test

.claude/skills/feature-walkthrough/SKILL.md

@@ -1,97 +0,0 @@
----
-name: feature-walkthrough
-description: >-
-  Explain the full logic and process of the current branch end-to-end so someone
-  with no prior knowledge of the task can understand, review, and reproduce it.
-  Scopes the change from the branch diff, traces the flow across every layer it
-  touches (frontend tool/hook/component, Java controller/service/endpoint, Python
-  engine, config, i18n, tests), and produces a self-contained walkthrough document
-  with Mermaid diagrams (sequence/flow/architecture), annotated file map with
-  clickable references, before/after behavior, screenshots where a UI is involved,
-  a "try it locally" section, and edge cases/risks. Use when asked for a feature or
-  branch walkthrough, "explain what this branch does", a design/logic writeup, PR
-  reviewer onboarding, or a hand-off doc. Pass --html to also emit a rendered HTML
-  version; --no-screens to skip screenshots.
-argument-hint: "[branch-or-area] [--html] [--no-screens]"
-allowed-tools: Read, Write, Edit, Glob, Grep, Bash
----
-
-# Feature / Branch Walkthrough
-
-Turn the current branch into a walkthrough a newcomer can follow. Audience:
-**someone who has never seen this task**. Explain the *why*, the *flow*, and *how to
-try it* - not just a diff summary.
-
-`$ARGUMENTS` may name a branch or area to focus on; default is the current branch
-vs `main`. Flags: `--html` (also emit a rendered HTML twin), `--no-screens`.
-
-## Process
-
-### 1. Scope the change
-- `git log --oneline main..HEAD` and `git diff --stat main...HEAD` for the shape.
-- Read the PR description / commit messages for stated intent. Do **not** invent
-  history or motivation that isn't evidenced (state current behavior in present tense).
-- Classify touched files by layer:
-  - **Frontend**: tools (`frontend/src/editor/core/components/tools/*` or `.../core/tools/*`),
-    hooks (`core/hooks/tools/*`, `useToolOperation`), contexts, routes, i18n
-    (`public/locales/en-US`).
-  - **Java backend**: controllers (`.../controller/api/...`), services, models, config.
-  - **Engine**: `engine/src/stirling/{agents,contracts,api,services}`.
-  - **Config / build / docker / tests.**
-
-### 2. Trace the flow end-to-end
-Follow one real path from user action to result. For a typical PDF tool that's:
-UI control → `useToolOperation` hook → `POST /api/v1/...` → Spring controller →
-service (PDFBox / LibreOffice / engine call) → response → review panel → download.
-Read the actual files so the narrative is true to the code, and collect the exact
-file:line anchors you'll cite.
-
-### 3. Draw the diagrams (Mermaid)
-Pick what fits; usually 2-3 of:
-- **Sequence diagram** - request/response across frontend → backend → engine.
-- **Flowchart** - the core decision/branching logic of the feature.
-- **Architecture/component** - new pieces and how they wire to existing ones.
-- **State** - if the feature has modes/steps.
-Keep nodes labeled in plain language. Validate the Mermaid parses before shipping.
-
-### 4. Screenshots (unless --no-screens)
-If a UI is involved, capture key states with the stubbed Playwright harness
-(see the **ui-walkthrough** skill and `files-page-screenshots.spec.ts` for the
-pattern) or, for before/after, capture `main` then the branch. Drop PNGs in
-`walkthrough/<feature>/` and reference them from the doc. For backend-only
-changes, show request/response examples (curl + JSON) instead.
-
-### 5. Write the walkthrough
-Create `walkthrough/<feature>/FEATURE-WALKTHROUGH.md` with:
-1. **TL;DR** - what the branch does and who it's for, in 3-4 sentences.
-2. **Problem & approach** - what wasn't possible before; the chosen solution.
-3. **Architecture diagram** + 1-paragraph orientation.
-4. **End-to-end flow** - the sequence diagram + a numbered walk of each step,
-   each citing the real file (clickable `path:line`).
