizing, adding images, rotating, compressing, and more. This locally hosted web application has evolved to encompass a comprehensive set of features, addressing all your PDF requirements.
 
-![Stirling PDF - Dashboard](images/home-light.png)
+All files and PDFs exist either exclusively on the client side, reside in server memory only during task execution, or temporarily reside in a file solely for the execution of the task. Any file downloaded by the user will have been deleted from the server by that point.
 
-## Key Capabilities
+Homepage: [https://stirlingpdf.com](https://stirlingpdf.com)
 
-- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
-- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
-- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
-- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
-- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
-- **Global UI** - Interface available in 40+ languages.
+All documentation available at [https://docs.stirlingpdf.com/](https://docs.stirlingpdf.com/)
 
-For a full feature list, see the docs: **https://docs.stirlingpdf.com**
+![stirling-home](images/stirling-home.jpg)
 
-## Quick Start
+## Features
 
-```bash
-docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
-```
+- 50+ PDF Operations
+- Parallel file processing and downloads
+- Dark mode support
+- Custom download options
+- Custom 'Pipelines' to run multiple features in a automated queue
+- API for integration with external scripts
+- Optional Login and Authentication support (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/System%20and%20Security) for documentation)
+- Database Backup and Import (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/DATABASE) for documentation)
+- Enterprise features like SSO (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/Single%20Sign-On%20Configuration) for documentation)
 
-Then open: http://localhost:8080
+## PDF Features
 
-For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
+### Page Operations
 
-## Resources
+- View and modify PDFs - View multi-page PDFs with custom viewing, sorting, and searching. Plus, on-page edit features like annotating, drawing, and adding text and images. (Using PDF.js with Joxit and Liberation fonts)
+- Full interactive GUI for merging/splitting/rotating/moving PDFs and their pages
+- Merge multiple PDFs into a single resultant file
+- Split PDFs into multiple files at specified page numbers or extract all pages as individual files
+- Reorganize PDF pages into different orders
+- Rotate PDFs in 90-degree increments
+- Remove pages
+- Multi-page layout (format PDFs into a multi-paged page)
+- Scale page contents size by set percentage
+- Adjust contrast
+- Crop PDF
+- Auto-split PDF (with physically scanned page dividers)
+- Extract page(s)
+- Convert PDF to a single page
+- Overlay PDFs on top of each other
+- PDF to a single page
+- Split PDF by sections
 
-- [**Documentation**](https://docs.stirlingpdf.com)
-- [**Homepage**](https://stirling.com)
-- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
-- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
+### Conversion Operations
 
-## Support
+- Convert PDFs to and from images
+- Convert any common file to PDF (using LibreOffice)
+- Convert PDF to Word/PowerPoint/others (using LibreOffice)
+- Convert HTML to PDF
+- Convert PDF to XML
+- Convert PDF to CSV
+- URL to PDF
+- Markdown to PDF
 
-- **Community** [Discord](https://discord.gg/HYmhKj45pU)
-- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+### Security & Permissions
 
-## Contributing
+- Add and remove passwords
+- Change/set PDF permissions
+- Add watermark(s)
+- Certify/sign PDFs
+- Sanitize PDFs
+- Auto-redact text
 
-We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+### Other Operations
 
-For development setup, see the [Developer Guide](DeveloperGuide.md).
+- Add/generate/write signatures
+- Split by Size or PDF
+- Repair PDFs
+- Detect and remove blank pages
+- Compare two PDFs and show differences in text
+- Add images to PDFs
+- Compress PDFs to decrease their filesize (using qpdf)
+- Extract images from PDF
+- Remove images from PDF
+- Extract images from scans
+- Remove annotations
+- Add page numbers
+- Auto-rename files by detecting PDF header text
+- OCR on PDF (using Tesseract OCR)
+- PDF/A conversion (using LibreOffice)
+- Edit metadata
+- Flatten PDFs
+- Get all information on a PDF to view or export as JSON
+- Show/detect embedded JavaScript
 
-For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
 
-## License
 
-Stirling PDF is open-core. See [LICENSE](LICENSE) for details.
+# 📖 Get Started
+
+Visit our comprehensive documentation at [docs.stirlingpdf.com](https://docs.stirlingpdf.com) for:
+
+- Installation guides for all platforms
+- Configuration options
+- Feature documentation
+- API reference
+- Security setup
+- Enterprise features
+
+
+## Supported Languages
+
+Stirling-PDF currently supports 40 languages!
+
+| Language                                     | Progress                               |
+| -------------------------------------------- | -------------------------------------- |
+| Arabic (العربية) (ar_AR)                        | ![64%](https://geps.dev/progress/64)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![24%](https://geps.dev/progress/24)   |
+| Basque (Euskara) (eu_ES)                     | ![14%](https://geps.dev/progress/14)   |
+| Bulgarian (Български) (bg_BG)                | ![26%](https://geps.dev/progress/26)   |
+| Catalan (Català) (ca_CA)                     | ![26%](https://geps.dev/progress/26)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![24%](https://geps.dev/progress/24)   |
+| Czech (Česky) (cs_CZ)                        | ![26%](https://geps.dev/progress/26)   |
+| Danish (Dansk) (da_DK)                       | ![23%](https://geps.dev/progress/23)   |
+| Dutch (Nederlands) (nl_NL)                   | ![23%](https://geps.dev/progress/23)   |
+| English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
+| English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
+| French (Français) (fr_FR)                    | ![63%](https://geps.dev/progress/63)   |
+| German (Deutsch) (de_DE)                     | ![64%](https://geps.dev/progress/64)   |
+| Greek (Ελληνικά) (el_GR)                     | ![26%](https://geps.dev/progress/26)   |
+| Hindi (हिंदी) (hi_IN)                          | ![26%](https://geps.dev/progress/26)   |
+| Hungarian (Magyar) (hu_HU)                   | ![29%](https://geps.dev/progress/29)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![24%](https://geps.dev/progress/24)   |
+| Irish (Gaeilge) (ga_IE)                      | ![26%](https://geps.dev/progress/26)   |
+| Italian (Italiano) (it_IT)                   | ![64%](https://geps.dev/progress/64)   |
+| Japanese (日本語) (ja_JP)                    | ![47%](https://geps.dev/progress/47)   |
+| Korean (한국어) (ko_KR)                      | ![26%](https://geps.dev/progress/26)   |
+| Norwegian (Norsk) (no_NB)                    | ![24%](https://geps.dev/progress/24)   |
+| Persian (فارسی) (fa_IR)                      | ![26%](https://geps.dev/progress/26)   |
+| Polish (Polski) (pl_PL)                      | ![27%](https://geps.dev/progress/27)   |
+| Portuguese (Português) (pt_PT)               | ![26%](https://geps.dev/progress/26)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![64%](https://geps.dev/progress/64)   |
+| Romanian (Română) (ro_RO)                    | ![22%](https://geps.dev/progress/22)   |
+| Russian (Русский) (ru_RU)                    | ![63%](https://geps.dev/progress/63)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![28%](https://geps.dev/progress/28)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![65%](https://geps.dev/progress/65)   |
+| Slovakian (Slovensky) (sk_SK)                | ![19%](https://geps.dev/progress/19)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![27%](https://geps.dev/progress/27)   |
+| Spanish (Español) (es_ES)                    | ![64%](https://geps.dev/progress/64)   |
+| Swedish (Svenska) (sv_SE)                    | ![25%](https://geps.dev/progress/25)   |
+| Thai (ไทย) (th_TH)                           | ![23%](https://geps.dev/progress/23)   |
+| Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![29%](https://geps.dev/progress/29)   |
+| Turkish (Türkçe) (tr_TR)                     | ![28%](https://geps.dev/progress/28)   |
+| Ukrainian (Українська) (uk_UA)               | ![28%](https://geps.dev/progress/28)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![21%](https://geps.dev/progress/21)   |
+| Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
+
+## Stirling PDF Enterprise
+
+Stirling PDF offers an Enterprise edition of its software. This is the same great software but with added features, support and comforts.
+Check out our [Enterprise docs](https://docs.stirlingpdf.com/Pro)
+
+
+## 🤝 Looking to contribute?
+
+Join our community:
+- [Contribution Guidelines](CONTRIBUTING.md)
+- [Translation Guide (How to add custom languages)](devGuide/HowToAddNewLanguage.md)
+- [Developer Guide](devGuide/DeveloperGuide.md)
+- [Issue Tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+- [Discord Community](https://discord.gg/HYmhKj45pU)

WINDOWS_SIGNING.md

@@ -1,258 +0,0 @@
-# Windows Code Signing Setup Guide
-
-This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
-
-## Overview
-
-Windows code signing is essential for:
-- Preventing Windows SmartScreen warnings
-- Building trust with users
-- Enabling Microsoft Store distribution
-- Professional application distribution
-
-## Certificate Types
-
-### OV Certificate (Organization Validated)
-- More affordable option
-- Requires business verification
-- May trigger SmartScreen warnings initially until reputation builds
-- Suitable for most independent software vendors
-
-### EV Certificate (Extended Validation)
-- Premium option with immediate SmartScreen reputation
-- Requires hardware security module (HSM) or cloud-based signing
-- Higher cost but provides immediate trust
-- Required since June 2023 for new certificates
-
-## Obtaining a Certificate
-
-### Certificate Authorities
-Popular certificate authorities for Windows code signing:
-- DigiCert
-- Sectigo (formerly Comodo)
-- GlobalSign
-- SSL.com
-
-### Certificate Format
-You'll receive a certificate in one of these formats:
-- `.pfx` or `.p12` (preferred - contains both certificate and private key)
-- `.cer` + private key (needs conversion to .pfx)
-
-### Converting to PFX (if needed)
-If you have separate certificate and private key files:
-
-```bash
-openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
-```
-
-## Setting Up GitHub Secrets
-
-### Required Secrets
-
-Navigate to your GitHub repository → Settings → Secrets and variables → Actions
-
-Add the following secrets:
-
-#### 1. `WINDOWS_CERTIFICATE`
-- **Description**: Base64-encoded .pfx certificate file
-- **How to create**:
-
-**On macOS/Linux:**
-```bash
-base64 -i certificate.pfx | pbcopy  # Copies to clipboard
-```
-
-**On Windows (PowerShell):**
-```powershell
-[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
-```
-
-Paste the entire base64 string into the GitHub secret.
-
-#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
-- **Description**: Password for the .pfx certificate
-- **Value**: The password you set when creating/exporting the .pfx file
-
-### Optional Secrets for Tauri Updater
-
-If you're using Tauri's built-in updater feature:
-
-#### `TAURI_SIGNING_PRIVATE_KEY`
-- Generated using Tauri CLI: `npm run tauri signer generate`
-- Used for update package verification
-
-#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
-- Password for the Tauri signing key
-
-## Configuration Files
-
-### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
-
-The Windows signing configuration is already set up:
-
-```json
-"windows": {
-  "certificateThumbprint": null,
-  "digestAlgorithm": "sha256",
-  "timestampUrl": "http://timestamp.digicert.com"
-}
-```
-
-**Configuration Options:**
-- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
-- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
-- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
-
-**Alternative Timestamp Servers:**
-- DigiCert: `http://timestamp.digicert.com`
-- Sectigo: `http://timestamp.sectigo.com`
-- GlobalSign: `http://timestamp.globalsign.com`
-
-### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
-
-The workflow includes three Windows signing steps:
-
-1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
-2. **Build Tauri App**: Builds and signs the application using the imported certificate
-3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
-
-## Testing the Setup
-
-### 1. Local Testing (Windows Only)
-
-Before pushing to GitHub, test locally:
-
-```powershell
-# Set environment variables
-$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
-$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
-
-# Build the application
-cd frontend
-npm run tauri build
-
-# Verify the signature
-Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
-```
-
-### 2. GitHub Actions Testing
-
-1. Push your changes to a branch
-2. Manually trigger the workflow:
-   - Go to Actions → Build Tauri Applications
-   - Click "Run workflow"
-   - Select "windows" platform
-3. Check the build logs for:
-   - ✅ Certificate import success
-   - ✅ Build completion
-   - ✅ Signature verification
-
-### 3. Verifying Signed Binaries
-
-After downloading the built artifacts:
-
-**Windows (PowerShell):**
-```powershell
-Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
-Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
-```
-
-Look for:
-- Status: `Valid`
-- Signer: Your organization name
-- Timestamp: Recent date/time
-
-**Windows (GUI):**
-1. Right-click the .exe or .msi file
-2. Select "Properties"
-3. Go to "Digital Signatures" tab
-4. Verify signature details
-
-## Troubleshooting
-
-### "HashMismatch" Status
-- Certificate doesn't match the binary
-- Possible file corruption during download
-- Re-download and verify
-
-### "NotSigned" Status
-- Certificate wasn't imported correctly
-- Check GitHub secrets are set correctly
-- Verify base64 encoding is complete (no truncation)
-
-### "UnknownError" Status
-- Timestamp server unreachable
-- Try alternative timestamp URL in tauri.conf.json
-- Check network connectivity in GitHub Actions
-
-### SmartScreen Still Shows Warnings
-- Normal for OV certificates initially
-- Reputation builds over time with user downloads
-- Consider EV certificate for immediate reputation
-
-### Certificate Not Found During Build
-- Verify `WINDOWS_CERTIFICATE` secret is set
-- Check base64 encoding is correct (no extra whitespace)
-- Ensure password is correct
-
-## Security Best Practices
-
-1. **Never commit certificates to version control**
-   - Keep .pfx files secure and backed up
-   - Use GitHub secrets for CI/CD
-
-2. **Rotate certificates before expiration**
-   - Set calendar reminders
-   - Update GitHub secrets with new certificate
-
-3. **Use strong passwords**
-   - Certificate password should be complex
-   - Store securely (password manager)
-
-4. **Monitor certificate usage**
-   - Review GitHub Actions logs
-   - Set up notifications for failed builds
-
-5. **Limit access to secrets**
-   - Only repository admins should access secrets
-   - Audit secret access regularly
-
-## Certificate Lifecycle
-
-### Before Expiration
-1. Obtain new certificate from CA (typically annual renewal)
-2. Convert to .pfx format if needed
-3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
-4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
-5. Test build to verify new certificate works
-
-### Expired Certificates
-- Signed binaries remain valid (timestamp proves signing time)
-- New builds will fail until certificate is renewed
-- Users can still install previously signed versions
-
-## Cost Considerations
-
-### Certificate Costs (Annual, as of 2024)
-- **OV Certificate**: $100-400/year
-- **EV Certificate**: $400-1000/year
-
-### Choosing the Right Certificate
-- **Open source / early stage**: Start with OV
-- **Commercial / enterprise**: Consider EV for better trust
-- **Microsoft Store**: EV certificate required
-
-## Additional Resources
-
-- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
-- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
-- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
-- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
-
-## Support
-
-If you encounter issues with Windows code signing:
-1. Check GitHub Actions logs for detailed error messages
-2. Verify all secrets are set correctly
-3. Test certificate locally first (Windows environment required)
-4. Open an issue in the repository with relevant logs (remove sensitive data)

app/common/build.gradle

@@ -37,8 +37,6 @@ dependencies {
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
-    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
-    api "org.apache.pdfbox:preflight:$pdfboxVersion"
     api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:2.10'

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
-                Use these endpoints to understand what's inside a document without changing it.
+                Document analysis and information extraction services for content intelligence and insights.
 
-                Typical uses:
-                • Get page counts and dimensions for layout or print rules
-                • List fonts and annotations to spot compatibility issues
-                • Inspect form fields before deciding how to fill or modify them
-                • Pull metadata and security settings for audits or reports
+                This endpoint group provides analytical capabilities to understand document structure,
+                extract information, and generate insights from PDF content for automated processing.
+
+                Common use cases:
+                • Document inventory management and content audit for compliance verification
+                • Quality assurance workflows and business intelligence analytics
+                • Migration planning, accessibility evaluation, and document forensics
+
+                Business applications:
+                • Legal discovery, financial document review, and healthcare records analysis
+                • Academic research, government processing, and publishing optimization
+
+                Operational scenarios:
+                • Large-scale profiling, migration assessment, and performance optimization
+                • Automated quality control and content strategy development
+
+                Target users: Data analysts, QA teams, administrators, and business intelligence
+                professionals requiring detailed document insights.
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
-                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
+                Document format transformation services for cross-platform compatibility and workflow integration.
 
-                Typical uses:
-                • Turn PDFs into Word or text for editing
-                • Convert office files, images, HTML, or email (EML) into PDFs
-                • Create PDF/A for long-term archiving
-                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
+                This endpoint group enables transformation between various formats, supporting
+                diverse business workflows and system integrations for mixed document ecosystems.
+
+                Common use cases:
+                • Legacy system integration, document migration, and cross-platform sharing
+                • Archive standardization, publishing preparation, and content adaptation
+                • Accessibility compliance and mobile-friendly document preparation
+
+                Business applications:
+                • Enterprise content management, digital publishing, and educational platforms
+                • Legal document processing, healthcare interoperability, and government standardization
+
+                Integration scenarios:
+                • API-driven pipelines, automated workflow preparation, and batch conversions
+                • Real-time format adaptation for user requests
+
+                Target users: System integrators, content managers, digital archivists, and
+                organizations requiring flexible document format interoperability.
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
-                Use these endpoints as a "pre-check" step to decide what to do with a file next.
+                Document content filtering and search operations for information discovery and organization.
 
-                Typical uses:
-                • Reject files that are too big or too small
-                • Detect image-only PDFs that should go through OCR
-                • Ensure a document has enough pages before it enters a workflow
-                • Check orientation of pages before printing or merging
+                This endpoint group enables intelligent content discovery and organization within
+                document collections for content-based processing and information extraction.
+
+                Common use cases:
+                • Legal discovery, research organization, and compliance auditing
+                • Content moderation, academic research, and business intelligence
+                • Quality assurance and content validation workflows
+
+                Business applications:
+                • Contract analysis, financial review, and healthcare records organization
+                • Government processing, educational curation, and IP protection
+
+                Workflow scenarios:
+                • Large-scale processing, automated classification, and information extraction
+                • Document preparation for further processing or analysis
+
+                Target users: Legal professionals, researchers, compliance officers, and
+                organizations requiring intelligent document content discovery and organization.
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,13 +22,21 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
-                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
+                Core PDF processing operations for fundamental document manipulation workflows.
 
-                Typical uses:
-                • Split a large PDF into smaller files (by pages, chapters, or size)
-                • Merge several PDFs into one report or pack
-                • Rotate or reorder pages before sending or archiving
-                • Turn a multi-page document into one long scrolling page
+                This endpoint group provides essential PDF functionality that forms the foundation
+                of most document processing workflows across various industries.
+
+                Common use cases:
+                • Document preparation for archival systems and content organization
+                • File preparation for distribution, accessibility compliance, and batch processing
+                • Document consolidation for reporting and legal compliance workflows
+
+                Typical applications:
+                • Content management, publishing workflows, and educational content distribution
+                • Business process automation and archive management
+
+                Target users: Content managers, document processors, and organizations requiring
+                reliable foundational PDF manipulation capabilities.
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -1,37 +0,0 @@
-package stirling.software.common.annotations.api;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import io.swagger.v3.oas.annotations.tags.Tag;
-
-/**
- * Combined annotation for Invite management controllers.
- * Includes @RestController, @RequestMapping("/api/v1/invite"), and OpenAPI @Tag.
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@RestController
-@RequestMapping("/api/v1/invite")
-@Tag(
-        name = "Invite",
-        description =
-                """
-                Invite-link generation and acceptance endpoints for onboarding new users.
-
-                Provides the ability to issue invitation tokens, send optional email invites,
-                validate and accept invite links, and manage pending invitations for teams.
-
-                Typical use cases include:
-                • Admin workflows for issuing time-limited invitations to external users
-                • Self-service invite acceptance and team assignment
-                • License limit enforcement when provisioning new accounts
-
-                Target users: administrators and automation scripts orchestrating user onboarding.
-                """)
-public @interface InviteApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,15 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
-                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
+                Specialized utilities and supplementary tools for enhanced document processing workflows.
 
-                Typical uses:
-                • Repair a damaged PDF or remove blank pages
-                • Run OCR on scanned PDFs so they become searchable
-                • Compress large PDFs for email or web download
-                • Extract embedded images or scans
-                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
-                • Update PDF metadata (title, author, etc.)
+                This endpoint group provides utility operations that support core document processing
+                tasks and address specific workflow needs in real-world scenarios.
+
+                Common use cases:
+                • Document optimization for bandwidth-limited environments and storage cost management
+                • Document repair, content extraction, and validation for quality assurance
+                • Accessibility improvement and custom processing for specialized needs
+
+                Business applications:
+                • Web publishing optimization, email attachment management, and archive efficiency
+                • Mobile compatibility, print production, and legacy document recovery
+
+                Operational scenarios:
+                • Batch processing, quality control, and performance optimization
+                • Troubleshooting and recovery of problematic documents
+
+                Target users: System administrators, document specialists, and organizations requiring
+                specialized document processing and optimization tools.
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,12 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
-                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
+                Automated document processing workflows for complex multi-stage business operations.
 