-5. **Key files** - annotated map (path → one line on its role).
-6. **Logic deep-dive** - the flowchart + prose for the non-obvious decisions.
-7. **Behavior** - before vs after; screenshots or request/response examples.
-8. **Try it locally** - exact steps (`task dev` / `task dev:all`, the route to
-   open or the curl to run, any env like `DOCKER_ENABLE_SECURITY` or a test
-   license key). Make it copy-pasteable.
-9. **Edge cases, risks, follow-ups** - what's untested, known limits, gotchas.
-
-Markdown is the primary deliverable - it renders with diagrams in GitHub PRs and
-IDEs, no build step, ideal for review.
-
-### 6. If `--html`
-Also emit `walkthrough/<feature>/walkthrough.html`: the same content with Mermaid
-rendered via `mermaid.initialize({startOnLoad:true})` (script from CDN; note in
-the file that rendering diagrams needs network, the `.md` is the offline copy) and
-screenshots inline. Keep it self-contained otherwise.
-
-### 7. Deliver
-Give the doc path and a short chat summary. Offer to `SendUserFile` it.
-
-## Principles
-- **True to the code.** Every claim traces to a file you read; cite `path:line`.
-  No fabricated migration/version history.
-- **Newcomer-first.** Define repo-specific terms (FileContext, `useToolOperation`,
-  the `@app/*` layer cascade, stubbed vs live tests) on first use.
-- **Show, don't assert.** Prefer a diagram + a real example over adjectives.
-- Don't commit the `walkthrough/` output unless asked.

.claude/skills/pr-quiz/SKILL.md

@@ -1,137 +0,0 @@
----
-name: pr-quiz
-description: >-
-  Quiz the PR author on their own branch before they request review, to prove they
-  actually understand the change - especially code an AI wrote for them. Scopes the
-  branch diff vs its base, reads the changed code, then asks graded questions about
-  what changed, why, how it works, what it could break, and which edge cases it must
-  handle. Presents all questions first, waits for the author's answers, then grades
-  each honestly against the real code (Correct / Partial / Incorrect with the true
-  answer and file:line), scores it, and gives a readiness verdict that names the
-  areas to re-study before asking humans to review. Use when asked to quiz me on my
-  PR/branch, "test my understanding before review", a self-check gate before opening
-  a PR, or before requesting reviewers. Administered as an interactive
-  multiple-choice quiz (clickable options) by default; pass --free-text for
-  written answers, --questions N to set count, --save to write a scorecard.
-argument-hint: "[branch-or-base-ref] [--questions N] [--free-text] [--save]"
-allowed-tools: Bash, Read, Grep, Glob, Write, AskUserQuestion
----
-
-# PR Quiz
-
-Test whether the **author** genuinely understands their own branch before they ask
-other people to spend time reviewing it. This is a self-check gate: the point is to
-catch changes - often AI-written - that the author would not be able to explain or
-defend in review. Be a fair but honest examiner, not a pushover.
-
-`$ARGUMENTS` may name a base ref or branch to diff against; default is this branch
-vs where it forked from the main line. Flags:
-- `--questions N` - target N questions (else scale to diff size, see below).
-- `--free-text` - administer as a written numbered list instead of the default
-  interactive multiple-choice.
-- `--save` - also write a scorecard file after grading.
-
-## Integrity rules (read first - the whole skill depends on these)
-
-1. **Present every question before revealing any answer.** Ask, then wait. Never
-   show the answer key alongside the questions.
-2. **Do not give hints or the answer while the quiz is open.** If the author asks
-   "what's the answer?" or "is it X?" before committing, decline warmly and tell
-   them to give their best answer first - guessing is part of the signal.
-3. **Grade truthfully.** Vague, hand-wavy, or "the AI did it" non-answers are
-   Partial or Incorrect, not Correct. Do not inflate the score to be nice; a false
-   pass defeats the entire purpose.
-4. **Ground everything in code you actually read.** Every question and every model
-   answer must trace to a real line in the diff. Cite `path:line`. No trivia
-   ("how many lines?"), no invented behavior.
-5. **Credit real understanding.** If the author explains it correctly in their own
-   words, mark it Correct even if worded differently than your key.
-
-## Process
-
-### 1. Scope the change (silently)
-- Find the base. Prefer the fork point off the main line so the quiz covers only
-  this branch's work:
-  ```bash
-  git fetch -q origin 2>/dev/null; \
-  BASE=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main); \
-  git diff --stat "$BASE"...HEAD
-  ```
-  If `$ARGUMENTS` names a ref, diff against that instead.
-- If the diff is empty, stop and say there's nothing to quiz on.
-- Read commit messages / PR description for the *stated* intent, but verify it
-  against the actual diff - a mismatch is itself a good question.
-
-### 2. Understand the code well enough to examine on it
-Read the full diff plus enough surrounding context and related files to answer
-every question you plan to ask. You cannot grade understanding you don't have.
-Note the non-obvious parts: the design decisions, the risky lines, the edge cases,
-the cross-file ripples, and anything that violates or upholds repo conventions
-(for this repo e.g. `@app/*` import layering, all file ops via FileContext,
-Jackson 3 / Spring Boot 4 APIs, engine typed-contract boundaries).
-
-### 3. Build the question set
-Scale count to the change unless `--questions N` is given:
-small (< ~50 changed lines) 3-4, medium 5-8, large 9-12. Cap at 12.
-Draw from these categories - weight toward the ones the diff actually exercises:
-- **Intent** - what problem this solves; why it was needed now.
-- **Mechanism** - how a specific non-trivial piece actually works ("walk me
-  through what `foo()` does when called with X").
-- **Decisions & alternatives** - why this approach over an obvious alternative;
-  what a reviewer would reasonably push back on.
-- **Blast radius** - what else this touches or could break; what you'd retest.
-- **Edge cases** - inputs/states the change must handle (null, empty, large,
-  concurrent, error paths).
-- **Conventions & correctness** - does it follow the repo's rules; is there a
-  latent bug the author should be able to spot.
-Prefer questions the author can only answer if they read and understood the code.
-Keep a private answer key with `path:line` for each - do **not** show it yet.
-
-### 4. Administer the quiz
-- **Default (multiple choice):** use the `AskUserQuestion` tool. Per question write
-  3-4 options where **every** option is independently plausible - each distractor a
-  real-but-wrong reading of the code, not filler. Two hard rules so the answer
-  can't be spotted by shape rather than knowledge:
-  - **Randomise the correct option's position** across questions - never default
-    it to first. Spread it roughly evenly over the slots.
-  - **Keep all options the same depth and length.** Do not describe the correct
-    one more fully than the distractors - a longer or more-detailed option is a
-    dead giveaway. Trim the right answer or flesh out the wrong ones until a
-    reader can't tell them apart by size.
-  The tool caps a call at 4 questions, so ask in batches of 4 - but run them as
-  one continuous flow: fire the next batch immediately after the previous
-  returns, with no narration ("Round 2 of 3") and no grading between batches.
-  The author always has an "Other" free-text escape, which is fine.
-- **`--free-text`:** present all questions in one numbered list, then say
-  "Answer in one reply; number your answers. I won't grade until you're done."
-  Wait for the author's answers.
-- Do not proceed to grading until every answer is in.
-
-### 5. Grade
-For each question, in order:
-- Verdict: **Correct** / **Partial** / **Incorrect**.
-- The model answer in one or two sentences, citing the real `path:line`.
-- One line on the gap when Partial/Incorrect - what they missed and where to look.
-Then a **Score** (e.g. 6/8, counting Partial as half) and a one-line summary of
-the pattern (e.g. "solid on intent, shaky on the error paths").
-
-### 6. Readiness verdict
-End with a clear call:
-- **Ready for review** - understanding is sound; note anything to mention to
-  reviewers proactively.