-                Typical uses:
-                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
-                • Normalise documents before they enter an archive
-                • Wrap a complex document flow behind a single API call for your own apps
+                This endpoint group enables organizations to create sophisticated document processing
+                workflows that combine multiple operations into streamlined, repeatable processes.
+
+                Common use cases:
+                • Invoice processing, legal document review, and healthcare records standardization
+                • Government processing, educational content preparation, and publishing automation
+                • Contract lifecycle management and approval processes
+
+                Business applications:
+                • Automated compliance reporting, large-scale migration, and quality assurance
+                • Archive preparation, content delivery, and document approval workflows
+
+                Operational scenarios:
+                • Scheduled batch processing and event-driven document processing
+                • Multi-department coordination and business system integration
+
+                Target users: Business process managers, IT automation specialists, and organizations
+                requiring consistent, repeatable document processing workflows.
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
-                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
+                Document security and protection services for confidential and sensitive content.
 
-                Typical uses:
-                • Add or remove a password on a PDF
-                • Redact personal or confidential information (manually or automatically)
-                • Validate or remove digital signatures
-                • Sanitize a PDF to strip scripts and embedded content
+                This endpoint group provides essential security operations for organizations handling
+                sensitive documents and materials requiring controlled access.
+
+                Common use cases:
+                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
+                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
+                • Contract security for business transactions
+
+                Business applications:
+                • Document authentication, confidential sharing, and secure archiving
+                • Content watermarking, access control, and privacy protection through redaction
+
+                Industry scenarios:
+                • Legal discovery, medical records exchange, financial audit documentation
+                • Enterprise policy enforcement and data governance
+
+                Target users: Legal professionals, healthcare administrators, compliance officers,
+                government agencies, and enterprises handling sensitive content.
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -68,7 +68,6 @@ public class ApplicationProperties {
 
     private AutoPipeline autoPipeline = new AutoPipeline();
     private ProcessExecutor processExecutor = new ProcessExecutor();
-    private PdfEditor pdfEditor = new PdfEditor();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -101,46 +100,6 @@ public class ApplicationProperties {
         private String outputFolder;
     }
 
-    @Data
-    public static class PdfEditor {
-        private Cache cache = new Cache();
-        private FontNormalization fontNormalization = new FontNormalization();
-        private CffConverter cffConverter = new CffConverter();
-        private Type3 type3 = new Type3();
-        private String fallbackFont = "classpath:/static/fonts/NotoSans-Regular.ttf";
-
-        @Data
-        public static class Cache {
-            private long maxBytes = -1;
-            private int maxPercent = 20;
-        }
-
-        @Data
-        public static class FontNormalization {
-            private boolean enabled = false;
-        }
-
-        @Data
-        public static class CffConverter {
-            private boolean enabled = true;
-            private String method = "python";
-            private String pythonCommand = "/opt/venv/bin/python3";
-            private String pythonScript = "/scripts/convert_cff_to_ttf.py";
-            private String fontforgeCommand = "fontforge";
-        }
-
-        @Data
-        public static class Type3 {
-            private Library library = new Library();
-
-            @Data
-            public static class Library {
-                private boolean enabled = true;
-                private String index = "classpath:/type3/library/index.json";
-            }
-        }
-    }
-
     @Data
     public static class Legal {
         private String termsAndConditions;
@@ -153,6 +112,7 @@ public class ApplicationProperties {
     @Data
     public static class Security {
         private Boolean enableLogin;
+        private Boolean csrfDisabled;
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
@@ -398,7 +358,6 @@ public class ApplicationProperties {
         private Boolean enableAnalytics;
         private Boolean enablePosthog;
         private Boolean enableScarf;
-        private Boolean enableDesktopInstallSlide;
         private Datasource datasource;
         private Boolean disableSanitize;
         private int maxDPI;
@@ -409,12 +368,10 @@ public class ApplicationProperties {
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
         private List<String> corsAllowedOrigins = new ArrayList<>();
-        private String backendUrl; // Backend base URL for SAML/OAuth/API callbacks (e.g.
-        // 'http://localhost:8080', 'https://api.example.com'). Required for
-        // SSO.
-        private String frontendUrl; // Frontend URL for invite email links (e.g.
+        private String
+                frontendUrl; // Base URL for frontend (used for invite links, etc.). If not set,
 
-        // 'https://app.example.com'). If not set, falls back to backendUrl.
+        // falls back to backend URL.
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -579,7 +536,6 @@ public class ApplicationProperties {
         @ToString.Exclude private String key;
         private String UUID;
         private String appVersion;
-        private Boolean isNewServer;
     }
 
     // TODO: Remove post migration
@@ -619,16 +575,6 @@ public class ApplicationProperties {
         private String username;
         @ToString.Exclude private String password;
         private String from;
-        // STARTTLS upgrades a plain SMTP connection to TLS after connecting (RFC 3207)
-        private Boolean startTlsEnable = true;
-        private Boolean startTlsRequired;
-        // SSL/TLS wrapper for implicit TLS (typically port 465)
-        private Boolean sslEnable;
-        // Hostnames or patterns (e.g., "smtp.example.com" or "*") to trust for TLS certificates;
-        // defaults to "*" (trust all) when not set
-        private String sslTrust;
-        // Enables hostname verification for TLS connections
-        private Boolean sslCheckServerIdentity;
     }
 
     @Data
@@ -697,7 +643,6 @@ public class ApplicationProperties {
             private int weasyPrintSessionLimit;
             private int installAppSessionLimit;
             private int calibreSessionLimit;
-            private int imageMagickSessionLimit;
             private int qpdfSessionLimit;
             private int tesseractSessionLimit;
             private int ghostscriptSessionLimit;
@@ -735,10 +680,6 @@ public class ApplicationProperties {
                 return calibreSessionLimit > 0 ? calibreSessionLimit : 1;
             }
 
-            public int getImageMagickSessionLimit() {
-                return imageMagickSessionLimit > 0 ? imageMagickSessionLimit : 4;
-            }
-
             public int getGhostscriptSessionLimit() {
                 return ghostscriptSessionLimit > 0 ? ghostscriptSessionLimit : 8;
             }
@@ -768,8 +709,6 @@ public class ApplicationProperties {
             @JsonProperty("calibretimeoutMinutes")
             private long calibreTimeoutMinutes;
 
-            private long imageMagickTimeoutMinutes;
-
             private long tesseractTimeoutMinutes;
             private long qpdfTimeoutMinutes;
             private long ghostscriptTimeoutMinutes;
@@ -807,10 +746,6 @@ public class ApplicationProperties {
                 return calibreTimeoutMinutes > 0 ? calibreTimeoutMinutes : 30;
             }
 
-            public long getImageMagickTimeoutMinutes() {
-                return imageMagickTimeoutMinutes > 0 ? imageMagickTimeoutMinutes : 30;
-            }
-
             public long getGhostscriptTimeoutMinutes() {
                 return ghostscriptTimeoutMinutes > 0 ? ghostscriptTimeoutMinutes : 30;
             }

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -41,7 +41,7 @@ public class CustomPDFDocumentFactory {
 
     // Memory thresholds and limits
 
-    public static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
+    private static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
     // Files smaller than this threshold are loaded entirely in memory for better performance.
     // These files use IOUtils.createMemoryOnlyStreamCache() which keeps all document data in RAM.
     // No temp files are created for document data, reducing I/O operations but consuming more

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -9,7 +9,6 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -38,9 +37,6 @@ public class JobExecutorService {
     private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
     private final long effectiveTimeoutMs;
 
-    @Autowired(required = false)
-    private JobOwnershipService jobOwnershipService;
-
     public JobExecutorService(
             TaskManager taskManager,
             FileStorage fileStorage,
@@ -102,17 +98,11 @@ public class JobExecutorService {
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
-        // Generate base UUID
-        String baseJobId = UUID.randomUUID().toString();
+        String jobId = UUID.randomUUID().toString();
 
-        // Scope job to authenticated user if security is enabled
-        String scopedJobKey = getScopedJobKey(baseJobId);
-
-        log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
-
-        // Store the scoped job ID in the request for potential use by other components
+        // Store the job ID in the request for potential use by other components
         if (request != null) {
-            request.setAttribute("jobId", scopedJobKey);
+            request.setAttribute("jobId", jobId);
 
             // Also track this job ID in the user's session for authorization purposes
             // This ensures users can only cancel their own jobs
@@ -126,13 +116,11 @@ public class JobExecutorService {
                     request.getSession().setAttribute("userJobIds", userJobIds);
                 }
 
-                userJobIds.add(scopedJobKey);
-                log.debug("Added scoped job ID {} to user session", scopedJobKey);
+                userJobIds.add(jobId);
+                log.debug("Added job ID {} to user session", jobId);
             }
         }
 
-        String jobId = scopedJobKey;
-
         // Determine which timeout to use
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
@@ -161,31 +149,17 @@ public class JobExecutorService {
             taskManager.createTask(jobId);
 
             // Create a specialized wrapper that updates the TaskManager
-            final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
-                            // Set jobId in ThreadLocal context for the queued job
-                            stirling.software.common.util.JobContext.setJobId(
-                                    capturedJobIdForQueue);
-                            log.debug(
-                                    "Set jobId {} in JobContext for queued job execution",
-                                    capturedJobIdForQueue);
-
                             Object result = work.get();
-                            processJobResult(capturedJobIdForQueue, result);
+                            processJobResult(jobId, result);
                             return result;
                         } catch (Exception e) {
                             log.error(
-                                    "Error executing queued job {}: {}",
-                                    capturedJobIdForQueue,
-                                    e.getMessage(),
-                                    e);
-                            taskManager.setError(capturedJobIdForQueue, e.getMessage());
+                                    "Error executing queued job {}: {}", jobId, e.getMessage(), e);
+                            taskManager.setError(jobId, e.getMessage());
                             throw e;
-                        } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
-                            stirling.software.common.util.JobContext.clear();
                         }
                     };
 
@@ -197,36 +171,21 @@ public class JobExecutorService {
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
-
-            // Capture the jobId for the async thread
-            final String capturedJobId = jobId;
-
             executor.execute(
                     () -> {
                         try {
                             log.debug(
-                                    "Running async job {} with timeout {} ms",
-                                    capturedJobId,
-                                    timeoutToUse);
-
-                            // Set jobId in ThreadLocal context for the async thread
-                            stirling.software.common.util.JobContext.setJobId(capturedJobId);
-                            log.debug(
-                                    "Set jobId {} in JobContext for async execution",
-                                    capturedJobId);
+                                    "Running async job {} with timeout {} ms", jobId, timeoutToUse);
 
                             // Execute with timeout
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
-                            processJobResult(capturedJobId, result);
+                            processJobResult(jobId, result);
                         } catch (TimeoutException te) {
                             log.error("Job {} timed out after {} ms", jobId, timeoutToUse);
                             taskManager.setError(jobId, "Job timed out");
                         } catch (Exception e) {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
-                        } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
-                            stirling.software.common.util.JobContext.clear();
                         }
                     });
 
@@ -235,10 +194,6 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
-                // Make jobId available to downstream components on the worker thread
-                stirling.software.common.util.JobContext.setJobId(jobId);
-                log.debug("Set jobId {} in JobContext for sync execution", jobId);
-
                 // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
@@ -258,8 +213,6 @@ public class JobExecutorService {
                 // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
-            } finally {
-                stirling.software.common.util.JobContext.clear();
             }
         }
     }
@@ -513,23 +466,8 @@ public class JobExecutorService {
             throws TimeoutException, Exception {
         // Use the same executor as other async jobs for consistency
         // This ensures all operations run on the same thread pool
-        String currentJobId = stirling.software.common.util.JobContext.getJobId();
-
         java.util.concurrent.CompletableFuture<T> future =
-                java.util.concurrent.CompletableFuture.supplyAsync(
-                        () -> {
-                            if (currentJobId != null) {
-                                stirling.software.common.util.JobContext.setJobId(currentJobId);
-                            }
-                            try {
-                                return supplier.get();
-                            } finally {
-                                if (currentJobId != null) {
-                                    stirling.software.common.util.JobContext.clear();
-                                }
-                            }
-                        },
-                        executor);
+                java.util.concurrent.CompletableFuture.supplyAsync(supplier, executor);
 
         try {
             return future.get(timeoutMs, TimeUnit.MILLISECONDS);
@@ -545,18 +483,4 @@ public class JobExecutorService {
             throw new Exception("Execution was interrupted", e);
         }
     }
-
-    /**
-     * Get a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param baseJobId the base job identifier
-     * @return scoped job key, or just baseJobId if no ownership service available
-     */
-    private String getScopedJobKey(String baseJobId) {
-        if (jobOwnershipService != null) {
-            return jobOwnershipService.createScopedJobKey(baseJobId);
-        }
-        // Security disabled, return unsecured job key
-        return baseJobId;
-    }
 }

app/common/src/main/java/stirling/software/common/service/JobOwnershipService.java

@@ -1,42 +0,0 @@
-package stirling.software.common.service;
-
-import java.util.Optional;
-
-/**
- * Service interface for managing job ownership and access control. Implementations can provide
- * user-scoped job isolation when security is enabled, or no-op behavior when security is disabled.
- */
-public interface JobOwnershipService {
-
-    /**
-     * Get the current authenticated user's identifier.
-     *
-     * @return Optional containing user identifier, or empty if not authenticated
-     */
-    Optional<String> getCurrentUserId();
-
-    /**
-     * Create a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param jobId the base job identifier
-     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
-     */
-    String createScopedJobKey(String jobId);
-
-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param scopedJobKey the scoped job key to validate
-     * @return true if current user owns the job or no authentication is required
-     * @throws SecurityException if current user does not own the job
-     */
-    boolean validateJobAccess(String scopedJobKey);
-
-    /**
-     * Extract the base job ID from a scoped job key.
-     *
-     * @param scopedJobKey the scoped job key
-     * @return the base job ID without user prefix
-     */
-    String extractJobId(String scopedJobKey);
-}

app/common/src/main/java/stirling/software/common/service/LineArtConversionService.java

@@ -1,12 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
-
-public interface LineArtConversionService {
-    PDImageXObject convertImageToLineArt(
-            PDDocument doc, PDImageXObject originalImage, double threshold, int edgeLevel)
-            throws IOException;
-}

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -1,21 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-/**
- * Interface for personal signature access (proprietary feature). Implemented only in proprietary
- * module to provide authenticated users access to their personal signatures.
- */
-public interface PersonalSignatureServiceInterface {
-
-    /**
-     * Get a personal signature from the user's folder. Only checks personal folder, not shared
-     * folder.
-     *
-     * @param username Username of the signature owner
-     * @param fileName Signature filename
-     * @return Personal signature image bytes
-     * @throws IOException If file not found or read error
-     */
-    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
-}

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -254,7 +254,10 @@ public class PostHogService {
                 properties,
                 "security_enableLogin",
                 applicationProperties.getSecurity().getEnableLogin());
-        addIfNotEmpty(properties, "security_csrfDisabled", true);
+        addIfNotEmpty(
+                properties,
+                "security_csrfDisabled",
+                applicationProperties.getSecurity().getCsrfDisabled());
         addIfNotEmpty(
                 properties,
                 "security_loginAttemptCount",

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -38,7 +38,6 @@ public class GeneralUtils {
             Set.of(
                     "OCR images.json",
                     "Prepare-pdfs-for-email.json",
-                    "Pre-publish-sanitization.json",
                     "split-rotate-auto-rename.json");
 
     private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -1,18 +0,0 @@
-package stirling.software.common.util;
-
-/** Thread-local context for passing job ID across async boundaries */
-public class JobContext {
-    private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
-
-    public static void setJobId(String jobId) {
-        CURRENT_JOB_ID.set(jobId);
-    }
-
-    public static String getJobId() {
-        return CURRENT_JOB_ID.get();
-    }
-
-    public static void clear() {
-        CURRENT_JOB_ID.remove();
-    }
-}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -86,11 +86,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getCalibreSessionLimit();
-                                case IMAGEMAGICK ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getSessionLimit()
-                                                .getImageMagickSessionLimit();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -101,7 +96,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getOcrMyPdfSessionLimit();
-                                case CFF_CONVERTER -> 1;
                             };
 
                     long timeoutMinutes =
@@ -146,11 +140,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getCalibreTimeoutMinutes();
-                                case IMAGEMAGICK ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getTimeoutMinutes()
-                                                .getImageMagickTimeoutMinutes();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -161,7 +150,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getOcrMyPdfTimeoutMinutes();
-                                case CFF_CONVERTER -> 5L;
                             };
                     return new ProcessExecutor(semaphoreLimit, liveUpdates, timeoutMinutes);
                 });
@@ -311,12 +299,10 @@ public class ProcessExecutor {
         WEASYPRINT,
         INSTALL_APP,
         CALIBRE,
-        IMAGEMAGICK,
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,
-        OCR_MY_PDF,
-        CFF_CONVERTER
+        OCR_MY_PDF
     }
 
     @Setter

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -7,106 +7,23 @@ public class RequestUriUtils {
     }
 
     public static boolean isStaticResource(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // API routes are never static except for the public status endpoint
-        if (normalizedUri.startsWith("/api/")) {
-            return normalizedUri.startsWith("/api/v1/info/status");
-        }
-
-        // Well-known static asset directories (backend + React build artifacts)
-        if (normalizedUri.startsWith("/css/")
-                || normalizedUri.startsWith("/fonts/")
-                || normalizedUri.startsWith("/js/")
-                || normalizedUri.startsWith("/images/")
-                || normalizedUri.startsWith("/public/")
-                || normalizedUri.startsWith("/pdfjs/")
-                || normalizedUri.startsWith("/pdfjs-legacy/")
-                || normalizedUri.startsWith("/pdfium/")
-                || normalizedUri.startsWith("/assets/")
-                || normalizedUri.startsWith("/locales/")
-                || normalizedUri.startsWith("/Login/")
-                || normalizedUri.startsWith("/samples/")
-                || normalizedUri.startsWith("/classic-logo/")
-                || normalizedUri.startsWith("/modern-logo/")
-                || normalizedUri.startsWith("/og_images/")) {
-            return true;
-        }
-
-        // Specific static files bundled with the frontend
-        if (normalizedUri.equals("/robots.txt")
-                || normalizedUri.equals("/favicon.ico")
-                || normalizedUri.equals("/manifest.json")
-                || normalizedUri.equals("/site.webmanifest")
-                || normalizedUri.equals("/manifest-classic.json")
-                || normalizedUri.equals("/index.html")) {
-            return true;
-        }
-
-        // Login/error pages remain public
-        if (normalizedUri.startsWith("/login") || normalizedUri.startsWith("/error")) {
-            return true;
-        }
-
-        // Treat common static file extensions as static resources
-        return normalizedUri.endsWith(".svg")
-                || normalizedUri.endsWith(".png")
-                || normalizedUri.endsWith(".ico")
-                || normalizedUri.endsWith(".txt")
-                || normalizedUri.endsWith(".webmanifest")
-                || normalizedUri.endsWith(".js")
-                || normalizedUri.endsWith(".css")
-                || normalizedUri.endsWith(".mjs")
-                || normalizedUri.endsWith(".html")
-                || normalizedUri.endsWith(".toml")
-                || normalizedUri.endsWith(".wasm");
-    }
-
-    public static boolean isFrontendRoute(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // APIs are never treated as frontend routes
-        if (normalizedUri.startsWith("/api/")) {
-            return false;
-        }
-
-        // Blocklist of backend/non-frontend paths that should still go through filters
-        String[] backendOnlyPrefixes = {
-            "/register",
-            "/invite",
-            "/pipeline",
-            "/pdfjs",
-            "/pdfjs-legacy",
-            "/fonts",
-            "/images",
-            "/files",
-            "/css",
-            "/js",
-            "/swagger",
-            "/v1/api-docs",
-            "/actuator"
-        };
-
-        for (String prefix : backendOnlyPrefixes) {
-            if (normalizedUri.equals(prefix) || normalizedUri.startsWith(prefix + "/")) {
-                return false;
-            }
-        }
-
-        if (normalizedUri.isBlank()) {
-            return false;
-        }
-
-        // Allow root and any extensionless path (React Router will handle these)
-        return !normalizedUri.contains(".");
+        return requestURI.startsWith(contextPath + "/css/")
+                || requestURI.startsWith(contextPath + "/fonts/")
+                || requestURI.startsWith(contextPath + "/js/")
+                || requestURI.endsWith(contextPath + "robots.txt")
+                || requestURI.startsWith(contextPath + "/images/")
+                || requestURI.startsWith(contextPath + "/public/")
+                || requestURI.startsWith(contextPath + "/pdfjs/")
+                || requestURI.startsWith(contextPath + "/pdfjs-legacy/")
+                || requestURI.startsWith(contextPath + "/login")
+                || requestURI.startsWith(contextPath + "/error")
+                || requestURI.startsWith(contextPath + "/favicon")
+                || requestURI.endsWith(".svg")
+                || requestURI.endsWith(".png")
+                || requestURI.endsWith(".ico")
+                || requestURI.endsWith(".txt")
+                || requestURI.endsWith(".webmanifest")
+                || requestURI.startsWith(contextPath + "/api/v1/info/status");
     }
 
     public static boolean isTrackableResource(String requestURI) {
@@ -126,14 +43,11 @@ public class RequestUriUtils {
                 || requestURI.endsWith(".svg")
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
-                || requestURI.endsWith(".toml")
-                || requestURI.endsWith(".wasm")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
                 || requestURI.startsWith("/fonts")
-                || requestURI.startsWith("/pdfjs")
-                || requestURI.startsWith("/pdfium"));
+                || requestURI.startsWith("/pdfjs"));
     }
 
     /**
@@ -164,17 +78,9 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith(
                         "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
                 // enableLogin)
-                || trimmedUri.startsWith(
-                        "/api/v1/ui-data/footer-info") // Public footer configuration
+                || trimmedUri.startsWith("/v1/api-docs")
                 || trimmedUri.startsWith("/api/v1/invite/validate")
                 || trimmedUri.startsWith("/api/v1/invite/accept")
-                || trimmedUri.startsWith("/v1/api-docs");
-    }
-
-    private static String stripContextPath(String contextPath, String requestURI) {
-        if (contextPath != null && !contextPath.isBlank() && requestURI.startsWith(contextPath)) {
-            return requestURI.substring(contextPath.length());
-        }
-        return requestURI;
+                || trimmedUri.contains("/v1/api-docs");
     }
 }

app/common/src/test/java/stirling/software/common/service/JobExecutorServiceTest.java

@@ -78,23 +78,6 @@ class JobExecutorServiceTest {
         verify(request).setAttribute(eq("jobId"), anyString());
     }
 
-    @Test
-    void shouldExposeJobIdInJobContextDuringSyncExecution() throws Exception {
-        // Given
-        Supplier<Object> work = stirling.software.common.util.JobContext::getJobId;
-
-        // When
-        ResponseEntity<?> response = jobExecutorService.runJobGeneric(false, work);
-
-        // Then
-        assertEquals(HttpStatus.OK, response.getStatusCode());
-        assertNotNull(response.getBody());
-
-        var requestJobIdCaptor = ArgumentCaptor.forClass(String.class);
-        verify(request).setAttribute(eq("jobId"), requestJobIdCaptor.capture());
-        assertEquals(requestJobIdCaptor.getValue(), response.getBody());
-    }
-
     @Test
     void shouldRunAsyncJobSuccessfully() throws Exception {
         // Given

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -24,9 +24,6 @@ public class RequestUriUtilsTest {
         assertTrue(
                 RequestUriUtils.isStaticResource("/pdfjs/pdf.worker.js"),
                 "PDF.js files should be static");
-        assertTrue(
-                RequestUriUtils.isStaticResource("/pdfium/pdfium.wasm"),
-                "PDFium wasm should be static");
         assertTrue(
                 RequestUriUtils.isStaticResource("/api/v1/info/status"),
                 "API status should be static");
@@ -52,27 +49,6 @@ public class RequestUriUtilsTest {
                 "API products should not be static");
     }
 
-    @Test
-    void testIsFrontendRoute() {
-        assertTrue(
-                RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
-        assertTrue(
-                RequestUriUtils.isFrontendRoute("", "/app/dashboard"),
-                "React routes without extensions should be frontend routes");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/api/v1/users"),
-                "API routes should not be frontend routes");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/register"),
-                "Register should not be treated as a frontend route");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/pipeline/jobs"),
-                "Pipeline should not be treated as a frontend route");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/files/download"),
-                "Files path should not be treated as a frontend route");
-    }
-
     @Test
     void testIsStaticResourceWithContextPath() {
         String contextPath = "/myapp";
@@ -107,14 +83,12 @@ public class RequestUriUtilsTest {
                 "/favicon.ico",
                 "/icon.svg",
                 "/image.png",
-                "/locales/en/translation.toml",
                 "/site.webmanifest",
                 "/app/logo.svg",
                 "/downloads/document.png",
                 "/assets/brand.ico",
                 "/any/path/with/image.svg",
-                "/deep/nested/folder/icon.png",
-                "/pdfium/pdfium.wasm"
+                "/deep/nested/folder/icon.png"
             })
     void testIsStaticResourceWithFileExtensions(String path) {
         assertTrue(
@@ -152,9 +126,6 @@ public class RequestUriUtilsTest {
         assertFalse(
                 RequestUriUtils.isTrackableResource("/script.js"),
                 "JS files should not be trackable");
-        assertFalse(
-                RequestUriUtils.isTrackableResource("/pdfium/pdfium.wasm"),
-                "PDFium wasm should not be trackable");
         assertFalse(
                 RequestUriUtils.isTrackableResource("/swagger/index.html"),
                 "Swagger files should not be trackable");
@@ -231,8 +202,7 @@ public class RequestUriUtilsTest {
                 "/api/v1/info/health",
                 "/site.webmanifest",
                 "/fonts/roboto.woff",
-                "/pdfjs/viewer.js",
-                "/pdfium/pdfium.wasm"
+                "/pdfjs/viewer.js"
             })
     void testNonTrackableResources(String path) {
         assertFalse(

app/core/build.gradle

@@ -1,7 +1,5 @@
 apply plugin: 'org.springframework.boot'
 
-import org.apache.tools.ant.taskdefs.condition.Os
-
 repositories {
     maven { url = 'https://build.shibboleth.net/maven/releases' }
     maven { url = 'https://maven.pkg.github.com/jcefmaven/jcefmaven' }
@@ -17,7 +15,6 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
-        targetExclude 'src/main/resources/static/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
@@ -28,14 +25,12 @@ spotless {
     }
     yaml {
         target '**/*.yml', '**/*.yaml'
-        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
     }
     format 'gradle', {
         target '**/gradle/*.gradle', '**/*.gradle'
-        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -162,125 +157,5 @@ springBoot {
     mainClass = 'stirling.software.SPDF.SPDFApplication'
 }
 
-// Frontend build tasks - only enabled with -PbuildWithFrontend=true
-def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
-def frontendDir = file('../../frontend')
-def frontendDistDir = file('../../frontend/dist')
-def resourcesStaticDir = file('src/main/resources/static')
-def generatedFrontendPaths = [
-    'assets',
-    'index.html',
-    'locales',
-    'Login',
-    'classic-logo',
-    'modern-logo',
-    'og_images',
-    'samples',
-    'manifest-classic.json'
-]
-
-tasks.register('npmInstall', Exec) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Install frontend dependencies'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
-    inputs.file(new File(frontendDir, 'package.json'))
-    inputs.file(new File(frontendDir, 'package-lock.json'))
-    outputs.dir(new File(frontendDir, 'node_modules'))
-
-    // Show live output
-    standardOutput = System.out
-    errorOutput = System.err
-
-    // Skip if node_modules exists and is up-to-date
-    onlyIf {
-        def nodeModules = new File(frontendDir, 'node_modules')
-        if (!nodeModules.exists()) {
-            println "node_modules not found, will install..."
-            return true
-        }
-        def packageJson = new File(frontendDir, 'package.json')
-        def packageLock = new File(frontendDir, 'package-lock.json')
-        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
-                        nodeModules.lastModified() < packageLock.lastModified()
-        if (isOutdated) {
-            println "package.json or package-lock.json changed, will reinstall..."
-        } else {
-            println "node_modules is up-to-date, skipping npm install"
-        }
-        return isOutdated
-    }
-
-    doFirst {
-        println "Installing npm dependencies in ${frontendDir}..."
-    }
-}
-
-tasks.register('npmBuild', Exec) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Build frontend application'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
-    dependsOn npmInstall
-    inputs.dir(new File(frontendDir, 'src'))
-    inputs.file(new File(frontendDir, 'package.json'))
-    outputs.dir(frontendDistDir)
-
-    // Show live output
-    standardOutput = System.out
-    errorOutput = System.err
-
-    // Override VITE_API_BASE_URL to use relative paths for production builds
-    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
-    environment 'VITE_API_BASE_URL', '/'
-
-    doFirst {
-        println "Building frontend application for production (VITE_API_BASE_URL=/)"
-    }
-}
-
-tasks.register('copyFrontendAssets', Copy) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Copy frontend build to static resources'
-    dependsOn npmBuild
-    from(frontendDistDir) {
-        // Exclude files that conflict with backend static resources
-        exclude 'robots.txt'  // Backend already has this
-        exclude 'favicon.ico' // Backend already has this
-    }
-    into resourcesStaticDir
-    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
-    doFirst {
-        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
-        println "Backend static resources will be preserved"
-    }
-    doLast {
-        println "Frontend assets copied successfully!"
-    }
-}
-
-tasks.register('cleanFrontendAssets', Delete) {
-    group = 'frontend'
-    description = 'Remove previously generated frontend assets from static resources'
-    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
-}
-
-// Ensure copyFrontendAssets runs after spotless tasks
-tasks.named('copyFrontendAssets').configure {
-    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
-}
-
-if (buildWithFrontend) {
-    println "Frontend build enabled - JAR will include React frontend"
-    processResources.dependsOn copyFrontendAssets
-} else {
-    println "Frontend build disabled - JAR will be backend-only"
-    // When not building the UI, ensure any stale frontend assets are removed
-    processResources.dependsOn cleanFrontendAssets
-}
-
 bootJar.dependsOn ':common:jar'
 bootJar.dependsOn ':proprietary:jar'

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -12,8 +12,6 @@ import java.util.Properties;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.web.context.WebServerInitializedEvent;
-import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
@@ -200,14 +198,6 @@ public class SPDFApplication {
         // }
     }
 
-    @EventListener
-    public void onWebServerInitialized(WebServerInitializedEvent event) {
-        int actualPort = event.getWebServer().getPort();
-        serverPortStatic = String.valueOf(actualPort);
-        // Log the actual runtime port for Tauri to parse
-        log.info("Stirling-PDF running on port: {}", actualPort);
-    }
-
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
         String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;

app/core/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -18,37 +18,11 @@ import stirling.software.common.model.ApplicationProperties;
 @Slf4j
 public class EndpointConfiguration {
 
-    public enum DisableReason {
-        CONFIG,
-        DEPENDENCY,
-        UNKNOWN
-    }
-
-    public static class EndpointAvailability {
-        private final boolean enabled;
-        private final DisableReason reason;
-
-        public EndpointAvailability(boolean enabled, DisableReason reason) {
-            this.enabled = enabled;
-            this.reason = reason;
-        }
-
-        public boolean isEnabled() {
-            return enabled;
-        }
-
-        public DisableReason getReason() {
-            return reason;
-        }
-    }
-
     private static final String REMOVE_BLANKS = "remove-blanks";
     private final ApplicationProperties applicationProperties;
     @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
     private Set<String> disabledGroups = new HashSet<>();
-    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
-    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
@@ -61,31 +35,16 @@ public class EndpointConfiguration {
         processEnvironmentConfigs();
     }
 
-    private String normalizeEndpoint(String endpoint) {
-        if (endpoint == null) {
-            return null;
-        }
-        return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
-    }
-
     public void enableEndpoint(String endpoint) {
-        String normalized = normalizeEndpoint(endpoint);
-        endpointStatuses.put(normalized, true);
-        endpointDisableReasons.remove(normalized);
-        log.debug("Enabled endpoint: {}", normalized);
+        endpointStatuses.put(endpoint, true);
+        log.debug("Enabled endpoint: {}", endpoint);
     }
 
     public void disableEndpoint(String endpoint) {
-        disableEndpoint(endpoint, DisableReason.CONFIG);
-    }
-
-    public void disableEndpoint(String endpoint, DisableReason reason) {
-        String normalized = normalizeEndpoint(endpoint);
-        if (!Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
-            log.debug("Disabling endpoint: {}", normalized);
+        if (!Boolean.FALSE.equals(endpointStatuses.get(endpoint))) {
+            log.debug("Disabling endpoint: {}", endpoint);
         }
-        endpointStatuses.put(normalized, false);
-        endpointDisableReasons.put(normalized, reason);
+        endpointStatuses.put(endpoint, false);
     }
 
     public boolean isEndpointEnabled(String endpoint) {
@@ -191,10 +150,6 @@ public class EndpointConfiguration {
     }
 
     public void disableGroup(String group) {
-        disableGroup(group, DisableReason.CONFIG);
-    }
-
-    public void disableGroup(String group, DisableReason reason) {
         if (disabledGroups.add(group)) {
             if (isToolGroup(group)) {
                 log.debug(
@@ -206,12 +161,11 @@ public class EndpointConfiguration {
                         group);
             }
         }
-        groupDisableReasons.put(group, reason);
         // Only cascade to endpoints for *functional* groups
         if (!isToolGroup(group)) {
             Set<String> endpoints = endpointGroups.get(group);
             if (endpoints != null) {
-                endpoints.forEach(endpoint -> disableEndpoint(endpoint, reason));
+                endpoints.forEach(this::disableEndpoint);
             }
         }
     }
@@ -220,39 +174,12 @@ public class EndpointConfiguration {
         if (disabledGroups.remove(group)) {
             log.debug("Enabling group: {}", group);
         }
-        groupDisableReasons.remove(group);
         Set<String> endpoints = endpointGroups.get(group);
         if (endpoints != null) {
             endpoints.forEach(this::enableEndpoint);
         }
     }
 
-    public EndpointAvailability getEndpointAvailability(String endpoint) {
-        boolean enabled = isEndpointEnabled(endpoint);
-        DisableReason reason = enabled ? null : determineDisableReason(endpoint);
-        return new EndpointAvailability(enabled, reason);
-    }
-
-    private DisableReason determineDisableReason(String endpoint) {
-        String normalized = normalizeEndpoint(endpoint);
-        if (Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
-            return endpointDisableReasons.getOrDefault(normalized, DisableReason.CONFIG);
-        }
-
-        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
-            String group = entry.getKey();
-            Set<String> endpoints = entry.getValue();
-            if (!disabledGroups.contains(group) || endpoints == null) {
-                continue;
-            }
-            if (endpoints.contains(normalized)) {
-                return groupDisableReasons.getOrDefault(group, DisableReason.CONFIG);
-            }
-        }
-
-        return DisableReason.UNKNOWN;
-    }
-
     public Set<String> getDisabledGroups() {
         return new HashSet<>(disabledGroups);
     }
@@ -334,10 +261,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Convert", "pdf-to-csv");
         addEndpointToGroup("Convert", "pdf-to-markdown");
         addEndpointToGroup("Convert", "eml-to-pdf");
-        addEndpointToGroup("Convert", "cbz-to-pdf");
-        addEndpointToGroup("Convert", "pdf-to-cbz");
-        addEndpointToGroup("Convert", "pdf-to-json");
-        addEndpointToGroup("Convert", "json-to-pdf");
 
         // Adding endpoints to "Security" group
         addEndpointToGroup("Security", "add-password");
@@ -471,10 +394,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Java", "pdf-to-markdown");
         addEndpointToGroup("Java", "add-attachments");
         addEndpointToGroup("Java", "compress-pdf");
-        addEndpointToGroup("Java", "cbz-to-pdf");
-        addEndpointToGroup("Java", "pdf-to-cbz");
-        addEndpointToGroup("Java", "pdf-to-json");
-        addEndpointToGroup("Java", "json-to-pdf");
         addEndpointToGroup("rar", "pdf-to-cbr");
 
         // Javascript
@@ -491,9 +410,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Ghostscript", "repair");
         addEndpointToGroup("Ghostscript", "compress-pdf");
 
-        /* ImageMagick */
-        addEndpointToGroup("ImageMagick", "compress-pdf");
-
         /* tesseract */
         addEndpointToGroup("tesseract", "ocr-pdf");
 
@@ -577,7 +493,6 @@ public class EndpointConfiguration {
                 || "Javascript".equals(group)
                 || "Weasyprint".equals(group)
                 || "Pdftohtml".equals(group)
-                || "ImageMagick".equals(group)
                 || "rar".equals(group);
     }
 

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -12,7 +12,6 @@ import jakarta.annotation.PostConstruct;
 
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.RegexPatternUtils;
 
@@ -25,7 +24,6 @@ public class ExternalAppDepConfig {
     private final String weasyprintPath;
     private final String unoconvPath;
     private final Map<String, List<String>> commandToGroupMapping;
-    private volatile boolean dependenciesChecked = false;
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -46,7 +44,6 @@ public class ExternalAppDepConfig {
                         put("qpdf", List.of("qpdf"));
                         put("tesseract", List.of("tesseract"));
                         put("rar", List.of("rar")); // Required for real CBR output
-                        put("magick", List.of("ImageMagick"));
                     }
                 };
     }
@@ -100,7 +97,7 @@ public class ExternalAppDepConfig {
             if (affectedGroups != null) {
                 for (String group : affectedGroups) {
                     List<String> affectedFeatures = getAffectedFeatures(group);
-                    endpointConfiguration.disableGroup(group, DisableReason.DEPENDENCY);
+                    endpointConfiguration.disableGroup(group);
                     log.warn(
                             "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                             command,
@@ -113,10 +110,6 @@ public class ExternalAppDepConfig {
         }
     }
 
-    public boolean isDependenciesChecked() {
-        return dependenciesChecked;
-    }
-
     @PostConstruct
     public void checkDependencies() {
         // Check core dependencies
@@ -129,14 +122,13 @@ public class ExternalAppDepConfig {
         checkDependencyAndDisableGroup("pdftohtml");
         checkDependencyAndDisableGroup(unoconvPath);
         checkDependencyAndDisableGroup("rar");
-        checkDependencyAndDisableGroup("magick");
         // Special handling for Python/OpenCV dependencies
         boolean pythonAvailable = isCommandAvailable("python3") || isCommandAvailable("python");
         if (!pythonAvailable) {
             List<String> pythonFeatures = getAffectedFeatures("Python");
             List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup("Python", DisableReason.DEPENDENCY);
-            endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("Python");
+            endpointConfiguration.disableGroup("OpenCV");
             log.warn(
                     "Missing dependency: Python - Disabling Python features: {} and OpenCV features: {}",
                     String.join(", ", pythonFeatures),
@@ -154,14 +146,14 @@ public class ExternalAppDepConfig {
                 int exitCode = process.waitFor();
                 if (exitCode != 0) {
                     List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                    endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
+                    endpointConfiguration.disableGroup("OpenCV");
                     log.warn(
                             "OpenCV not available in Python - Disabling OpenCV features: {}",
                             String.join(", ", openCVFeatures));
                 }
             } catch (Exception e) {
                 List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
+                endpointConfiguration.disableGroup("OpenCV");
                 log.warn(
                         "Error checking OpenCV: {} - Disabling OpenCV features: {}",
                         e.getMessage(),
@@ -169,7 +161,5 @@ public class ExternalAppDepConfig {
             }
         }
         endpointConfiguration.logDisabledEndpointsSummary();
-        dependenciesChecked = true;
-        log.info("Dependency checks completed");
     }
 }

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -34,6 +34,7 @@ public class InitialSetup {
     public void init() throws IOException {
         initUUIDKey();
         initSecretKey();
+        initEnableCSRFSecurity();
         initLegalUrls();
         initSetAppVersion();
         GeneralUtils.extractPipeline();
@@ -59,6 +60,18 @@ public class InitialSetup {
         }
     }
 
+    public void initEnableCSRFSecurity() throws IOException {
+        if (GeneralUtils.isVersionHigher(
+                "0.46.0", applicationProperties.getAutomaticallyGenerated().getAppVersion())) {
+            Boolean csrf = applicationProperties.getSecurity().getCsrfDisabled();
+            if (!csrf) {
+                GeneralUtils.saveKeyToSettings("security.csrfDisabled", false);
+                GeneralUtils.saveKeyToSettings("system.enableAnalytics", true);
+                applicationProperties.getSecurity().setCsrfDisabled(false);
+            }
+        }
+    }
+
     public void initLegalUrls() throws IOException {
         // Initialize Terms and Conditions
         String termsUrl = applicationProperties.getLegal().getTermsAndConditions();
@@ -82,7 +95,7 @@ public class InitialSetup {
         isNewServer =
                 existingVersion == null
                         || existingVersion.isEmpty()
-                        || "0.0.0".equals(existingVersion);
+                        || existingVersion.equals("0.0.0");
 