-- **Study first** - list the specific files/concepts to re-read before requesting
-  review, each as a clickable `path:line`. Be concrete: "re-read the null handling
-  in X before you send this out."
-Keep it honest - if they'd get grilled in review on something, say so now.
-
-### 7. If `--save`
-Write `pr-quiz/<branch>-scorecard.md`: the questions, their answers, your grades
-and model answers, the score, and the verdict. Don't commit it unless asked.
-
-## Principles
-- **The author is the examinee, not the collaborator.** During the quiz you withhold
-  answers; you're measuring them, not helping them pass.
-- **A failed quiz is a successful outcome** - it caught a gap before a human's time
-  was spent. Frame it that way, not as a scolding.
-- **True to the code.** Every question, answer, and grade traces to a line you read.
-- **Terse and direct** in chat - the questions and the verdict, minimal preamble.

.claude/skills/ui-before-after/SKILL.md

@@ -1,122 +0,0 @@
----
-name: ui-before-after
-description: >-
-  Analyse a branch or PR and automatically capture before/after screenshots of
-  every UI surface its changes touch, then pixel-diff the pairs to surface what
-  actually changed and assemble PR-ready before/after montage images. Generic and
-  diff-driven: it derives the capture targets from the diff (changed tools/routes →
-  URLs) instead of hand-listing screens, captures "before" from the base branch and
-  "after" from the head, then keeps only the views that visually differ. Each
-  comparison is auto-cropped to the region that actually changed (the bounding box of
-  differing pixels), falling back to the full page only when the change spans most of
-  it. Use for before/after shots, a visual diff of a branch/PR, "screenshots for the
-  PR description", "show what changed in the UI", or a side-by-side of UI changes.
-  Takes a PR number/URL (resolved via gh) or a branch; defaults to the current branch
-  vs its base. Flags: --scope <selector>, --base <ref|merge-base>, --theme
-  light|dark|both, --all (capture every route, not just changed), --no-autocrop,
-  --pagewide <n>, --threshold <n>.
-argument-hint: "[PR# | PR-url | branch] [--scope <sel>] [--base <ref>] [--theme both] [--all] [--no-autocrop]"
-allowed-tools: Read, Write, Edit, Glob, Grep, Bash
----
-
-# UI Before / After (generic visual diff)
-
-Point it at a branch or PR; it figures out which UI changed, screenshots every
-affected surface **before** (base) and **after** (head), pixel-diffs the pairs, and
-montages the ones that actually changed into images for the PR description.
-
-`$ARGUMENTS`: a PR number/URL, a branch, or nothing (current branch vs base).
-By default it captures the full viewport and auto-crops each comparison to the region
-that changed. Flags: `--scope <css>` (narrow the *capture* to a container, e.g.
-`[data-sidebar="tool-panel"]`, when you already know where the change is),
-`--no-autocrop` (keep full frames), `--pagewide <fraction>` (above this share of the
-page, skip cropping; default 0.6), `--base <ref|merge-base>`,
-`--theme light|dark|both`, `--all` (walk every route, not just changed),
-`--threshold <fraction>` (diff sensitivity, default 0.001).
-
-Shares the capture harness with **ui-walkthrough** - read its SKILL.md for the
-stubbed-Playwright setup, worktree node_modules + `generate-icons`, the
-stale-`:5173` gotcha, and the dark-mode init-script. Bundled helpers:
-[capture-spec.template.ts](capture-spec.template.ts), [diff-shots.mjs](diff-shots.mjs),
-[montage-template.html](montage-template.html), [shoot-sections.mjs](shoot-sections.mjs).