         String appVersion = "0.0.0";
         Resource resource = new ClassPathResource("version.properties");
@@ -94,7 +107,6 @@ public class InitialSetup {
         }
         GeneralUtils.saveKeyToSettings("AutomaticallyGenerated.appVersion", appVersion);
         applicationProperties.getAutomaticallyGenerated().setAppVersion(appVersion);
-        applicationProperties.getAutomaticallyGenerated().setIsNewServer(isNewServer);
     }
 
     public static boolean isNewServer() {

app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java

@@ -62,15 +62,10 @@ public class OpenApiConfig {
 
         // Add server configuration from environment variable
         String swaggerServerUrl = System.getenv("SWAGGER_SERVER_URL");
-        Server server;
         if (swaggerServerUrl != null && !swaggerServerUrl.trim().isEmpty()) {
-            server = new Server().url(swaggerServerUrl).description("API Server");
-        } else {
-            // Use relative path so Swagger uses the current browser origin to avoid CORS issues
-            // when accessing via different ports
-            server = new Server().url("/").description("Current Server");
+            Server server = new Server().url(swaggerServerUrl).description("API Server");
+            openAPI.addServersItem(server);
         }
-        openAPI.addServersItem(server);
 
         // Add ErrorResponse schema to components
         Schema<?> errorResponseSchema =

app/core/src/main/java/stirling/software/SPDF/config/SpringDocConfig.java

@@ -21,9 +21,6 @@ public class SpringDocConfig {
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
                         "/api/v1/team/**",
-                        "/api/v1/auth/**",
-                        "/api/v1/invite/**",
-                        "/api/v1/audit/**",
                         "/api/v1/ui-data/**",
                         "/api/v1/proprietary/ui-data/**",
                         "/api/v1/info/**",
@@ -36,7 +33,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - Processing API")
                                             .description(
-                                                    "APIs for converting, editing, securing, and analysing PDF documents. Use these endpoints to automate common PDF tasks (like split, merge, convert, OCR) and plug them into your own apps and backend jobs."));
+                                                    "API documentation for PDF processing operations including conversion, manipulation, security, and utilities."));
                         })
                 .build();
     }
@@ -50,17 +47,14 @@ public class SpringDocConfig {
                         "/api/v1/admin/**",
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
-                        "/api/v1/team/**",
-                        "/api/v1/auth/**",
-                        "/api/v1/invite/**",
-                        "/api/v1/audit/**")
+                        "/api/v1/team/**")
                 .addOpenApiCustomizer(
                         openApi -> {
                             openApi.info(
                                     openApi.getInfo()
-                                            .title("Stirling PDF - Management API")
+                                            .title("Stirling PDF - Admin API")
                                             .description(
-                                                    "Endpoints for authentication, user management, invitations, audit logging, and system configuration."));
+                                                    "API documentation for administrative functions, user management, and system configuration."));
                         })
                 .build();
     }
@@ -82,7 +76,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - System API")
                                             .description(
-                                                    "System information, UI metadata, job status, and file management endpoints."));
+                                                    "API documentation for system information, UI data, and utility endpoints."));
                         })
                 .build();
     }

app/core/src/main/java/stirling/software/SPDF/config/WAUTrackingFilter.java

@@ -1,49 +0,0 @@
-package stirling.software.SPDF.config;
-
-import java.io.IOException;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.stereotype.Component;
-
-import jakarta.servlet.Filter;
-import jakarta.servlet.FilterChain;
-import jakarta.servlet.ServletException;
-import jakarta.servlet.ServletRequest;
-import jakarta.servlet.ServletResponse;
-import jakarta.servlet.http.HttpServletRequest;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.service.WeeklyActiveUsersService;
-
-/**
- * Filter to track browser IDs for Weekly Active Users (WAU) counting. Only active when security is
- * disabled (no-login mode).
- */
-@Component
-@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
-@RequiredArgsConstructor
-@Slf4j
-public class WAUTrackingFilter implements Filter {
-
-    private final WeeklyActiveUsersService wauService;
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
-            throws IOException, ServletException {
-
-        if (request instanceof HttpServletRequest httpRequest) {
-            // Extract browser ID from header
-            String browserId = httpRequest.getHeader("X-Browser-Id");
-
-            if (browserId != null && !browserId.trim().isEmpty()) {
-                // Record browser access
-                wauService.recordBrowserAccess(browserId);
-            }
-        }
-
-        // Continue the filter chain
-        chain.doFilter(request, response);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -1,14 +1,10 @@
 package stirling.software.SPDF.config;
 
-import java.util.concurrent.TimeUnit;
-
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.http.CacheControl;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import lombok.RequiredArgsConstructor;
@@ -29,20 +25,6 @@ public class WebMvcConfig implements WebMvcConfigurer {
         registry.addInterceptor(endpointInterceptor);
     }
 
-    @Override
-    public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        // Cache hashed assets (JS/CSS with content hashes) for 1 year
-        // These files have names like index-ChAS4tCC.js that change when content changes
-        registry.addResourceHandler("/assets/**")
-                .addResourceLocations("classpath:/static/assets/")
-                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS).cachePublic());
-
-        // Don't cache index.html - it needs to be fresh to reference latest hashed assets
-        registry.addResourceHandler("/index.html")
-                .addResourceLocations("classpath:/static/")
-                .setCacheControl(CacheControl.noCache().mustRevalidate());
-    }
-
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         // Check if running in Tauri mode
@@ -60,28 +42,12 @@ public class WebMvcConfig implements WebMvcConfigurer {
             // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
             logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
             registry.addMapping("/**")
-                    .allowedOriginPatterns(
+                    .allowedOrigins(
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")
-                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
-                    .allowedHeaders(
-                            "Authorization",
-                            "Content-Type",
-                            "X-Requested-With",
-                            "Accept",
-                            "Origin",
-                            "X-API-KEY",
-                            "X-CSRF-TOKEN",
-                            "X-XSRF-TOKEN",
-                            "X-Browser-Id")
-                    .exposedHeaders(
-                            "WWW-Authenticate",
-                            "X-Total-Count",
-                            "X-Page-Number",
-                            "X-Page-Size",
-                            "Content-Disposition",
-                            "Content-Type")
+                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
+                    .allowedHeaders("*")
                     .allowCredentials(true)
                     .maxAge(3600);
         } else if (hasConfiguredOrigins) {
@@ -97,53 +63,13 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             .toArray(new String[0]);
 
             registry.addMapping("/**")
-                    .allowedOriginPatterns(allowedOrigins)
-                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
-                    .allowedHeaders(
-                            "Authorization",
-                            "Content-Type",
-                            "X-Requested-With",
-                            "Accept",
-                            "Origin",
-                            "X-API-KEY",
-                            "X-CSRF-TOKEN",
-                            "X-XSRF-TOKEN",
-                            "X-Browser-Id")
-                    .exposedHeaders(
-                            "WWW-Authenticate",
-                            "X-Total-Count",
-                            "X-Page-Number",
-                            "X-Page-Size",
-                            "Content-Disposition",
-                            "Content-Type")
-                    .allowCredentials(true)
-                    .maxAge(3600);
-        } else {
-            // Default to allowing all origins when nothing is configured
-            logger.info(
-                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
-            registry.addMapping("/**")
-                    .allowedOriginPatterns("*")
-                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
-                    .allowedHeaders(
-                            "Authorization",
-                            "Content-Type",
-                            "X-Requested-With",
-                            "Accept",
-                            "Origin",
-                            "X-API-KEY",
-                            "X-CSRF-TOKEN",
-                            "X-XSRF-TOKEN",
-                            "X-Browser-Id")
-                    .exposedHeaders(
-                            "WWW-Authenticate",
-                            "X-Total-Count",
-                            "X-Page-Number",
-                            "X-Page-Size",
-                            "Content-Disposition",
-                            "Content-Type")
+                    .allowedOrigins(allowedOrigins)
+                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
+                    .allowedHeaders("*")
                     .allowCredentials(true)
                     .maxAge(3600);
         }
+        // If no origins are configured and not in Tauri mode, CORS is not enabled (secure by
+        // default)
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -29,6 +29,7 @@ import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.swagger.JsonDataResponse;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.EditTableOfContentsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -48,12 +49,13 @@ public class EditTableOfContentsController {
     @AutoJobPostMapping(
             value = "/extract-bookmarks",
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @JsonDataResponse
     @Operation(
             summary = "Extract PDF Bookmarks",
             description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
     @ResponseBody
-    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
-            @RequestParam("file") MultipartFile file) throws Exception {
+    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
+            throws Exception {
         PDDocument document = null;
         try {
             document = pdfDocumentFactory.load(file);
@@ -61,10 +63,10 @@ public class EditTableOfContentsController {
 
             if (outline == null) {
                 log.info("No outline/bookmarks found in PDF");
-                return ResponseEntity.ok(new ArrayList<>());
+                return new ArrayList<>();
             }
 
-            return ResponseEntity.ok(extractBookmarkItems(document, outline));
+            return extractBookmarkItems(document, outline);
         } finally {
             if (document != null) {
                 document.close();

app/core/src/main/java/stirling/software/SPDF/controller/api/SettingsController.java

@@ -124,6 +124,7 @@ public class SettingsController {
         ApplicationProperties.Security security = applicationProperties.getSecurity();
 
         settings.put("enableLogin", security.getEnableLogin());
+        settings.put("csrfDisabled", security.getCsrfDisabled());
         settings.put("loginMethod", security.getLoginMethod());
         settings.put("loginAttemptCount", security.getLoginAttemptCount());
         settings.put("loginResetTimeMinutes", security.getLoginResetTimeMinutes());
@@ -158,6 +159,12 @@ public class SettingsController {
                     .getSecurity()
                     .setEnableLogin((Boolean) settings.get("enableLogin"));
         }
+        if (settings.containsKey("csrfDisabled")) {
+            GeneralUtils.saveKeyToSettings("security.csrfDisabled", settings.get("csrfDisabled"));
+            applicationProperties
+                    .getSecurity()
+                    .setCsrfDisabled((Boolean) settings.get("csrfDisabled"));
+        }
         if (settings.containsKey("loginMethod")) {
             GeneralUtils.saveKeyToSettings("security.loginMethod", settings.get("loginMethod"));
             applicationProperties

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -26,7 +26,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.Dependency;
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.SPDF.service.SignatureService;
 import stirling.software.common.annotations.api.UiDataApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
@@ -40,14 +40,14 @@ import stirling.software.common.util.GeneralUtils;
 public class UIDataController {
 
     private final ApplicationProperties applicationProperties;
-    private final SharedSignatureService signatureService;
+    private final SignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
-            SharedSignatureService signatureService,
+            SignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {
@@ -58,21 +58,6 @@ public class UIDataController {
         this.runtimePathConfig = runtimePathConfig;
     }
 
-    @GetMapping("/footer-info")
-    @Operation(summary = "Get public footer configuration data")
-    public ResponseEntity<FooterData> getFooterData() {
-        FooterData data = new FooterData();
-        data.setAnalyticsEnabled(applicationProperties.getSystem().getEnableAnalytics());
-        data.setTermsAndConditions(applicationProperties.getLegal().getTermsAndConditions());
-        data.setPrivacyPolicy(applicationProperties.getLegal().getPrivacyPolicy());
-        data.setAccessibilityStatement(
-                applicationProperties.getLegal().getAccessibilityStatement());
-        data.setCookiePolicy(applicationProperties.getLegal().getCookiePolicy());
-        data.setImpressum(applicationProperties.getLegal().getImpressum());
-
-        return ResponseEntity.ok(data);
-    }
-
     @GetMapping("/home")
     @Operation(summary = "Get home page data")
     public ResponseEntity<HomeData> getHomeData() {
@@ -252,16 +237,6 @@ public class UIDataController {
     }
 
     // Data classes
-    @Data
-    public static class FooterData {
-        private Boolean analyticsEnabled;
-        private String termsAndConditions;
-        private String privacyPolicy;
-        private String accessibilityStatement;
-        private String cookiePolicy;
-        private String impressum;
-    }
-
     @Data
     public static class HomeData {
         private boolean showSurveyFromDocker;

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -1,225 +0,0 @@
-package stirling.software.SPDF.controller.api.converters;
-
-import java.util.Optional;
-import java.util.UUID;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.multipart.MultipartFile;
-
-import io.github.pixee.security.Filenames;
-import io.swagger.v3.oas.annotations.Operation;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.config.swagger.StandardPdfResponse;
-import stirling.software.SPDF.model.json.PdfJsonDocument;
-import stirling.software.SPDF.model.json.PdfJsonMetadata;
-import stirling.software.SPDF.service.PdfJsonConversionService;
-import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.annotations.api.ConvertApi;
-import stirling.software.common.model.api.GeneralFile;
-import stirling.software.common.model.api.PDFFile;
-import stirling.software.common.service.JobOwnershipService;
-import stirling.software.common.util.ExceptionUtils;
-import stirling.software.common.util.WebResponseUtils;
-
-@Slf4j
-@ConvertApi
-@RequiredArgsConstructor
-public class ConvertPdfJsonController {
-
-    private final PdfJsonConversionService pdfJsonConversionService;
-
-    @Autowired(required = false)
-    private JobOwnershipService jobOwnershipService;
-
-    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor")
-    @Operation(
-            summary = "Convert PDF to Text Editor Format",
-            description =
-                    "Extracts PDF text, fonts, and metadata into an editable JSON structure for the text editor tool. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<byte[]> convertPdfToJson(
-            @ModelAttribute PDFFile request,
-            @RequestParam(value = "lightweight", defaultValue = "false") boolean lightweight)
-            throws Exception {
-        MultipartFile inputFile = request.getFileInput();
-        if (inputFile == null) {
-            throw ExceptionUtils.createNullArgumentException("fileInput");
-        }
-
-        byte[] jsonBytes = pdfJsonConversionService.convertPdfToJson(inputFile, lightweight);
-        String originalName = inputFile.getOriginalFilename();
-        String baseName =
-                (originalName != null && !originalName.isBlank())
-                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
-                        : "document";
-        String docName = baseName + ".json";
-        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
-    }
-
-    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/text-editor/pdf")
-    @StandardPdfResponse
-    @Operation(
-            summary = "Convert Text Editor Format to PDF",
-            description =
-                    "Rebuilds a PDF from the editable JSON structure generated by the text editor tool. Input:JSON Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> convertJsonToPdf(@ModelAttribute GeneralFile request)
-            throws Exception {
-        MultipartFile jsonFile = request.getFileInput();
-        if (jsonFile == null) {
-            throw ExceptionUtils.createNullArgumentException("fileInput");
-        }
-
-        byte[] pdfBytes = pdfJsonConversionService.convertJsonToPdf(jsonFile);
-        String originalName = jsonFile.getOriginalFilename();
-        String baseName =
-                (originalName != null && !originalName.isBlank())
-                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
-                        : "document";
-        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
-    }
-
-    @PostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor/metadata")
-    @Operation(
-            summary = "Extract PDF metadata for text editor lazy loading",
-            description =
-                    "Extracts document metadata, fonts, and page dimensions for the text editor tool. Caches the document for"
-                            + " subsequent page requests. Returns a server-generated jobId scoped to the"
-                            + " authenticated user. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<byte[]> extractPdfMetadata(@ModelAttribute PDFFile request)
-            throws Exception {
-        MultipartFile inputFile = request.getFileInput();
-        if (inputFile == null) {
-            throw ExceptionUtils.createNullArgumentException("fileInput");
-        }
-
-        // Generate server-side UUID for job
-        String baseJobId = UUID.randomUUID().toString();
-
-        // Scope job to authenticated user if security is enabled
-        String scopedJobKey = getScopedJobKey(baseJobId);
-
-        log.info("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);
-
-        byte[] jsonBytes =
-                pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey);
-        String originalName = inputFile.getOriginalFilename();
-        String baseName =
-                (originalName != null && !originalName.isBlank())
-                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
-                        : "document";
-        String docName = baseName + "_metadata.json";
-
-        // Return jobId in response header for client
-        return ResponseEntity.ok()
-                .header("X-Job-Id", scopedJobKey)
-                .contentType(MediaType.APPLICATION_JSON)
-                .body(jsonBytes);
-    }
-
-    @PostMapping(
-            value = "/pdf/text-editor/partial/{jobId}",
-            consumes = MediaType.APPLICATION_JSON_VALUE)
-    @StandardPdfResponse
-    @Operation(
-            summary = "Apply incremental edits from text editor to a cached PDF",
-            description =
-                    "Applies edits for the specified pages of a cached PDF and returns an updated PDF."
-                            + " Requires the PDF to have been previously cached via the text editor metadata endpoint."
-                            + " The jobId must be obtained from the metadata extraction endpoint.")
-    public ResponseEntity<byte[]> exportPartialPdf(
-            @PathVariable String jobId,
-            @RequestBody PdfJsonDocument document,
-            @RequestParam(value = "filename", required = false) String filename)
-            throws Exception {
-        if (document == null) {
-            throw ExceptionUtils.createNullArgumentException("document");
-        }
-
-        // Validate job ownership
-        validateJobAccess(jobId);
-
-        byte[] pdfBytes = pdfJsonConversionService.exportUpdatedPages(jobId, document);
-
-        String baseName =
-                (filename != null && !filename.isBlank())
-                        ? Filenames.toSimpleFileName(filename).replaceFirst("[.][^.]+$", "")
-                        : Optional.ofNullable(document.getMetadata())
-                                .map(PdfJsonMetadata::getTitle)
-                                .filter(title -> title != null && !title.isBlank())
-                                .orElse("document");
-        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
-    }
-
-    @GetMapping(value = "/pdf/text-editor/page/{jobId}/{pageNumber}")
-    @Operation(
-            summary = "Extract single page from cached PDF for text editor",
-            description =
-                    "Retrieves a single page's content from a previously cached PDF document for the text editor tool."
-                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
-                            + " authenticated user. Output:JSON")
-    public ResponseEntity<byte[]> extractSinglePage(
-            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {
-
-        // Validate job ownership
-        validateJobAccess(jobId);
-
-        byte[] jsonBytes = pdfJsonConversionService.extractSinglePage(jobId, pageNumber);
-        String docName = "page_" + pageNumber + ".json";
-        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
-    }
-
-    @PostMapping(value = "/pdf/text-editor/clear-cache/{jobId}")
-    @Operation(
-            summary = "Clear cached PDF document for text editor",
-            description =
-                    "Manually clears a cached PDF document used by the text editor to free up server resources."
-                            + " Called automatically after 30 minutes. The jobId must belong to the"
-                            + " authenticated user.")
-    public ResponseEntity<Void> clearCache(@PathVariable String jobId) {
-
-        // Validate job ownership
-        validateJobAccess(jobId);
-
-        pdfJsonConversionService.clearCachedDocument(jobId);
-        return ResponseEntity.ok().build();
-    }
-
-    /**
-     * Get a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param baseJobId the base job identifier
-     * @return scoped job key, or just baseJobId if no ownership service available
-     */
-    private String getScopedJobKey(String baseJobId) {
-        if (jobOwnershipService != null) {
-            return jobOwnershipService.createScopedJobKey(baseJobId);
-        }
-        // Security disabled, return unsecured job key
-        return baseJobId;
-    }
-
-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param jobId the job identifier to validate
-     * @throws SecurityException if current user does not own the job
-     */
-    private void validateJobAccess(String jobId) {
-        if (jobOwnershipService != null) {
-            jobOwnershipService.validateJobAccess(jobId);
-        }
-        // If jobOwnershipService is null (security disabled), allow all access
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -1,60 +0,0 @@
-package stirling.software.SPDF.controller.api.converters;
-
-import java.nio.charset.StandardCharsets;
-
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ControllerAdvice;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.exception.CacheUnavailableException;
-
-@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
-@Slf4j
-@RequiredArgsConstructor
-public class ConvertPdfJsonExceptionHandler {
-
-    private final ObjectMapper objectMapper;
-
-    @ExceptionHandler(CacheUnavailableException.class)
-    @ResponseBody
-    public ResponseEntity<byte[]> handleCacheUnavailable(CacheUnavailableException ex) {
-        try {
-            byte[] body =
-                    objectMapper.writeValueAsBytes(
-                            java.util.Map.of(
-                                    "error", "cache_unavailable",
-                                    "action", "reupload",
-                                    "message", ex.getMessage()));
-            return ResponseEntity.status(HttpStatus.GONE)
-                    .contentType(MediaType.APPLICATION_JSON)
-                    .body(body);
-        } catch (Exception e) {
-            log.warn("Failed to serialize cache_unavailable response", e);
-            var fallbackBody =
-                    java.util.Map.of(
-                            "error", "cache_unavailable",
-                            "action", "reupload",
-                            "message", String.valueOf(ex.getMessage()));
-            try {
-                return ResponseEntity.status(HttpStatus.GONE)
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .body(objectMapper.writeValueAsBytes(fallbackBody));
-            } catch (Exception ignored) {
-                // Truly last-ditch fallback
-                return ResponseEntity.status(HttpStatus.GONE)
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .body(
-                                "{\"error\":\"cache_unavailable\",\"action\":\"reupload\",\"message\":\"Cache unavailable\"}"
-                                        .getBytes(StandardCharsets.UTF_8));
-            }
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/CompressController.java