-
-## Process
-
-### 1. Resolve target + base
-```
-gh pr view <pr> --json number,title,headRefName,baseRefName,url,files   # PR
-# or branch: base = merge-base(main, HEAD); head = HEAD
-gh pr diff <pr> --name-only        # or: git diff --name-only <base>...HEAD
-```
-
-### 2. Derive capture targets from the diff (the "analyse" step - no hand-listing)
-Map changed frontend files to URLs generically:
-- **Tools**: a changed `components/tools/<toolDir>/…` or `hooks/tools/<tool>/…` →
-  toolId → URL via the repo's own rule `getToolUrlPath` in
-  [toolsTaxonomy.ts:200](frontend/src/editor/core/data/toolsTaxonomy.ts): `/` + the
-  id kebab-cased (`addPageNumbers` → `/add-page-numbers`).
-- **Pages/routes**: changed `filesPage/*` → `/files`, etc.
-- `--all`: enumerate every tool in the registry instead of just changed ones.
-Write `frontend/screenshots/ui-diff/targets.json` =
-`[{ "id":"compress", "url":"/compress", "name":"Compress" }]`. This is what makes
-it generic - the spec never names a tool.
-
-### 3. Capture AFTER (head) then BEFORE (base)
-Copy [capture-spec.template.ts](capture-spec.template.ts) →
-`src/core/tests/stubbed/ui-before-after.spec.ts` (it loops `targets.json`, seeds a
-sample PDF so file-dependent panels render, navigates to each URL, and screenshots
-the full viewport - or the `--scope` container if given). Ensure the harness is ready
-(node_modules + icons).
-```
-# after = current head
-cd frontend && PR_SHOT_SIDE=after PR_SHOT_THEME=light \
-  npx playwright test --project=stubbed ui-before-after.spec.ts
-# before = base, in an isolated worktree (copy the spec + targets.json in)
-git worktree add ../ba-base origin/<baseRefName>        # or the merge-base
-#   set up its frontend, copy spec + screenshots/ui-diff/targets.json across, then:
-cd ../ba-base/frontend && PR_SHOT_SIDE=before PR_SHOT_THEME=light \
-  npx playwright test --project=stubbed ui-before-after.spec.ts
-#   copy its screenshots/ui-diff/before/ back next to after/. Repeat with
-#   PR_SHOT_THEME=dark if --theme includes dark. Remove worktree when done.
-```
-
-### 4. Auto-diff (surface what changed)
-```
-cd frontend && node <skill>/diff-shots.mjs \
-  screenshots/ui-diff/before screenshots/ui-diff/after screenshots/ui-diff
-```
-Produces `diff-report.json` classifying each view `unchanged | changed | added |
-removed`. For each changed view it computes the bounding box of differing pixels and
-writes cropped `__before_crop.png` / `__after_crop.png` / `__diff.png` to that region
-(+ padding) - **unless** the change covers more than `--pagewide` of the frame, where
-it keeps the full frame (`pageWide:true`). Drop `unchanged` - that's the noise the
-user doesn't want.
-
-### 5. Montage the changes
-Build the manifest from the non-unchanged entries (group by tab/tool; each becomes a
-state row with before/after). For changed views use the cropped `cropBefore` /
-`cropAfter` from `diff-report.json` (tight on the affected region; full frame when
-`pageWide`); `added`/`removed` render the "not present" placeholder. Fill
-[montage-template.html](montage-template.html) (replace the `window.__BA__` data
-block; base64-inline the PNGs for portability), then render one PNG per section with
-[shoot-sections.mjs](shoot-sections.mjs). Optionally include the `__diff.png` overlay
-as a third column.
-
-### 6. Deliver
-Output the `montage_<tab>.png` files + a short summary (N changed / added / removed,
-M unchanged skipped) and a paste-ready Markdown block. GitHub has no PR-body image
-API, so tell the user to drag the PNGs into the description. Do **not** post to the
-PR.
-
-## Gotchas
-- Two installs (base worktree + head); junction main's node_modules only if its deps
-  match that ref, else `npm ci` (see ui-walkthrough's stale-dep note).
-- A view that errors on one side (refactored/removed) → that side is missing; the
-  diff marks it added/removed rather than failing the run.