@@ -28,13 +28,10 @@ import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.graphics.PDXObject;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.server.ResponseStatusException;
 
 import io.swagger.v3.oas.annotations.Operation;
 
@@ -47,7 +44,6 @@ import stirling.software.SPDF.model.api.misc.OptimizePdfRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.MiscApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.service.LineArtConversionService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
@@ -62,9 +58,6 @@ public class CompressController {
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final EndpointConfiguration endpointConfiguration;
 
-    @Autowired(required = false)
-    private LineArtConversionService lineArtConversionService;
-
     private boolean isQpdfEnabled() {
         return endpointConfiguration.isGroupEnabled("qpdf");
     }
@@ -73,10 +66,6 @@ public class CompressController {
         return endpointConfiguration.isGroupEnabled("Ghostscript");
     }
 
-    private boolean isImageMagickEnabled() {
-        return endpointConfiguration.isGroupEnabled("ImageMagick");
-    }
-
     @Data
     @AllArgsConstructor
     @NoArgsConstructor
@@ -671,9 +660,6 @@ public class CompressController {
         Integer optimizeLevel = request.getOptimizeLevel();
         String expectedOutputSizeString = request.getExpectedOutputSize();
         Boolean convertToGrayscale = request.getGrayscale();
-        Boolean convertToLineArt = request.getLineArt();
-        Double lineArtThreshold = request.getLineArtThreshold();
-        Integer lineArtEdgeLevel = request.getLineArtEdgeLevel();
         if (expectedOutputSizeString == null && optimizeLevel == null) {
             throw new Exception("Both expected output size and optimize level are not specified");
         }
@@ -703,26 +689,6 @@ public class CompressController {
                 optimizeLevel = determineOptimizeLevel(sizeReductionRatio);
             }
 
-            if (Boolean.TRUE.equals(convertToLineArt)) {
-                if (lineArtConversionService == null) {
-                    throw new ResponseStatusException(
-                            HttpStatus.FORBIDDEN,
-                            "Line art conversion is unavailable - ImageMagick service not found");
-                }
-                if (!isImageMagickEnabled()) {
-                    throw new IOException(
-                            "ImageMagick is not enabled but line art conversion was requested");
-                }
-                double thresholdValue =
-                        lineArtThreshold == null
-                                ? 55d
-                                : Math.min(100d, Math.max(0d, lineArtThreshold));
-                int edgeLevel =
-                        lineArtEdgeLevel == null ? 1 : Math.min(3, Math.max(1, lineArtEdgeLevel));
-                currentFile =
-                        applyLineArtConversion(currentFile, tempFiles, thresholdValue, edgeLevel);
-            }
-
             boolean sizeMet = false;
             boolean imageCompressionApplied = false;
             boolean externalCompressionApplied = false;
@@ -844,75 +810,6 @@ public class CompressController {
         }
     }
 
-    private Path applyLineArtConversion(
-            Path currentFile, List<Path> tempFiles, double threshold, int edgeLevel)
-            throws IOException {
-
-        Path lineArtFile = Files.createTempFile("lineart_output_", ".pdf");
-        tempFiles.add(lineArtFile);
-
-        try (PDDocument doc = pdfDocumentFactory.load(currentFile.toFile())) {
-            Map<String, List<ImageReference>> uniqueImages = findImages(doc);
-            CompressionStats stats = new CompressionStats();
-            stats.uniqueImagesCount = uniqueImages.size();
-            calculateImageStats(uniqueImages, stats);
-
-            Map<String, PDImageXObject> convertedImages =
-                    createLineArtImages(doc, uniqueImages, stats, threshold, edgeLevel);
-
-            replaceImages(doc, uniqueImages, convertedImages, stats);
-
-            log.info(
-                    "Applied line art conversion to {} unique images ({} total references)",
-                    stats.uniqueImagesCount,
-                    stats.totalImages);
-
-            doc.save(lineArtFile.toString());
-            return lineArtFile;
-        }
-    }
-
-    private Map<String, PDImageXObject> createLineArtImages(
-            PDDocument doc,
-            Map<String, List<ImageReference>> uniqueImages,
-            CompressionStats stats,
-            double threshold,
-            int edgeLevel)
-            throws IOException {
-
-        Map<String, PDImageXObject> convertedImages = new HashMap<>();
-
-        for (Entry<String, List<ImageReference>> entry : uniqueImages.entrySet()) {
-            String imageHash = entry.getKey();
-            List<ImageReference> references = entry.getValue();
-            if (references.isEmpty()) continue;
-
-            PDImageXObject originalImage = getOriginalImage(doc, references.get(0));
-
-            int originalSize = (int) originalImage.getCOSObject().getLength();
-            stats.totalOriginalBytes += originalSize;
-
-            PDImageXObject converted =
-                    lineArtConversionService.convertImageToLineArt(
-                            doc, originalImage, threshold, edgeLevel);
-            convertedImages.put(imageHash, converted);
-            stats.compressedImages++;
-
-            int convertedSize = (int) converted.getCOSObject().getLength();
-            stats.totalCompressedBytes += convertedSize * references.size();
-
-            double reductionPercentage = 100.0 - ((convertedSize * 100.0) / originalSize);
-            log.info(
-                    "Image hash {}: Line art conversion {} → {} (reduced by {}%)",
-                    imageHash,
-                    GeneralUtils.formatBytes(originalSize),
-                    GeneralUtils.formatBytes(convertedSize),
-                    String.format("%.1f", reductionPercentage));
-        }
-
-        return convertedImages;
-    }
-
     // Run Ghostscript compression
     private void applyGhostscriptCompression(
             OptimizePdfRequest request, int optimizeLevel, Path currentFile, List<Path> tempFiles)

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -1,7 +1,6 @@
 package stirling.software.SPDF.controller.api.misc;
 
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 
 import org.springframework.context.ApplicationContext;
@@ -11,13 +10,9 @@ import org.springframework.web.bind.annotation.RequestParam;
 
 import io.swagger.v3.oas.annotations.Hidden;
 
-import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.Size;
-
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointConfiguration;
-import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
 import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
@@ -35,7 +30,6 @@ public class ConfigController {
     private final EndpointConfiguration endpointConfiguration;
     private final ServerCertificateServiceInterface serverCertificateService;
     private final UserServiceInterface userService;
-    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;
 
     public ConfigController(
             ApplicationProperties applicationProperties,
@@ -44,14 +38,12 @@ public class ConfigController {
             @org.springframework.beans.factory.annotation.Autowired(required = false)
                     ServerCertificateServiceInterface serverCertificateService,
             @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    UserServiceInterface userService,
-            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
+                    UserServiceInterface userService) {
         this.applicationProperties = applicationProperties;
         this.applicationContext = applicationContext;
         this.endpointConfiguration = endpointConfiguration;
         this.serverCertificateService = serverCertificateService;
         this.userService = userService;
-        this.externalAppDepConfig = externalAppDepConfig;
     }
 
     @GetMapping("/app-config")
@@ -59,9 +51,6 @@ public class ConfigController {
         Map<String, Object> configData = new HashMap<>();
 
         try {
-            // Add dependency check status
-            configData.put("dependenciesReady", externalAppDepConfig.isDependenciesChecked());
-
             // Get AppConfig bean
             AppConfig appConfig = applicationContext.getBean(AppConfig.class);
 
@@ -74,7 +63,6 @@ public class ConfigController {
             configData.put("appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
             configData.put("languages", applicationProperties.getUi().getLanguages());
             configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
-            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());
 
             // Security settings
             // enableLogin requires both the config flag AND proprietary features to be loaded
@@ -124,9 +112,6 @@ public class ConfigController {
                     "enableAnalytics", applicationProperties.getSystem().getEnableAnalytics());
             configData.put("enablePosthog", applicationProperties.getSystem().getEnablePosthog());
             configData.put("enableScarf", applicationProperties.getSystem().getEnableScarf());
-            configData.put(
-                    "enableDesktopInstallSlide",
-                    applicationProperties.getSystem().getEnableDesktopInstallSlide());
 
             // Premium/Enterprise settings
             configData.put("premiumEnabled", applicationProperties.getPremium().isEnabled());
@@ -169,25 +154,6 @@ public class ConfigController {
                 // EE features not available, continue without them
             }
 
-            // Add version and machine info for update checking
-            try {
-                if (applicationContext.containsBean("appVersion")) {
-                    configData.put(
-                            "appVersion", applicationContext.getBean("appVersion", String.class));
-                }
-                if (applicationContext.containsBean("machineType")) {
-                    configData.put(
-                            "machineType", applicationContext.getBean("machineType", String.class));
-                }
-                if (applicationContext.containsBean("activeSecurity")) {
-                    configData.put(
-                            "activeSecurity",
-                            applicationContext.getBean("activeSecurity", Boolean.class));
-                }
-            } catch (Exception e) {
-                // Version/machine info not available
-            }
-
             return ResponseEntity.ok(configData);
 
         } catch (Exception e) {
@@ -215,25 +181,4 @@ public class ConfigController {
         }
         return ResponseEntity.ok(result);
     }
-
-    @GetMapping("/endpoints-availability")
-    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
-            @RequestParam(name = "endpoints")
-                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
-                    List<@NotBlank String> endpoints) {
-        Map<String, EndpointAvailability> result = new HashMap<>();
-        for (String endpoint : endpoints) {
-            String trimmedEndpoint = endpoint.trim();
-            result.put(
-                    trimmedEndpoint,
-                    endpointConfiguration.getEndpointAvailability(trimmedEndpoint));
-        }
-        return ResponseEntity.ok(result);
-    }
-
-    @GetMapping("/group-enabled")
-    public ResponseEntity<Boolean> isGroupEnabled(@RequestParam(name = "group") String group) {
-        boolean enabled = endpointConfiguration.isGroupEnabled(group);
-        return ResponseEntity.ok(enabled);
-    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java

@@ -196,9 +196,9 @@ public class StampController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
-                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
-                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
+                    case "japanese" -> "static/fonts/Meiryo.ttf";
+                    case "korean" -> "static/fonts/malgun.ttf";
+                    case "chinese" -> "static/fonts/SimSun.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     case "roman" -> "static/fonts/NotoSans-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";

app/core/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java

@@ -191,12 +191,6 @@ public class CertSignController {
 
         switch (certType) {
             case "PEM":
-                privateKeyFile =
-                        validateFilePresent(
-                                privateKeyFile, "PEM private key", "private key file is required");
-                certFile =
-                        validateFilePresent(
-                                certFile, "PEM certificate", "certificate file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(null);
                 PrivateKey privateKey = getPrivateKeyFromPEM(privateKeyFile.getBytes(), password);
@@ -206,16 +200,10 @@ public class CertSignController {
                 break;
             case "PKCS12":
             case "PFX":
-                p12File =
-                        validateFilePresent(
-                                p12File, "PKCS12 keystore", "PKCS12/PFX keystore file is required");
                 ks = KeyStore.getInstance("PKCS12");
                 ks.load(p12File.getInputStream(), password.toCharArray());
                 break;
             case "JKS":
-                jksfile =
-                        validateFilePresent(
-                                jksfile, "JKS keystore", "JKS keystore file is required");
                 ks = KeyStore.getInstance("JKS");
                 ks.load(jksfile.getInputStream(), password.toCharArray());
                 break;
@@ -263,17 +251,6 @@ public class CertSignController {
                 GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_signed.pdf"));
     }
 
-    private MultipartFile validateFilePresent(
-            MultipartFile file, String argumentName, String errorDescription) {
-        if (file == null || file.isEmpty()) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.invalidArgument",
-                    "Invalid argument: {0}",
-                    argumentName + " - " + errorDescription);
-        }
-        return file;
-    }
-
     private PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
             throws IOException, OperatorCreationException, PKCSException {
         try (PEMParser pemParser =

app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java

@@ -171,9 +171,9 @@ public class WatermarkController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
-                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
-                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
+                    case "japanese" -> "static/fonts/Meiryo.ttf";
+                    case "korean" -> "static/fonts/malgun.ttf";
+                    case "chinese" -> "static/fonts/SimSun.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";
                 };

app/core/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java

@@ -25,7 +25,7 @@ import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.SPDF.service.SignatureService;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.UserServiceInterface;
@@ -37,13 +37,13 @@ import stirling.software.common.util.GeneralUtils;
 @Slf4j
 public class GeneralWebController {
 
-    private final SharedSignatureService signatureService;
+    private final SignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public GeneralWebController(
-            SharedSignatureService signatureService,
+            SignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java

@@ -23,7 +23,6 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointInspector;
 import stirling.software.SPDF.config.StartupApplicationListener;
-import stirling.software.SPDF.service.WeeklyActiveUsersService;
 import stirling.software.common.annotations.api.InfoApi;
 import stirling.software.common.model.ApplicationProperties;
 
@@ -35,7 +34,6 @@ public class MetricsController {
     private final ApplicationProperties applicationProperties;
     private final MeterRegistry meterRegistry;
     private final EndpointInspector endpointInspector;
-    private final Optional<WeeklyActiveUsersService> wauService;
     private boolean metricsEnabled;
 
     @PostConstruct
@@ -354,36 +352,6 @@ public class MetricsController {
         return ResponseEntity.ok(formatDuration(uptime));
     }
 
-    @GetMapping("/wau")
-    @Operation(
-            summary = "Weekly Active Users statistics",
-            description =
-                    "Returns WAU (Weekly Active Users) count and total unique browsers. "
-                            + "Only available when security is disabled (no-login mode). "
-                            + "Tracks unique browsers via client-generated UUID in localStorage.")
-    public ResponseEntity<?> getWeeklyActiveUsers() {
-        if (!metricsEnabled) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("This endpoint is disabled.");
-        }
-
-        // Check if WAU service is available (only when security.enableLogin=false)
-        if (wauService.isEmpty()) {
-            return ResponseEntity.status(HttpStatus.NOT_FOUND)
-                    .body(
-                            "WAU tracking is only available when security is disabled (no-login mode)");
-        }
-
-        WeeklyActiveUsersService service = wauService.get();
-
-        Map<String, Object> wauStats = new HashMap<>();
-        wauStats.put("weeklyActiveUsers", service.getWeeklyActiveUsers());
-        wauStats.put("totalUniqueBrowsers", service.getTotalUniqueBrowsers());
-        wauStats.put("daysOnline", service.getDaysOnline());
-        wauStats.put("trackingSince", service.getStartTime().toString());
-
-        return ResponseEntity.ok(wauStats);
-    }
-
     private String formatDuration(Duration duration) {
         long days = duration.toDays();
         long hours = duration.toHoursPart();

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,88 +1,17 @@
 package stirling.software.SPDF.controller.web;
 
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-import jakarta.annotation.PostConstruct;
-import jakarta.servlet.http.HttpServletRequest;
-
-@Controller
+// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
 public class ReactRoutingController {
 
-    @Value("${server.servlet.context-path:/}")
-    private String contextPath;
-
-    private String cachedIndexHtml;
-    private boolean indexHtmlExists = false;
-
-    @PostConstruct
-    public void init() {
-        // Only cache if index.html exists (production builds)
-        ClassPathResource resource = new ClassPathResource("static/index.html");
-        if (resource.exists()) {
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-            } catch (IOException e) {
-                // Failed to cache, will process on each request
-                this.indexHtmlExists = false;
-            }
-        }
+    @GetMapping("/{path:^(?!api|static|robots\\.txt|favicon\\.ico)[^\\.]*$}")
+    public String forwardRootPaths() {
+        return "forward:/index.html";
     }
 
-    private String processIndexHtml() throws IOException {
-        ClassPathResource resource = new ClassPathResource("static/index.html");
-
-        try (InputStream inputStream = resource.getInputStream()) {
-            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-
-            // Replace %BASE_URL% with the actual context path for base href
-            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-            html = html.replace("%BASE_URL%", baseUrl);
-            // Also rewrite any existing <base> tag (Vite may have baked one in)
-            html =
-                    html.replaceFirst(
-                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
-                            "<base href=\\\"" + baseUrl + "\\\" />");
-
-            // Inject context path as a global variable for API calls
-            String contextPathScript =
-                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
-            html = html.replace("</head>", contextPathScript + "</head>");
-
-            return html;
-        }
-    }
-
-    @GetMapping(
-            value = {"/", "/index.html"},
-            produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
-        if (indexHtmlExists && cachedIndexHtml != null) {
-            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
-        }
-        // Fallback: process on each request (dev mode or cache failed)
-        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
-    }
-
-    @GetMapping(
-            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
-    public ResponseEntity<String> forwardRootPaths(HttpServletRequest request) throws IOException {
-        return serveIndexHtml(request);
-    }
-
-    @GetMapping(
-            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|pdfium|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
-    public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
-            throws IOException {
-        return serveIndexHtml(request);
+    @GetMapping("/{path:^(?!api|static)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    public String forwardNestedPaths() {
+        return "forward:/index.html";
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java

@@ -0,0 +1,48 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import stirling.software.SPDF.service.SignatureService;
+import stirling.software.common.service.UserServiceInterface;
+
+// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
+@RequestMapping("/api/v1/general")
+public class SignatureController {
+
+    private final SignatureService signatureService;
+
+    private final UserServiceInterface userService;
+
+    public SignatureController(
+            SignatureService signatureService,
+            @Autowired(required = false) UserServiceInterface userService) {
+        this.signatureService = signatureService;
+        this.userService = userService;
+    }
+
+    @GetMapping("/sign/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
+            throws IOException {
+        String username = "NON_SECURITY_USER";
+        if (userService != null) {
+            username = userService.getCurrentUsername();
+        }
+        // Verify access permission
+        if (!signatureService.hasAccessToFile(username, fileName)) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
+        return ResponseEntity.ok()
+                .contentType( // Adjust based on file type
+                        MediaType.IMAGE_JPEG)
+                .body(imageBytes);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureImageController.java

@@ -1,84 +0,0 @@
-package stirling.software.SPDF.controller.web;
-
-import java.io.IOException;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.service.SharedSignatureService;
-import stirling.software.common.service.PersonalSignatureServiceInterface;
-import stirling.software.common.service.UserServiceInterface;
-
-/**
- * Unified signature image controller that works for both authenticated and unauthenticated users.
- * Uses composition pattern: - Core SharedSignatureService (always available): reads shared
- * signatures - PersonalSignatureService (proprietary, optional): reads personal signatures For
- * authenticated signature management (save/delete), see proprietary SignatureController.
- */
-@Slf4j
-@RestController
-@RequestMapping("/api/v1/general")
-public class SignatureImageController {
-
-    private final SharedSignatureService sharedSignatureService;
-    private final PersonalSignatureServiceInterface personalSignatureService;
-    private final UserServiceInterface userService;
-
-    public SignatureImageController(
-            SharedSignatureService sharedSignatureService,
-            @Autowired(required = false) PersonalSignatureServiceInterface personalSignatureService,
-            @Autowired(required = false) UserServiceInterface userService) {
-        this.sharedSignatureService = sharedSignatureService;
-        this.personalSignatureService = personalSignatureService;
-        this.userService = userService;
-    }
-
-    /**
-     * Get a signature image (works for both authenticated and unauthenticated users). -
-     * Authenticated with proprietary: tries personal first, then shared - Unauthenticated or
-     * community: tries shared only
-     */
-    @GetMapping("/signatures/{fileName}")
-    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName) {
-        try {
-            byte[] imageBytes = null;
-
-            // If proprietary service available and user authenticated, try personal folder first
-            if (personalSignatureService != null && userService != null) {
-                try {
-                    String username = userService.getCurrentUsername();
-                    imageBytes =
-                            personalSignatureService.getPersonalSignatureBytes(username, fileName);
-                } catch (Exception e) {
-                    // Not found in personal folder or not authenticated, will try shared
-                    log.debug("Personal signature not found, trying shared: {}", e.getMessage());
-                }
-            }
-
-            // If not found in personal (or no personal service), try shared
-            if (imageBytes == null) {
-                imageBytes = sharedSignatureService.getSharedSignatureBytes(fileName);
-            }
-
-            // Determine content type from file extension
-            MediaType contentType = MediaType.IMAGE_PNG; // Default
-            String lowerFileName = fileName.toLowerCase();
-            if (lowerFileName.endsWith(".jpg") || lowerFileName.endsWith(".jpeg")) {
-                contentType = MediaType.IMAGE_JPEG;
-            }
-
-            return ResponseEntity.ok().contentType(contentType).body(imageBytes);
-        } catch (IOException e) {
-            log.debug("Signature not found: {}", fileName);
-            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/exception/CacheUnavailableException.java