-- Pixel diff needs equal dimensions, so capture at a fixed viewport (the template
-  does); a view whose size changed is reported as "changed (dimensions differ)",
-  uncropped.
-- Auto-crop uses a single bounding box, so two far-apart changes give one large crop
-  (or trip `--pagewide`); narrow with `--scope` if that happens.
-- `getToolUrlPath` is the source of truth for tool URLs - use it, don't guess slugs.
-- Don't commit `screenshots/`, the throwaway spec, or the base worktree.

.claude/skills/ui-before-after/capture-spec.template.ts

@@ -1,67 +0,0 @@
-// Generic before/after capturer. NOT app-specific: it walks a targets.json that
-// the ui-before-after skill generates from the branch/PR diff, so nothing here is
-// hand-listed. Copy to src/core/tests/stubbed/ui-before-after.spec.ts, then run
-// once per (side, theme):
-//   PR_SHOT_SIDE=after  PR_SHOT_THEME=light \
-//     npx playwright test --project=stubbed ui-before-after.spec.ts
-//
-// targets.json shape: [{ "id":"compress", "url":"/compress", "name":"Compress",
-//                        "needsFile": true }]
-import { test } from "@app/tests/helpers/stub-test-base";
-import type { Page } from "@playwright/test";
-import fs from "node:fs";
-import path from "node:path";
-
-const SIDE = process.env.PR_SHOT_SIDE ?? "after";
-const THEME = process.env.PR_SHOT_THEME ?? "light";
-// Capture the full viewport by default so the affected region is in frame
-// wherever it is; diff-shots.mjs crops each comparison to what actually changed.
-// Set PR_SHOT_SCOPE to a selector to narrow the capture to one container.
-const SCOPE = process.env.PR_SHOT_SCOPE ?? "";
-const ROOT = path.resolve(process.cwd(), "screenshots", "ui-diff");
-const OUT = path.join(ROOT, SIDE);
-// A tiny sample PDF so file-dependent tool panels render. Point at a real fixture.
-const SAMPLE_PDF = process.env.PR_SHOT_SAMPLE ?? "src/core/tests/test-fixtures/sample.pdf";
-
-type Target = { id: string; url: string; name?: string; needsFile?: boolean };
-const targets: Target[] = JSON.parse(fs.readFileSync(path.join(ROOT, "targets.json"), "utf-8"));
-
-test.use({ autoGoto: false, viewport: { width: 1600, height: 900 }, seedJwt: true });
-
-async function applyTheme(page: Page): Promise<void> {
-  if (THEME !== "dark") return;
-  await page.addInitScript(() => {
-    localStorage.setItem("mantine-color-scheme", "dark");
-    localStorage.setItem("mantine-color-scheme-value", "dark");
-  });
-  await page.emulateMedia({ colorScheme: "dark" });
-}
-
-async function seedFile(page: Page): Promise<void> {
-  if (!fs.existsSync(SAMPLE_PDF)) return;
-  await page.goto("/", { waitUntil: "domcontentloaded" });
-  await page.getByTestId("files-button").click().catch(() => {});
-  await page.locator('[data-testid="file-input"]').setInputFiles(SAMPLE_PDF).catch(() => {});
-  await page.locator(".file-sidebar-file-item").first().isVisible({ timeout: 8_000 }).catch(() => {});
-}
-
-for (const t of targets) {
-  // One test per target so a single failure doesn't drop the rest.
-  test(`${SIDE}/${THEME} ${t.id}`, async ({ page }) => {
-    fs.mkdirSync(OUT, { recursive: true });
-    await applyTheme(page);
-    if (t.needsFile !== false) await seedFile(page);
-    await page.goto(t.url, { waitUntil: "domcontentloaded" });
-    await page.waitForTimeout(400); // settle Mantine portals/transitions
-    const shot = path.join(OUT, `${t.id}__${THEME}.png`);
-    if (SCOPE) {
-      const scope = page.locator(SCOPE).first();
-      if (await scope.isVisible({ timeout: 8_000 }).catch(() => false)) {
-        await scope.screenshot({ path: shot });
-        return;
-      }
-    }
-    // Full viewport (fixed size → stable dimensions for pixel diffing).