@@ -1,8 +0,0 @@
-package stirling.software.SPDF.exception;
-
-public class CacheUnavailableException extends RuntimeException {
-
-    public CacheUnavailableException(String message) {
-        super(message);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/model/api/PdfJsonConversionProgress.java

@@ -1,49 +0,0 @@
-package stirling.software.SPDF.model.api;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class PdfJsonConversionProgress {
-    private int percent;
-    private String stage;
-    private String message;
-    private boolean complete;
-    private Integer current; // Current item being processed (e.g., page number)
-    private Integer total; // Total items to process (e.g., total pages)
-
-    public static PdfJsonConversionProgress of(int percent, String stage, String message) {
-        return PdfJsonConversionProgress.builder()
-                .percent(percent)
-                .stage(stage)
-                .message(message)
-                .complete(false)
-                .build();
-    }
-
-    public static PdfJsonConversionProgress of(
-            int percent, String stage, String message, int current, int total) {
-        return PdfJsonConversionProgress.builder()
-                .percent(percent)
-                .stage(stage)
-                .message(message)
-                .current(current)
-                .total(total)
-                .complete(false)
-                .build();
-    }
-
-    public static PdfJsonConversionProgress complete() {
-        return PdfJsonConversionProgress.builder()
-                .percent(100)
-                .stage("complete")
-                .message("Conversion complete")
-                .complete(true)
-                .build();
-    }
-}

app/core/src/main/java/stirling/software/SPDF/model/api/misc/OptimizePdfRequest.java

@@ -45,26 +45,4 @@ public class OptimizePdfRequest extends PDFFile {
             requiredMode = Schema.RequiredMode.REQUIRED,
             defaultValue = "false")
     private Boolean grayscale = false;
-
-    @Schema(
-            description =
-                    "Whether to convert images to high-contrast line art using ImageMagick. Default is false.",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "false")
-    private Boolean lineArt = false;
-
-    @Schema(
-            description = "Threshold to use for line art conversion (0-100).",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "55")
-    private Double lineArtThreshold = 55d;
-
-    @Schema(
-            description =
-                    "Edge detection strength to use for line art conversion (1-3). This maps to"
-                            + " ImageMagick's -edge radius.",
-            requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-            defaultValue = "1",
-            allowableValues = {"1", "2", "3"})
-    private Integer lineArtEdgeLevel = 1;
 }

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureRequest.java

@@ -1,18 +0,0 @@
-package stirling.software.SPDF.model.api.signature;
-
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-public class SavedSignatureRequest {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureResponse.java

@@ -1,22 +0,0 @@
-package stirling.software.SPDF.model.api.signature;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SavedSignatureResponse {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types (or URL to fetch image)
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-    private Long createdAt;
-    private Long updatedAt;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonAnnotation.java

@@ -1,61 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/**
- * Represents a PDF annotation (comments, highlights, stamps, etc.). Annotations often contain OCR
- * text layers or other metadata not visible in content streams.
- */
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonAnnotation {
-
-    /** Annotation subtype (Text, Highlight, Link, Stamp, Widget, etc.) */
-    private String subtype;
-
-    /** Human-readable text content of the annotation */
-    private String contents;
-
-    /** Annotation rectangle [x1, y1, x2, y2] */
-    private List<Float> rect;
-
-    /** Annotation appearance characteristics */
-    private String appearanceState;
-
-    /** Color components (e.g., [r, g, b] for RGB) */
-    private List<Float> color;
-
-    /** Annotation flags (print, hidden, etc.) */
-    private Integer flags;
-
-    /** For link annotations: destination or action */
-    private String destination;
-
-    /** For text annotations: icon name */
-    private String iconName;
-
-    /** Subject/title of the annotation */
-    private String subject;
-
-    /** Author of the annotation */
-    private String author;
-
-    /** Creation date (ISO 8601 format) */
-    private String creationDate;
-
-    /** Modification date (ISO 8601 format) */
-    private String modificationDate;
-
-    /** Full annotation dictionary for lossless round-tripping */
-    private PdfJsonCosValue rawData;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonCosValue.java

@@ -1,49 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-import java.util.Map;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonCosValue {
-
-    public enum Type {
-        NULL,
-        BOOLEAN,
-        INTEGER,
-        FLOAT,
-        NAME,
-        STRING,
-        ARRAY,
-        DICTIONARY,
-        STREAM
-    }
-
-    private Type type;
-
-    /**
-     * Holds the decoded value for primitives (boolean, integer, float, name, string). For name
-     * values the stored value is the PDF name literal. For string values the content is Base64
-     * encoded to safely transport arbitrary binaries.
-     */
-    private Object value;
-
-    /** Reference to nested values for arrays. */
-    private List<PdfJsonCosValue> items;
-
-    /** Reference to nested values for dictionaries. */
-    private Map<String, PdfJsonCosValue> entries;
-
-    /** Stream payload when {@code type == STREAM}. */
-    private PdfJsonStream stream;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocument.java

@@ -1,34 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonDocument {
-
-    private PdfJsonMetadata metadata;
-
-    /** Optional XMP metadata packet stored as Base64. */
-    private String xmpMetadata;
-
-    /** Indicates that images should be loaded lazily via API rather than embedded in the JSON. */
-    private Boolean lazyImages;
-
-    @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
-
-    @Builder.Default private List<PdfJsonPage> pages = new ArrayList<>();
-
-    /** Form fields (AcroForm) at document level */
-    @Builder.Default private List<PdfJsonFormField> formFields = new ArrayList<>();
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocumentMetadata.java

@@ -1,34 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonDocumentMetadata {
-
-    private PdfJsonMetadata metadata;
-
-    /** Optional XMP metadata packet stored as Base64. */
-    private String xmpMetadata;
-
-    /** Indicates that images should be requested lazily via the page endpoint. */
-    private Boolean lazyImages;
-
-    @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
-
-    @Builder.Default private List<PdfJsonPageDimension> pageDimensions = new ArrayList<>();
-
-    /** Form fields (AcroForm) at document level */
-    @Builder.Default private List<PdfJsonFormField> formFields = new ArrayList<>();
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFont.java

@@ -1,96 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonFont {
-
-    /** PDF resource name (e.g. F1) used as the primary identifier. */
-    private String id;
-
-    /** Logical page number that owns this font resource. */
-    private Integer pageNumber;
-
-    /** Stable UID combining page number and resource for diagnostics. */
-    private String uid;
-
-    /** Reported PostScript/Base font name. */
-    private String baseName;
-
-    /** Declared subtype in the COS dictionary. */
-    private String subtype;
-
-    /** Encoding dictionary or name. */
-    private String encoding;
-
-    /** CID system info for Type0 fonts. */
-    private PdfJsonFontCidSystemInfo cidSystemInfo;
-
-    /** True when the original PDF embedded the font program. */
-    private Boolean embedded;
-
-    /** Font program bytes (TTF/OTF/CFF/PFB) encoded as Base64. */
-    private String program;
-
-    /** Hint describing the font program type (ttf, otf, cff, pfb, etc.). */
-    private String programFormat;
-
-    /** Web-optimized font program (e.g. converted TrueType) encoded as Base64. */
-    private String webProgram;
-
-    /** Format hint for the webProgram payload. */
-    private String webProgramFormat;
-
-    /** PDF-friendly font program (e.g. converted TrueType) encoded as Base64. */
-    private String pdfProgram;
-
-    /** Format hint for the pdfProgram payload. */
-    private String pdfProgramFormat;
-
-    /** Glyph metadata for Type3 fonts to enable precise text rewrites. */
-    private List<PdfJsonFontType3Glyph> type3Glyphs;
-
-    /** Per-strategy synthesized font payloads for Type3 normalization. */
-    private List<PdfJsonFontConversionCandidate> conversionCandidates;
-
-    /** ToUnicode stream encoded as Base64 when present. */
-    private String toUnicode;
-
-    /** Mapped Standard 14 font name when available. */
-    private String standard14Name;
-
-    /** Font descriptor flags copied from the source document. */
-    private Integer fontDescriptorFlags;
-
-    /** Font ascent in glyph units (typically 1/1000). */
-    private Float ascent;
-
-    /** Font descent in glyph units (typically negative). */
-    private Float descent;
-
-    /** Capital height when available. */
-    private Float capHeight;
-
-    /** x-height when available. */
-    private Float xHeight;
-
-    /** Italic angle reported by the font descriptor. */
-    private Float italicAngle;
-
-    /** Units per em extracted from the font matrix. */
-    private Integer unitsPerEm;
-
-    /** Serialized COS dictionary describing the original font resource. */
-    private PdfJsonCosValue cosDictionary;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontCidSystemInfo.java

@@ -1,20 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonFontCidSystemInfo {
-
-    private String registry;
-    private String ordering;
-    private Integer supplement;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionCandidate.java

@@ -1,69 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonFontConversionCandidate {
-
-    /** Stable identifier for the strategy that produced this candidate. */
-    private String strategyId;
-
-    /** Human-readable label for diagnostics and UI toggles. */
-    private String strategyLabel;
-
-    /** Outcome of the conversion attempt. */
-    private PdfJsonFontConversionStatus status;
-
-    /** Summary diagnostics or error details. */
-    private String message;
-
-    /** Count of glyphs successfully synthesized. */
-    private Integer synthesizedGlyphs;
-
-    /** Count of glyphs that could not be reproduced accurately. */
-    private Integer missingGlyphs;
-
-    /** Approximate width delta (in glyph units) across the test sample. */
-    private Double widthDelta;
-
-    /** Approximate bounding box delta (in glyph units). */
-    private Double bboxDelta;
-
-    /** Base64-encoded font program (typically TTF/OTF) produced by the strategy. */
-    private String program;
-
-    /** Format hint for {@link #program}. */
-    private String programFormat;
-
-    /** Web-optimized payload (e.g. TTF) for browser preview. */
-    private String webProgram;
-
-    /** Format for the web payload. */
-    private String webProgramFormat;
-
-    /** PDF-friendly payload for re-embedding during export. */
-    private String pdfProgram;
-
-    /** Format for the PDF payload. */
-    private String pdfProgramFormat;
-
-    /** Optional PNG preview of rendered glyphs (Base64). */
-    private String previewImage;
-
-    /** Additional structured diagnostics (JSON string). */
-    private String diagnostics;
-
-    /** Known unicode/codepoint coverage derived from the conversion strategy. */
-    private List<Integer> glyphCoverage;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionStatus.java

@@ -1,9 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-public enum PdfJsonFontConversionStatus {
-    SUCCESS,
-    WARNING,
-    FAILURE,
-    SKIPPED,
-    UNSUPPORTED
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontType3Glyph.java

@@ -1,27 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonFontType3Glyph {
-    /** Character code used in the content stream to reference this glyph. */
-    private Integer charCode;
-
-    /** PostScript glyph name, when available. */
-    private String glyphName;
-
-    /** Unicode code point represented by this glyph, if it can be resolved. */
-    private Integer unicode;
-
-    /** Raw char code used in the Type3 font encoding (0-255). */
-    private Integer charCodeRaw;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFormField.java

@@ -1,66 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/** Represents a PDF form field (AcroForm). */
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonFormField {
-
-    /** Fully qualified field name (e.g., "form1.textfield1") */
-    private String name;
-
-    /** Partial field name (last component) */
-    private String partialName;
-
-    /** Field type (Tx=text, Btn=button, Ch=choice, Sig=signature) */
-    private String fieldType;
-
-    /** Field value as string */
-    private String value;
-
-    /** Default value */
-    private String defaultValue;
-
-    /** Field flags (readonly, required, multiline, etc.) */
-    private Integer flags;
-
-    /** Alternative field name (for accessibility) */
-    private String alternateFieldName;
-
-    /** Mapping name (for export) */
-    private String mappingName;
-
-    /** Page number where field appears (1-indexed) */
-    private Integer pageNumber;
-
-    /** Field rectangle [x1, y1, x2, y2] on the page */
-    private List<Float> rect;
-
-    /** For choice fields: list of options */
-    private List<String> options;
-
-    /** For choice fields: selected indices */
-    private List<Integer> selectedIndices;
-
-    /** For button fields: whether it's checked */
-    private Boolean checked;
-
-    /** Font information for text fields */
-    private String fontName;
-
-    private Float fontSize;
-
-    /** Full field dictionary for lossless round-tripping */
-    private PdfJsonCosValue rawData;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonImageElement.java

@@ -1,37 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonImageElement {
-
-    private String id;
-    private String objectName;
-    private Boolean inlineImage;
-    private Integer nativeWidth;
-    private Integer nativeHeight;
-    private Float x;
-    private Float y;
-    private Float width;
-    private Float height;
-    private Float left;
-    private Float right;
-    private Float top;
-    private Float bottom;
-    @Builder.Default private List<Float> transform = new ArrayList<>();
-    private Integer zOrder;
-    private String imageData;
-    private String imageFormat;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonMetadata.java

@@ -1,27 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonMetadata {
-
-    private String title;
-    private String author;
-    private String subject;
-    private String keywords;
-    private String creator;
-    private String producer;
-    private String creationDate;
-    private String modificationDate;
-    private String trapped;
-    private Integer numberOfPages;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonPage.java

@@ -1,34 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonPage {
-
-    private Integer pageNumber;
-    private Float width;
-    private Float height;
-    private Integer rotation;
-
-    @Builder.Default private List<PdfJsonTextElement> textElements = new ArrayList<>();
-    @Builder.Default private List<PdfJsonImageElement> imageElements = new ArrayList<>();
-    @Builder.Default private List<PdfJsonAnnotation> annotations = new ArrayList<>();
-
-    /** Serialized representation of the page resources dictionary. */
-    private PdfJsonCosValue resources;
-
-    /** Raw content streams associated with the page, preserved for lossless round-tripping. */
-    @Builder.Default private List<PdfJsonStream> contentStreams = new ArrayList<>();
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonPageDimension.java

@@ -1,20 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonPageDimension {
-    private Integer pageNumber;
-    private Float width;
-    private Float height;
-    private Integer rotation;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonStream.java

@@ -1,27 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.Map;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonStream {
-
-    /**
-     * A dictionary of entries that describe the stream metadata (Filter, DecodeParms, etc). Each
-     * entry is represented using {@link PdfJsonCosValue} so nested structures are supported.
-     */
-    private Map<String, PdfJsonCosValue> dictionary;
-
-    /** Raw stream bytes in Base64 form. Data is stored exactly as it appeared in the source PDF. */
-    private String rawData;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonTextColor.java

@@ -1,21 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonTextColor {
-
-    private String colorSpace;
-    private List<Float> components;
-}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonTextElement.java

@@ -1,41 +0,0 @@
-package stirling.software.SPDF.model.json;
-
-import java.util.List;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class PdfJsonTextElement {
-
-    private String text;
-    private String fontId;
-    private Float fontSize;
-    private Float fontMatrixSize;
-    private Float fontSizeInPt;
-    private Float characterSpacing;
-    private Float wordSpacing;
-    private Float spaceWidth;
-    private Integer zOrder;
-    private Float horizontalScaling;
-    private Float leading;
-    private Float rise;
-    private Float x;
-    private Float y;
-    private Float width;
-    private Float height;
-    private List<Float> textMatrix;
-    private PdfJsonTextColor fillColor;
-    private PdfJsonTextColor strokeColor;
-    private Integer renderingMode;
-    private Boolean fallbackUsed;
-    private List<Integer> charCodes;
-}

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonCosMapper.java

@@ -1,274 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.Base64;
-import java.util.Collections;
-import java.util.IdentityHashMap;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import org.apache.pdfbox.cos.COSArray;
-import org.apache.pdfbox.cos.COSBase;
-import org.apache.pdfbox.cos.COSBoolean;
-import org.apache.pdfbox.cos.COSDictionary;
-import org.apache.pdfbox.cos.COSFloat;
-import org.apache.pdfbox.cos.COSInteger;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.cos.COSNull;
-import org.apache.pdfbox.cos.COSObject;
-import org.apache.pdfbox.cos.COSStream;
-import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.common.PDStream;
-import org.springframework.stereotype.Component;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.json.PdfJsonCosValue;
-import stirling.software.SPDF.model.json.PdfJsonStream;
-
-@Slf4j
-@Component
-public class PdfJsonCosMapper {
-
-    public PdfJsonStream serializeStream(PDStream stream) throws IOException {
-        if (stream == null) {
-            return null;
-        }
-        return serializeStream(
-                stream.getCOSObject(), Collections.newSetFromMap(new IdentityHashMap<>()));
-    }
-
-    public PdfJsonStream serializeStream(COSStream cosStream) throws IOException {
-        if (cosStream == null) {
-            return null;
-        }
-        return serializeStream(cosStream, Collections.newSetFromMap(new IdentityHashMap<>()));
-    }
-
-    public PdfJsonCosValue serializeCosValue(COSBase base) throws IOException {
-        return serializeCosValue(base, Collections.newSetFromMap(new IdentityHashMap<>()));
-    }
-
-    public COSBase deserializeCosValue(PdfJsonCosValue value, PDDocument document)
-            throws IOException {
-        if (value == null || value.getType() == null) {
-            return null;
-        }
-        switch (value.getType()) {
-            case NULL:
-                return COSNull.NULL;
-            case BOOLEAN:
-                if (value.getValue() instanceof Boolean bool) {
-                    return COSBoolean.getBoolean(bool);
-                }
-                return null;
-            case INTEGER:
-                if (value.getValue() instanceof Number number) {
-                    return COSInteger.get(number.longValue());
-                }
-                return null;
-            case FLOAT:
-                if (value.getValue() instanceof Number number) {
-                    return new COSFloat(number.floatValue());
-                }
-                return null;
-            case NAME:
-                if (value.getValue() instanceof String name) {
-                    return COSName.getPDFName(name);
-                }
-                return null;
-            case STRING:
-                if (value.getValue() instanceof String encoded) {
-                    try {
-                        byte[] bytes = Base64.getDecoder().decode(encoded);
-                        return new COSString(bytes);
-                    } catch (IllegalArgumentException ex) {
-                        log.debug("Failed to decode COSString value: {}", ex.getMessage());
-                    }
-                }
-                return null;
-            case ARRAY:
-                COSArray array = new COSArray();
-                if (value.getItems() != null) {
-                    for (PdfJsonCosValue item : value.getItems()) {
-                        COSBase entry = deserializeCosValue(item, document);
-                        if (entry != null) {
-                            array.add(entry);
-                        } else {
-                            array.add(COSNull.NULL);
-                        }
-                    }
-                }
-                return array;
-            case DICTIONARY:
-                COSDictionary dictionary = new COSDictionary();
-                if (value.getEntries() != null) {
-                    for (Map.Entry<String, PdfJsonCosValue> entry : value.getEntries().entrySet()) {
-                        COSName key = COSName.getPDFName(entry.getKey());
-                        COSBase entryValue = deserializeCosValue(entry.getValue(), document);
-                        if (entryValue != null) {
-                            dictionary.setItem(key, entryValue);
-                        }
-                    }
-                }
-                return dictionary;
-            case STREAM:
-                if (value.getStream() != null) {
-                    return buildStreamFromModel(value.getStream(), document);
-                }
-                return null;
-            default:
-                return null;
-        }
-    }
-
-    public COSStream buildStreamFromModel(PdfJsonStream streamModel, PDDocument document)
-            throws IOException {
-        if (streamModel == null) {
-            return null;
-        }
-        COSStream cosStream = document.getDocument().createCOSStream();
-        if (streamModel.getDictionary() != null) {
-            for (Map.Entry<String, PdfJsonCosValue> entry :
-                    streamModel.getDictionary().entrySet()) {
-                COSName key = COSName.getPDFName(entry.getKey());
-                COSBase value = deserializeCosValue(entry.getValue(), document);
-                if (value != null) {
-                    cosStream.setItem(key, value);
-                }
-            }
-        }
-
-        String rawData = streamModel.getRawData();
-        if (rawData != null && !rawData.isBlank()) {
-            byte[] data;
-            try {
-                data = Base64.getDecoder().decode(rawData);
-            } catch (IllegalArgumentException ex) {
-                log.debug("Invalid base64 content stream data: {}", ex.getMessage());
-                data = new byte[0];
-            }
-            try (OutputStream outputStream = cosStream.createRawOutputStream()) {
-                outputStream.write(data);
-            }
-            cosStream.setItem(COSName.LENGTH, COSInteger.get(data.length));
-        } else {
-            cosStream.setItem(COSName.LENGTH, COSInteger.get(0));
-        }
-        return cosStream;
-    }
-
-    private PdfJsonCosValue serializeCosValue(COSBase base, Set<COSBase> visited)
-            throws IOException {
-        if (base == null) {
-            return null;
-        }
-        if (base instanceof COSObject cosObject) {
-            base = cosObject.getObject();
-            if (base == null) {
-                return null;
-            }
-        }
-
-        boolean complex =
-                base instanceof COSDictionary
-                        || base instanceof COSArray
-                        || base instanceof COSStream;
-        if (complex) {
-            if (!visited.add(base)) {
-                return PdfJsonCosValue.builder()
-                        .type(PdfJsonCosValue.Type.NAME)
-                        .value("__circular__")
-                        .build();
-            }
-        }
-
-        try {
-            PdfJsonCosValue.PdfJsonCosValueBuilder builder = PdfJsonCosValue.builder();
-            if (base instanceof COSNull) {
-                builder.type(PdfJsonCosValue.Type.NULL);
-                return builder.build();
-            }
-            if (base instanceof COSBoolean booleanValue) {
-                builder.type(PdfJsonCosValue.Type.BOOLEAN).value(booleanValue.getValue());
-                return builder.build();
-            }
-            if (base instanceof COSInteger integer) {
-                builder.type(PdfJsonCosValue.Type.INTEGER).value(integer.longValue());
-                return builder.build();
-            }
-            if (base instanceof COSFloat floatValue) {
-                builder.type(PdfJsonCosValue.Type.FLOAT).value(floatValue.floatValue());
-                return builder.build();
-            }
-            if (base instanceof COSName name) {
-                builder.type(PdfJsonCosValue.Type.NAME).value(name.getName());
-                return builder.build();
-            }
-            if (base instanceof COSString cosString) {
-                builder.type(PdfJsonCosValue.Type.STRING)
-                        .value(Base64.getEncoder().encodeToString(cosString.getBytes()));
-                return builder.build();
-            }
-            if (base instanceof COSArray array) {
-                List<PdfJsonCosValue> items = new ArrayList<>(array.size());
-                for (COSBase item : array) {
-                    PdfJsonCosValue serialized = serializeCosValue(item, visited);
-                    items.add(serialized);
-                }
-                builder.type(PdfJsonCosValue.Type.ARRAY).items(items);
-                return builder.build();
-            }
-            if (base instanceof COSStream stream) {
-                builder.type(PdfJsonCosValue.Type.STREAM).stream(serializeStream(stream, visited));
-                return builder.build();
-            }
-            if (base instanceof COSDictionary dictionary) {
-                Map<String, PdfJsonCosValue> entries = new LinkedHashMap<>();
-                for (COSName key : dictionary.keySet()) {
-                    PdfJsonCosValue serialized =
-                            serializeCosValue(dictionary.getDictionaryObject(key), visited);
-                    entries.put(key.getName(), serialized);
-                }
-                builder.type(PdfJsonCosValue.Type.DICTIONARY).entries(entries);
-                return builder.build();
-            }
-            return null;
-        } finally {
-            if (complex) {
-                visited.remove(base);
-            }
-        }
-    }
-
-    private PdfJsonStream serializeStream(COSStream cosStream, Set<COSBase> visited)
-            throws IOException {
-        Map<String, PdfJsonCosValue> dictionary = new LinkedHashMap<>();
-        for (COSName key : cosStream.keySet()) {
-            COSBase value = cosStream.getDictionaryObject(key);
-            PdfJsonCosValue serialized = serializeCosValue(value, visited);
-            if (serialized != null) {
-                dictionary.put(key.getName(), serialized);
-            }
-        }
-        String rawData = null;
-        try (InputStream inputStream = cosStream.createRawInputStream();
-                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-            if (inputStream != null) {
-                inputStream.transferTo(baos);
-            }
-            byte[] data = baos.toByteArray();
-            if (data.length > 0) {
-                rawData = Base64.getEncoder().encodeToString(data);
-            }
-        }
-        return PdfJsonStream.builder().dictionary(dictionary).rawData(rawData).build();
-    }
-}

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonFallbackFontService.java

@@ -1,655 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.Locale;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.font.PDFont;
-import org.apache.pdfbox.pdmodel.font.PDType0Font;
-import org.apache.pdfbox.pdmodel.font.PDType3Font;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.Resource;
-import org.springframework.core.io.ResourceLoader;
-import org.springframework.stereotype.Component;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.json.PdfJsonFont;
-
-@Slf4j
-@Component
-@RequiredArgsConstructor
-public class PdfJsonFallbackFontService {
-
-    public static final String FALLBACK_FONT_ID = "fallback-noto-sans";
-    public static final String DEFAULT_FALLBACK_FONT_LOCATION =
-            "classpath:/static/fonts/NotoSans-Regular.ttf";
-    public static final String FALLBACK_FONT_CJK_ID = "fallback-noto-cjk";
-    public static final String FALLBACK_FONT_JP_ID = "fallback-noto-jp";
-    public static final String FALLBACK_FONT_KR_ID = "fallback-noto-korean";
-    public static final String FALLBACK_FONT_TC_ID = "fallback-noto-tc";
-    public static final String FALLBACK_FONT_AR_ID = "fallback-noto-arabic";
-    public static final String FALLBACK_FONT_TH_ID = "fallback-noto-thai";
-    public static final String FALLBACK_FONT_DEVANAGARI_ID = "fallback-noto-devanagari";
-    public static final String FALLBACK_FONT_MALAYALAM_ID = "fallback-noto-malayalam";
-    public static final String FALLBACK_FONT_TIBETAN_ID = "fallback-noto-tibetan";
-
-    // Font name aliases map PDF font names to available fallback fonts
-    // This provides better visual consistency when editing PDFs
-    private static final Map<String, String> FONT_NAME_ALIASES =
-            Map.ofEntries(
-                    // Liberation fonts are metric-compatible with Microsoft core fonts
-                    Map.entry("arial", "fallback-liberation-sans"),
-                    Map.entry("helvetica", "fallback-liberation-sans"),
-                    Map.entry("arimo", "fallback-liberation-sans"),
-                    Map.entry("liberationsans", "fallback-liberation-sans"),
-                    Map.entry("times", "fallback-liberation-serif"),
-                    Map.entry("timesnewroman", "fallback-liberation-serif"),
-                    Map.entry("tinos", "fallback-liberation-serif"),
-                    Map.entry("liberationserif", "fallback-liberation-serif"),
-                    Map.entry("courier", "fallback-liberation-mono"),
-                    Map.entry("couriernew", "fallback-liberation-mono"),
-                    Map.entry("cousine", "fallback-liberation-mono"),
-                    Map.entry("liberationmono", "fallback-liberation-mono"),
-                    // DejaVu fonts - widely used open source fonts
-                    Map.entry("dejavu", "fallback-dejavu-sans"),
-                    Map.entry("dejavusans", "fallback-dejavu-sans"),
-                    Map.entry("dejavuserif", "fallback-dejavu-serif"),
-                    Map.entry("dejavumono", "fallback-dejavu-mono"),
-                    Map.entry("dejavusansmono", "fallback-dejavu-mono"),
-                    // Traditional Chinese fonts (Taiwan, Hong Kong, Macau)
-                    Map.entry("mingliu", "fallback-noto-tc"),
-                    Map.entry("pmingliu", "fallback-noto-tc"),
-                    Map.entry("microsoftjhenghei", "fallback-noto-tc"),
-                    Map.entry("jhenghei", "fallback-noto-tc"),
-                    Map.entry("kaiti", "fallback-noto-tc"),
-                    Map.entry("kaiu", "fallback-noto-tc"),
-                    Map.entry("dfkaib5", "fallback-noto-tc"),
-                    Map.entry("dfkai", "fallback-noto-tc"),
-                    // Simplified Chinese fonts (Mainland China) - more common
-                    Map.entry("simsun", "fallback-noto-cjk"),
-                    Map.entry("simhei", "fallback-noto-cjk"),
-                    Map.entry("microsoftyahei", "fallback-noto-cjk"),
-                    Map.entry("yahei", "fallback-noto-cjk"),
-                    Map.entry("songti", "fallback-noto-cjk"),
-                    Map.entry("heiti", "fallback-noto-cjk"),
-                    // Noto Sans - Google's universal font (use as last resort generic fallback)
-                    Map.entry("noto", "fallback-noto-sans"),
-                    Map.entry("notosans", "fallback-noto-sans"));
-
-    private static final Map<String, FallbackFontSpec> BUILT_IN_FALLBACK_FONTS =
-            Map.ofEntries(
-                    Map.entry(
-                            FALLBACK_FONT_CJK_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansSC-Regular.ttf",
-                                    "NotoSansSC-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_JP_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansJP-Regular.ttf",
-                                    "NotoSansJP-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_KR_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansKR-Regular.ttf",
-                                    "NotoSansKR-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_TC_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansTC-Regular.ttf",
-                                    "NotoSansTC-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_AR_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansArabic-Regular.ttf",
-                                    "NotoSansArabic-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_TH_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansThai-Regular.ttf",
-                                    "NotoSansThai-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_DEVANAGARI_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansDevanagari-Regular.ttf",
-                                    "NotoSansDevanagari-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_MALAYALAM_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansMalayalam-Regular.ttf",
-                                    "NotoSansMalayalam-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_TIBETAN_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSerifTibetan-Regular.ttf",
-                                    "NotoSerifTibetan-Regular",
-                                    "ttf")),
-                    // Liberation Sans family
-                    Map.entry(
-                            "fallback-liberation-sans",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSans-Regular.ttf",
-                                    "LiberationSans-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-sans-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSans-Bold.ttf",
-                                    "LiberationSans-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-sans-italic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSans-Italic.ttf",
-                                    "LiberationSans-Italic",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-sans-bolditalic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSans-BoldItalic.ttf",
-                                    "LiberationSans-BoldItalic",
-                                    "ttf")),
-                    // Liberation Serif family
-                    Map.entry(
-                            "fallback-liberation-serif",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSerif-Regular.ttf",
-                                    "LiberationSerif-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-serif-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSerif-Bold.ttf",
-                                    "LiberationSerif-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-serif-italic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSerif-Italic.ttf",
-                                    "LiberationSerif-Italic",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-serif-bolditalic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationSerif-BoldItalic.ttf",
-                                    "LiberationSerif-BoldItalic",
-                                    "ttf")),
-                    // Liberation Mono family
-                    Map.entry(
-                            "fallback-liberation-mono",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationMono-Regular.ttf",
-                                    "LiberationMono-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-mono-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationMono-Bold.ttf",
-                                    "LiberationMono-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-mono-italic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationMono-Italic.ttf",
-                                    "LiberationMono-Italic",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-liberation-mono-bolditalic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/LiberationMono-BoldItalic.ttf",
-                                    "LiberationMono-BoldItalic",
-                                    "ttf")),
-                    // Noto Sans family (enhanced with weight variants)
-                    Map.entry(
-                            FALLBACK_FONT_ID,
-                            new FallbackFontSpec(
-                                    DEFAULT_FALLBACK_FONT_LOCATION, "NotoSans-Regular", "ttf")),
-                    Map.entry(
-                            "fallback-noto-sans-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSans-Bold.ttf",
-                                    "NotoSans-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-noto-sans-italic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSans-Italic.ttf",
-                                    "NotoSans-Italic",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-noto-sans-bolditalic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSans-BoldItalic.ttf",
-                                    "NotoSans-BoldItalic",
-                                    "ttf")),
-                    // DejaVu Sans family
-                    Map.entry(
-                            "fallback-dejavu-sans",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSans.ttf", "DejaVuSans", "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-sans-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSans-Bold.ttf",
-                                    "DejaVuSans-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-sans-oblique",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSans-Oblique.ttf",
-                                    "DejaVuSans-Oblique",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-sans-boldoblique",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSans-BoldOblique.ttf",
-                                    "DejaVuSans-BoldOblique",
-                                    "ttf")),
-                    // DejaVu Serif family
-                    Map.entry(
-                            "fallback-dejavu-serif",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSerif.ttf",
-                                    "DejaVuSerif",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-serif-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSerif-Bold.ttf",
-                                    "DejaVuSerif-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-serif-italic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSerif-Italic.ttf",
-                                    "DejaVuSerif-Italic",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-serif-bolditalic",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSerif-BoldItalic.ttf",
-                                    "DejaVuSerif-BoldItalic",
-                                    "ttf")),
-                    // DejaVu Mono family
-                    Map.entry(
-                            "fallback-dejavu-mono",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSansMono.ttf",
-                                    "DejaVuSansMono",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-mono-bold",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSansMono-Bold.ttf",
-                                    "DejaVuSansMono-Bold",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-mono-oblique",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSansMono-Oblique.ttf",
-                                    "DejaVuSansMono-Oblique",
-                                    "ttf")),
-                    Map.entry(
-                            "fallback-dejavu-mono-boldoblique",
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/DejaVuSansMono-BoldOblique.ttf",
-                                    "DejaVuSansMono-BoldOblique",
-                                    "ttf")));
-
-    private final ResourceLoader resourceLoader;
-    private final stirling.software.common.model.ApplicationProperties applicationProperties;
-
-    @Value("${stirling.pdf.fallback-font:" + DEFAULT_FALLBACK_FONT_LOCATION + "}")
-    private String legacyFallbackFontLocation;
-
-    private String fallbackFontLocation;
-
-    private final Map<String, byte[]> fallbackFontCache = new ConcurrentHashMap<>();
-
-    @jakarta.annotation.PostConstruct
-    private void loadConfig() {
-        String configured = null;
-        if (applicationProperties.getPdfEditor() != null) {
-            configured = applicationProperties.getPdfEditor().getFallbackFont();
-        }
-        if (configured != null && !configured.isBlank()) {
-            fallbackFontLocation = configured;
-        } else {
-            fallbackFontLocation = legacyFallbackFontLocation;
-        }
-        log.info("Using fallback font location: {}", fallbackFontLocation);
-    }
-
-    public PdfJsonFont buildFallbackFontModel() throws IOException {
-        return buildFallbackFontModel(FALLBACK_FONT_ID);
-    }
-
-    public PdfJsonFont buildFallbackFontModel(String fallbackId) throws IOException {
-        FallbackFontSpec spec = getFallbackFontSpec(fallbackId);
-        if (spec == null) {
-            throw new IOException("Unknown fallback font id " + fallbackId);
-        }
-        byte[] bytes = loadFallbackFontBytes(fallbackId, spec);
-        String base64 = java.util.Base64.getEncoder().encodeToString(bytes);
-        return PdfJsonFont.builder()
-                .id(fallbackId)
-                .uid(fallbackId)
-                .baseName(spec.baseName())
-                .subtype("TrueType")
-                .embedded(true)
-                .program(base64)
-                .programFormat(spec.format())
-                .build();
-    }
-
-    public PDFont loadFallbackPdfFont(PDDocument document) throws IOException {
-        return loadFallbackPdfFont(document, FALLBACK_FONT_ID);
-    }
-
-    public PDFont loadFallbackPdfFont(PDDocument document, String fallbackId) throws IOException {
-        FallbackFontSpec spec = getFallbackFontSpec(fallbackId);
-        if (spec == null) {
-            throw new IOException("Unknown fallback font id " + fallbackId);
-        }
-        byte[] bytes = loadFallbackFontBytes(fallbackId, spec);
-        try (InputStream stream = new ByteArrayInputStream(bytes)) {
-            // Load with embedSubset=false to ensure full glyph coverage
-            // Fallback fonts need all glyphs available for substituting missing characters
-            return PDType0Font.load(document, stream, false);
-        }
-    }
-
-    public boolean canEncodeFully(PDFont font, String text) {
-        return canEncode(font, text);
-    }
-
-    public boolean canEncode(PDFont font, int codePoint) {
-        return canEncode(font, new String(Character.toChars(codePoint)));
-    }
-
-    public boolean canEncode(PDFont font, String text) {
-        if (font == null || text == null || text.isEmpty()) {
-            return false;
-        }
-        if (font instanceof PDType3Font) {
-            return false;
-        }
-        try {
-            font.encode(text);
-            return true;
-        } catch (IOException | IllegalArgumentException | UnsupportedOperationException ex) {
-            // Only log at debug level to reduce verbosity - summary is logged elsewhere
-            log.debug(
-                    "[FONT-DEBUG] Font {} cannot encode text '{}' ({}): {}",
-                    font != null ? font.getName() : "null",
-                    text,
-                    font != null ? font.getClass().getSimpleName() : "null",
-                    ex.getMessage());
-            return false;
-        }
-    }
-
-    /**
-     * Resolve fallback font ID based on the original font name and code point. Attempts to match
-     * font family and weight/style for visual consistency.
-     *
-     * @param originalFontName the name of the original font (may be null)
-     * @param codePoint the Unicode code point that needs to be rendered
-     * @return fallback font ID
-     */
-    public String resolveFallbackFontId(String originalFontName, int codePoint) {
-        // First try to match based on original font name for visual consistency
-        if (originalFontName != null && !originalFontName.isEmpty()) {
-            // Normalize font name: remove subset prefix (e.g. "PXAAAC+"), convert to lowercase,
-            // remove spaces
-            String normalized =
-                    originalFontName
-                            .replaceAll("^[A-Z]{6}\\+", "") // Remove subset prefix
-                            .toLowerCase()
-                            .replaceAll("\\s+", ""); // Remove spaces (e.g. "Times New Roman" ->
-            // "timesnewroman")
-
-            // Extract base name without weight/style suffixes
-            // Split on common delimiters: hyphen, underscore, comma, plus
-            // Handles: "Arimo_700wght" -> "arimo", "Arial-Bold" -> "arial", "Arial,Bold" -> "arial"
-            String baseName = normalized.split("[-_,+]")[0];
-
-            String aliasedFontId = FONT_NAME_ALIASES.get(baseName);
-            if (aliasedFontId != null) {
-                // Detect weight and style from the normalized font name
-                boolean isBold = detectBold(normalized);
-                boolean isItalic = detectItalic(normalized);
-
-                // Apply weight/style suffix to fallback font ID
-                String styledFontId = applyWeightStyle(aliasedFontId, isBold, isItalic);
-
-                log.debug(
-                        "Matched font '{}' (normalized: '{}', base: '{}', bold: {}, italic: {}) to fallback '{}'",
-                        originalFontName,
-                        normalized,
-                        baseName,
-                        isBold,
-                        isItalic,
-                        styledFontId);
-                return styledFontId;
-            }
-        }
-
-        // Fall back to Unicode-based selection
-        return resolveFallbackFontId(codePoint);
-    }
-
-    /**
-     * Detect if font name indicates bold weight.
-     *
-     * @param normalizedFontName lowercase font name without subset prefix or spaces
-     * @return true if bold weight is detected
-     */
-    private boolean detectBold(String normalizedFontName) {
-        // Check for explicit bold indicators
-        if (normalizedFontName.contains("bold")
-                || normalizedFontName.contains("heavy")
-                || normalizedFontName.contains("black")) {
-            return true;
-        }
-
-        // Check for numeric weight indicators (600-900 = bold)
-        // Handles: "Arimo_700wght", "Arial-700", "Font-w700"
-        if (normalizedFontName.matches(".*[_-]?[6-9]00(wght)?.*")) {
-            return true;
-        }
-
-        return false;
-    }
-
-    /**
-     * Detect if font name indicates italic/oblique style.
-     *
-     * @param normalizedFontName lowercase font name without subset prefix or spaces
-     * @return true if italic style is detected
-     */
-    private boolean detectItalic(String normalizedFontName) {
-        return normalizedFontName.contains("italic") || normalizedFontName.contains("oblique");
-    }
-
-    /**
-     * Apply weight/style suffix to fallback font ID.
-     *
-     * <p>Weight/style variants are only applied to font families where we have the actual font
-     * files available. Currently supported: - Liberation Sans: Regular, Bold, Italic, BoldItalic
-     * (full support) - Liberation Serif: Regular, Bold, Italic, BoldItalic (full support) -
-     * Liberation Mono: Regular, Bold, Italic, BoldItalic (full support) - Noto Sans: Regular, Bold,
-     * Italic, BoldItalic (full support) - DejaVu Sans: Regular, Bold, Oblique, BoldOblique (full
-     * support) - DejaVu Serif: Regular, Bold, Italic, BoldItalic (full support) - DejaVu Mono:
-     * Regular, Bold, Oblique, BoldOblique (full support)
-     *
-     * <p>To add weight/style support for additional font families: 1. Download the font files
-     * (Bold, Italic, BoldItalic) to: app/core/src/main/resources/static/fonts/ 2. Register the
-     * variants in BUILT_IN_FALLBACK_FONTS map (see lines 63-267) 3. Update the check below to
-     * include the font family prefix
-     *
-     * @param baseFontId base fallback font ID (e.g., "fallback-liberation-sans")
-     * @param isBold true if bold weight needed
-     * @param isItalic true if italic style needed
-     * @return styled font ID (e.g., "fallback-liberation-sans-bold"), or base ID if variants not
-     *     available
-     */
-    private String applyWeightStyle(String baseFontId, boolean isBold, boolean isItalic) {
-        // Only apply weight/style to font families where we have the font files available
-        // Supported: Liberation (Sans/Serif/Mono), Noto Sans, DejaVu (Sans/Serif/Mono)
-        boolean isSupported =
-                baseFontId.startsWith("fallback-liberation-")
-                        || baseFontId.equals("fallback-noto-sans")
-                        || baseFontId.startsWith("fallback-dejavu-");
-
-        if (!isSupported) {
-            return baseFontId;
-        }
-
-        // DejaVu Sans and Mono use "oblique" instead of "italic"
-        boolean useOblique =
-                baseFontId.equals("fallback-dejavu-sans")
-                        || baseFontId.equals("fallback-dejavu-mono");
-
-        if (isBold && isItalic) {
-            return baseFontId + (useOblique ? "-boldoblique" : "-bolditalic");
-        } else if (isBold) {
-            return baseFontId + "-bold";
-        } else if (isItalic) {
-            return baseFontId + (useOblique ? "-oblique" : "-italic");
-        }
-
-        return baseFontId;
-    }
-
-    /**
-     * Resolve fallback font ID based on Unicode code point properties.
-     *
-     * @param codePoint the Unicode code point
-     * @return fallback font ID
-     */
-    public String resolveFallbackFontId(int codePoint) {
-        Character.UnicodeBlock block = Character.UnicodeBlock.of(codePoint);
-
-        // Bopomofo is primarily used in Taiwan for Traditional Chinese phonetic annotation
-        if (block == Character.UnicodeBlock.BOPOMOFO
-                || block == Character.UnicodeBlock.BOPOMOFO_EXTENDED) {
-            return FALLBACK_FONT_TC_ID;
-        }
-
-        // Compatibility ideographs are primarily used by Traditional Chinese encodings (e.g., Big5,
-        // HKSCS) so prefer the Traditional Chinese fallback here.
-        if (block == Character.UnicodeBlock.CJK_COMPATIBILITY_IDEOGRAPHS
-                || block == Character.UnicodeBlock.CJK_COMPATIBILITY_IDEOGRAPHS_SUPPLEMENT) {
-            return FALLBACK_FONT_TC_ID;
-        }
-
-        if (block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS
-                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_A
-                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_B
-                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_C
-                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_D
-                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_E
-                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_F
-                || block == Character.UnicodeBlock.CJK_SYMBOLS_AND_PUNCTUATION
-                || block == Character.UnicodeBlock.HALFWIDTH_AND_FULLWIDTH_FORMS) {
-            return FALLBACK_FONT_CJK_ID;
-        }
-
-        Character.UnicodeScript script = Character.UnicodeScript.of(codePoint);
-        return switch (script) {
-            // HAN script is used by both Simplified and Traditional Chinese
-            // Default to Simplified (mainland China, 1.4B speakers) as it's more common
-            // Traditional Chinese PDFs are detected via font name aliases (MingLiU, PMingLiU, etc.)
-            case HAN -> FALLBACK_FONT_CJK_ID;
-            case HIRAGANA, KATAKANA -> FALLBACK_FONT_JP_ID;
-            case HANGUL -> FALLBACK_FONT_KR_ID;
-            case ARABIC -> FALLBACK_FONT_AR_ID;
-            case THAI -> FALLBACK_FONT_TH_ID;
-            case DEVANAGARI -> FALLBACK_FONT_DEVANAGARI_ID;
-            case MALAYALAM -> FALLBACK_FONT_MALAYALAM_ID;
-            case TIBETAN -> FALLBACK_FONT_TIBETAN_ID;
-            default -> FALLBACK_FONT_ID;
-        };
-    }
-
-    public String mapUnsupportedGlyph(int codePoint) {
-        return switch (codePoint) {
-            case 0x276E -> "<";
-            case 0x276F -> ">";
-            default -> null;
-        };
-    }
-
-    private FallbackFontSpec getFallbackFontSpec(String fallbackId) {
-        if (FALLBACK_FONT_ID.equals(fallbackId)) {
-            String baseName = inferBaseName(fallbackFontLocation, "NotoSans-Regular");
-            String format = inferFormat(fallbackFontLocation, "ttf");
-            return new FallbackFontSpec(fallbackFontLocation, baseName, format);
-        }
-        return BUILT_IN_FALLBACK_FONTS.get(fallbackId);
-    }
-
-    private byte[] loadFallbackFontBytes(String fallbackId, FallbackFontSpec spec)
-            throws IOException {
-        if (spec == null) {
-            throw new IOException("No fallback font specification for " + fallbackId);
-        }
-        byte[] cached = fallbackFontCache.get(fallbackId);
-        if (cached != null) {
-            return cached;
-        }
-        Resource resource = resourceLoader.getResource(spec.resourceLocation());
-        if (!resource.exists()) {
-            throw new IOException("Fallback font resource not found at " + spec.resourceLocation());
-        }
-        try (InputStream inputStream = resource.getInputStream();
-                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-            inputStream.transferTo(baos);
-            byte[] bytes = baos.toByteArray();
-            fallbackFontCache.put(fallbackId, bytes);
-            return bytes;
-        }
-    }
-
-    private String inferBaseName(String location, String defaultName) {
-        if (location == null || location.isBlank()) {
-            return defaultName;
-        }
-        int slash = location.lastIndexOf('/');
-        String fileName = slash >= 0 ? location.substring(slash + 1) : location;
-        int dot = fileName.lastIndexOf('.');
-        if (dot > 0) {
-            fileName = fileName.substring(0, dot);
-        }
-        return fileName.isEmpty() ? defaultName : fileName;
-    }
-
-    private String inferFormat(String location, String defaultFormat) {
-        if (location == null || location.isBlank()) {
-            return defaultFormat;
-        }
-        int dot = location.lastIndexOf('.');
-        if (dot >= 0 && dot < location.length() - 1) {
-            return location.substring(dot + 1).toLowerCase(Locale.ROOT);
-        }
-        return defaultFormat;
-    }
-
-    private record FallbackFontSpec(String resourceLocation, String baseName, String format) {}
-}