-    await page.screenshot({ path: shot });
-  });
-}

.claude/skills/ui-before-after/diff-shots.mjs

@@ -1,106 +0,0 @@
-// Auto-diff before/ vs after/ screenshots, classify each as
-// unchanged | changed | added | removed, and CROP each changed pair to the
-// affected region (bounding box of differing pixels + padding) - unless the
-// change spans most of the page, in which case the full frame is kept.
-// Run from frontend (so deps resolve):
-//   node <skill>/diff-shots.mjs <beforeDir> <afterDir> [outDir]
-// Env:
-//   DIFF_THRESHOLD  min fraction of differing pixels to count as changed (default 0.001)
-//   DIFF_PAD        padding px around the affected region (default 24)
-//   DIFF_PAGEWIDE   if affected bbox area / image area exceeds this, keep full frame (default 0.6)
-import fs from "node:fs";
-import path from "node:path";
-import { createRequire } from "node:module";
-
-const require = createRequire(path.join(process.cwd(), "noop.js"));
-const pm = require("pixelmatch");
-const pixelmatch = pm.default || pm;
-const { PNG } = require("pngjs");
-
-const beforeDir = path.resolve(process.argv[2]);
-const afterDir = path.resolve(process.argv[3]);
-const outDir = path.resolve(process.argv[4] || afterDir);
-const THRESHOLD = Number(process.env.DIFF_THRESHOLD ?? "0.001");
-const PAD = Number(process.env.DIFF_PAD ?? "24");
-const PAGEWIDE = Number(process.env.DIFF_PAGEWIDE ?? "0.6");
-
-const read = (p) => PNG.sync.read(fs.readFileSync(p));
-const isShot = (f) => f.endsWith(".png") && !/__(diff|before_crop|after_crop)\.png$/.test(f);
-const list = (d) => (fs.existsSync(d) ? fs.readdirSync(d).filter(isShot) : []);
-const names = [...new Set([...list(beforeDir), ...list(afterDir)])].sort();
-fs.mkdirSync(outDir, { recursive: true });
-
-function cropPNG(src, x, y, w, h) {
-  const out = new PNG({ width: w, height: h });
-  PNG.bitblt(src, out, x, y, w, h, 0, 0);
-  return out;
-}
-const writePNG = (p, png) => fs.writeFileSync(p, PNG.sync.write(png));
-
-// Bounding box of differing pixels using a diff mask (alpha>0 where changed).
-function changedBBox(before, after, w, h) {
-  const mask = new PNG({ width: w, height: h });
-  pixelmatch(before.data, after.data, mask.data, w, h, { threshold: 0.1, diffMask: true });
-  let minX = w, minY = h, maxX = -1, maxY = -1, count = 0;
-  for (let y = 0; y < h; y++) {
-    for (let x = 0; x < w; x++) {
-      if (mask.data[(y * w + x) * 4 + 3] > 0) {
-        count++;
-        if (x < minX) minX = x; if (x > maxX) maxX = x;
-        if (y < minY) minY = y; if (y > maxY) maxY = y;
-      }
-    }
-  }
-  return maxX < 0 ? null : { minX, minY, maxX, maxY, count };
-}
-
-const report = [];
-for (const name of names) {
-  const id = name.replace(/\.png$/, "");
-  const bp = path.join(beforeDir, name), ap = path.join(afterDir, name);
-  const hasB = fs.existsSync(bp), hasA = fs.existsSync(ap);
-  if (hasB && !hasA) { report.push({ id, status: "removed", before: bp }); continue; }
-  if (!hasB && hasA) { report.push({ id, status: "added", after: ap }); continue; }
-
-  const before = read(bp), after = read(ap);
-  if (before.width !== after.width || before.height !== after.height) {
-    report.push({ id, status: "changed", note: "dimensions differ", before: bp, after: ap });
-    continue;
-  }
-  const w = after.width, h = after.height;
-  const overlay = new PNG({ width: w, height: h });
-  const px = pixelmatch(before.data, after.data, overlay.data, w, h, { threshold: 0.1 });
-  const ratio = px / (w * h);
-  if (ratio <= THRESHOLD) { report.push({ id, status: "unchanged", ratio: Number(ratio.toFixed(5)), before: bp, after: ap }); continue; }
-
-  const box = changedBBox(before, after, w, h);
-  // Pad + clamp the affected region.