app/core/src/main/java/stirling/software/SPDF/service/SharedSignatureService.java

@@ -1,308 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.nio.file.StandardOpenOption;
-import java.util.ArrayList;
-import java.util.Base64;
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.springframework.stereotype.Service;
-import org.springframework.util.StringUtils;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.model.api.signature.SavedSignatureRequest;
-import stirling.software.SPDF.model.api.signature.SavedSignatureResponse;
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Service
-@Slf4j
-public class SharedSignatureService {
-
-    private final String SIGNATURE_BASE_PATH;
-    private final String ALL_USERS_FOLDER = "ALL_USERS";
-    private final ObjectMapper objectMapper;
-
-    public SharedSignatureService() {
-        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
-        this.objectMapper = new ObjectMapper();
-    }
-
-    public boolean hasAccessToFile(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // Check if file exists in user's personal folder or ALL_USERS folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-
-        return Files.exists(userPath) || Files.exists(allUsersPath);
-    }
-
-    public List<SignatureFile> getAvailableSignatures(String username) {
-        List<SignatureFile> signatures = new ArrayList<>();
-
-        // Get signatures from user's personal folder
-        if (StringUtils.hasText(username)) {
-            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-            if (Files.exists(userFolder)) {
-                try {
-                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
-                } catch (IOException e) {
-                    log.error("Error reading user signatures folder", e);
-                }
-            }
-        }
-
-        // Get signatures from ALL_USERS folder
-        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(allUsersFolder)) {
-            try {
-                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
-            } catch (IOException e) {
-                log.error("Error reading shared signatures folder", e);
-            }
-        }
-
-        return signatures;
-    }
-
-    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
-            throws IOException {
-        try (Stream<Path> stream = Files.list(folder)) {
-            return stream.filter(this::isImageFile)
-                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
-                    .toList();
-        }
-    }
-
-    /**
-     * Get a signature from the shared (ALL_USERS) folder. This is always available for both
-     * authenticated and unauthenticated users.
-     */
-    public byte[] getSharedSignatureBytes(String fileName) throws IOException {
-        validateFileName(fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-        if (!Files.exists(allUsersPath)) {
-            throw new FileNotFoundException("Shared signature file not found");
-        }
-        return Files.readAllBytes(allUsersPath);
-    }
-
-    private boolean isImageFile(Path path) {
-        String fileName = path.getFileName().toString().toLowerCase();
-        return fileName.endsWith(".jpg") || fileName.endsWith(".jpeg") || fileName.endsWith(".png");
-    }
-
-    private void validateFileName(String fileName) {
-        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
-            throw new IllegalArgumentException("Invalid filename");
-        }
-        // Only allow alphanumeric, hyphen, underscore, and dot (for extensions)
-        if (!fileName.matches("^[a-zA-Z0-9_.-]+$")) {
-            throw new IllegalArgumentException("Filename contains invalid characters");
-        }
-    }
-
-    private String validateAndNormalizeExtension(String extension) {
-        String normalized = extension.toLowerCase().trim();
-        // Whitelist only safe image extensions
-        if (normalized.equals("png") || normalized.equals("jpg") || normalized.equals("jpeg")) {
-            return normalized;
-        }
-        throw new IllegalArgumentException("Unsupported image extension: " + extension);
-    }
-
-    private void verifyPathWithinDirectory(Path resolvedPath, Path targetDirectory)
-            throws IOException {
-        Path canonicalTarget = targetDirectory.toAbsolutePath().normalize();
-        Path canonicalResolved = resolvedPath.toAbsolutePath().normalize();
-        if (!canonicalResolved.startsWith(canonicalTarget)) {
-            throw new IOException("Resolved path is outside the target directory");
-        }
-    }
-
-    /** Save a signature as image file */
-    public SavedSignatureResponse saveSignature(String username, SavedSignatureRequest request)
-            throws IOException {
-        validateFileName(request.getId());
-
-        // Determine folder based on scope
-        String scope = request.getScope();
-        if (scope == null || scope.isEmpty()) {
-            scope = "personal"; // Default to personal
-        }
-
-        String folderName = "shared".equals(scope) ? ALL_USERS_FOLDER : username;
-        Path targetFolder = Paths.get(SIGNATURE_BASE_PATH, folderName);
-        Files.createDirectories(targetFolder);
-
-        long timestamp = System.currentTimeMillis();
-
-        SavedSignatureResponse response = new SavedSignatureResponse();
-        response.setId(request.getId());
-        response.setLabel(request.getLabel());
-        response.setType(request.getType());
-        response.setScope(scope);
-        response.setCreatedAt(timestamp);
-        response.setUpdatedAt(timestamp);
-
-        // Extract and save image data
-        String dataUrl = request.getDataUrl();
-        if (dataUrl != null && dataUrl.startsWith("data:image/")) {
-            // Extract base64 data
-            String base64Data = dataUrl.substring(dataUrl.indexOf(",") + 1);
-            byte[] imageBytes = Base64.getDecoder().decode(base64Data);
-
-            // Determine and validate file extension from data URL
-            String mimeType = dataUrl.substring(dataUrl.indexOf(":") + 1, dataUrl.indexOf(";"));
-            String rawExtension = mimeType.substring(mimeType.indexOf("/") + 1);
-            String extension = validateAndNormalizeExtension(rawExtension);
-
-            // Save image file only
-            String imageFileName = request.getId() + "." + extension;
-            Path imagePath = targetFolder.resolve(imageFileName);
-
-            // Verify path is within target directory
-            verifyPathWithinDirectory(imagePath, targetFolder);
-
-            Files.write(
-                    imagePath,
-                    imageBytes,
-                    StandardOpenOption.CREATE,
-                    StandardOpenOption.TRUNCATE_EXISTING);
-
-            // Store reference to image file
-            response.setDataUrl("/api/v1/general/signatures/" + imageFileName);
-        }
-
-        log.info("Saved signature {} for user {}", request.getId(), username);
-        return response;
-    }
-
-    /** Get all saved signatures for a user */
-    public List<SavedSignatureResponse> getSavedSignatures(String username) throws IOException {
-        List<SavedSignatureResponse> signatures = new ArrayList<>();
-
-        // Load personal signatures
-        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-        if (Files.exists(personalFolder)) {
-            try (Stream<Path> stream = Files.list(personalFolder)) {
-                stream.filter(this::isImageFile)
-                        .forEach(
-                                path -> {
-                                    try {
-                                        String fileName = path.getFileName().toString();
-                                        String id =
-                                                fileName.substring(0, fileName.lastIndexOf('.'));
-
-                                        SavedSignatureResponse sig = new SavedSignatureResponse();
-                                        sig.setId(id);
-                                        sig.setLabel(id); // Use ID as label
-                                        sig.setType("image"); // Default type
-                                        sig.setScope("personal");
-                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
-                                        sig.setCreatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-                                        sig.setUpdatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-
-                                        signatures.add(sig);
-                                    } catch (IOException e) {
-                                        log.error("Error reading signature file: " + path, e);
-                                    }
-                                });
-            }
-        }
-
-        // Load shared signatures
-        Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(sharedFolder)) {
-            try (Stream<Path> stream = Files.list(sharedFolder)) {
-                stream.filter(this::isImageFile)
-                        .forEach(
-                                path -> {
-                                    try {
-                                        String fileName = path.getFileName().toString();
-                                        String id =
-                                                fileName.substring(0, fileName.lastIndexOf('.'));
-
-                                        SavedSignatureResponse sig = new SavedSignatureResponse();
-                                        sig.setId(id);
-                                        sig.setLabel(id); // Use ID as label
-                                        sig.setType("image"); // Default type
-                                        sig.setScope("shared");
-                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
-                                        sig.setCreatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-                                        sig.setUpdatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-
-                                        signatures.add(sig);
-                                    } catch (IOException e) {
-                                        log.error("Error reading signature file: " + path, e);
-                                    }
-                                });
-            }
-        }
-
-        return signatures;
-    }
-
-    /** Delete a saved signature */
-    public void deleteSignature(String username, String signatureId) throws IOException {
-        validateFileName(signatureId);
-
-        // Try to find and delete image file in personal folder
-        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-        boolean deleted = false;
-
-        if (Files.exists(personalFolder)) {
-            try (Stream<Path> stream = Files.list(personalFolder)) {
-                List<Path> matchingFiles =
-                        stream.filter(
-                                        path ->
-                                                path.getFileName()
-                                                        .toString()
-                                                        .startsWith(signatureId + "."))
-                                .toList();
-                for (Path file : matchingFiles) {
-                    Files.delete(file);
-                    deleted = true;
-                }
-            }
-        }
-
-        // Try shared folder if not found in personal
-        if (!deleted) {
-            Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-            if (Files.exists(sharedFolder)) {
-                try (Stream<Path> stream = Files.list(sharedFolder)) {
-                    List<Path> matchingFiles =
-                            stream.filter(
-                                            path ->
-                                                    path.getFileName()
-                                                            .toString()
-                                                            .startsWith(signatureId + "."))
-                                    .toList();
-                    for (Path file : matchingFiles) {
-                        Files.delete(file);
-                        deleted = true;
-                    }
-                }
-            }
-        }
-
-        if (!deleted) {
-            throw new FileNotFoundException("Signature not found");
-        }
-
-        log.info("Deleted signature {} for user {}", signatureId, username);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/service/SignatureService.java

@@ -0,0 +1,107 @@
+package stirling.software.SPDF.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.SignatureFile;
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Service
+@Slf4j
+public class SignatureService {
+
+    private final String SIGNATURE_BASE_PATH;
+    private final String ALL_USERS_FOLDER = "ALL_USERS";
+
+    public SignatureService() {
+        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
+    }
+
+    public boolean hasAccessToFile(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // Check if file exists in user's personal folder or ALL_USERS folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+
+        return Files.exists(userPath) || Files.exists(allUsersPath);
+    }
+
+    public List<SignatureFile> getAvailableSignatures(String username) {
+        List<SignatureFile> signatures = new ArrayList<>();
+
+        // Get signatures from user's personal folder
+        if (StringUtils.hasText(username)) {
+            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+            if (Files.exists(userFolder)) {
+                try {
+                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
+                } catch (IOException e) {
+                    log.error("Error reading user signatures folder", e);
+                }
+            }
+        }
+
+        // Get signatures from ALL_USERS folder
+        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(allUsersFolder)) {
+            try {
+                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
+            } catch (IOException e) {
+                log.error("Error reading shared signatures folder", e);
+            }
+        }
+
+        return signatures;
+    }
+
+    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
+            throws IOException {
+        try (Stream<Path> stream = Files.list(folder)) {
+            return stream.filter(this::isImageFile)
+                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
+                    .toList();
+        }
+    }
+
+    public byte[] getSignatureBytes(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // First try user's personal folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        if (Files.exists(userPath)) {
+            return Files.readAllBytes(userPath);
+        }
+
+        // Then try ALL_USERS folder
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+        if (Files.exists(allUsersPath)) {
+            return Files.readAllBytes(allUsersPath);
+        }
+
+        throw new FileNotFoundException("Signature file not found");
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg")
+                || fileName.endsWith(".jpeg")
+                || fileName.endsWith(".png")
+                || fileName.endsWith(".gif");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/WeeklyActiveUsersService.java

@@ -1,101 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.time.Instant;
-import java.time.temporal.ChronoUnit;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Service for tracking Weekly Active Users (WAU) in no-login mode. Uses in-memory storage with
- * automatic cleanup of old entries.
- */
-@Service
-@Slf4j
-public class WeeklyActiveUsersService {
-
-    // Map of browser ID -> last seen timestamp
-    private final Map<String, Instant> activeBrowsers = new ConcurrentHashMap<>();
-
-    // Track total unique browsers seen (overall)
-    private long totalUniqueBrowsers = 0;
-
-    // Application start time
-    private final Instant startTime = Instant.now();
-
-    /**
-     * Records a browser access with the current timestamp
-     *
-     * @param browserId Unique browser identifier from X-Browser-Id header
-     */
-    public void recordBrowserAccess(String browserId) {
-        if (browserId == null || browserId.trim().isEmpty()) {
-            return;
-        }
-
-        boolean isNewBrowser = !activeBrowsers.containsKey(browserId);
-        activeBrowsers.put(browserId, Instant.now());
-
-        if (isNewBrowser) {
-            totalUniqueBrowsers++;
-            log.debug("New browser recorded: {} (Total: {})", browserId, totalUniqueBrowsers);
-        }
-    }
-
-    /**
-     * Gets the count of unique browsers seen in the last 7 days
-     *
-     * @return Weekly Active Users count
-     */
-    public long getWeeklyActiveUsers() {
-        cleanupOldEntries();
-        return activeBrowsers.size();
-    }
-
-    /**
-     * Gets the total count of unique browsers ever seen
-     *
-     * @return Total unique browsers count
-     */
-    public long getTotalUniqueBrowsers() {
-        return totalUniqueBrowsers;
-    }
-
-    /**
-     * Gets the number of days the service has been running
-     *
-     * @return Days online
-     */
-    public long getDaysOnline() {
-        return ChronoUnit.DAYS.between(startTime, Instant.now());
-    }
-
-    /**
-     * Gets the timestamp when tracking started
-     *
-     * @return Start time
-     */
-    public Instant getStartTime() {
-        return startTime;
-    }
-
-    /** Removes entries older than 7 days */
-    private void cleanupOldEntries() {
-        Instant sevenDaysAgo = Instant.now().minus(7, ChronoUnit.DAYS);
-        activeBrowsers.entrySet().removeIf(entry -> entry.getValue().isBefore(sevenDaysAgo));
-    }
-
-    /** Manual cleanup trigger (can be called by scheduled task if needed) */
-    public void performCleanup() {
-        int sizeBefore = activeBrowsers.size();
-        cleanupOldEntries();
-        int sizeAfter = activeBrowsers.size();
-
-        if (sizeBefore != sizeAfter) {
-            log.debug("Cleaned up {} old browser entries", sizeBefore - sizeAfter);
-        }
-    }
-}