-  const x = Math.max(0, box.minX - PAD), y = Math.max(0, box.minY - PAD);
-  const x2 = Math.min(w, box.maxX + 1 + PAD), y2 = Math.min(h, box.maxY + 1 + PAD);
-  const bw = x2 - x, bh = y2 - y;
-  const pageWide = (bw * bh) / (w * h) > PAGEWIDE;
-
-  const entry = { id, status: "changed", ratio: Number(ratio.toFixed(5)), before: bp, after: ap, pageWide };
-  if (pageWide) {
-    // Change spans most of the page - keep the full frame, full overlay.
-    const dp = path.join(outDir, `${id}__diff.png`); writePNG(dp, overlay);
-    entry.diff = dp;
-  } else {
-    entry.bbox = { x, y, w: bw, h: bh };
-    const cb = path.join(outDir, `${id}__before_crop.png`); writePNG(cb, cropPNG(before, x, y, bw, bh));
-    const ca = path.join(outDir, `${id}__after_crop.png`); writePNG(ca, cropPNG(after, x, y, bw, bh));
-    const dp = path.join(outDir, `${id}__diff.png`); writePNG(dp, cropPNG(overlay, x, y, bw, bh));
-    entry.cropBefore = cb; entry.cropAfter = ca; entry.diff = dp;
-  }
-  report.push(entry);
-}
-
-fs.writeFileSync(path.join(outDir, "diff-report.json"), JSON.stringify(report, null, 2));
-const changed = report.filter((r) => r.status !== "unchanged");
-console.log(`diffed ${report.length} view(s): ${changed.length} changed/added/removed, ${report.length - changed.length} unchanged`);
-for (const r of changed) {
-  const tail = r.status !== "changed" ? ""
-    : r.pageWide ? " (page-wide → full frame)"
-    : ` (${(r.ratio * 100).toFixed(2)}%, cropped to ${r.bbox.w}×${r.bbox.h})`;
-  console.log(`  ${r.status.padEnd(9)} ${r.id}${tail}${r.note ? " - " + r.note : ""}`);
-}

.claude/skills/ui-before-after/make_example.py

@@ -1,48 +0,0 @@
-"""Build EXAMPLE.html from montage-template.html using REAL files-page shots as
-stand-in before/after pairs (layout demo, not an actual PR diff). Inlines PNGs as
-data URIs so the HTML is portable. Run: python make_example.py"""
-import base64
-import json
-import pathlib
-import re
-
-HERE = pathlib.Path(__file__).parent
-SHOTS = pathlib.Path(
-    r"C:\Users\systo\git\Stirling-PDFNew\.claude\worktrees\kind-faraday-522a30"
-    r"\frontend\editor\screenshots\files-page"
-)
-
-
-def uri(fname):
-    p = SHOTS / fname
-    return "data:image/png;base64," + base64.b64encode(p.read_bytes()).decode() if p.exists() else None
-
-
-data = {
-    "pr": "DEMO",
-    "title": "EXAMPLE — before/after montage (layout demo, real Files-page shots; not a real PR diff)",
-    "base": "main", "head": "demo-branch",
-    "cropSelector": "[data-sidebar=\"tool-panel\"]  (real runs crop to the side; these demo shots are full-page)",
-    "tabs": [
-        {"id": "files", "title": "Files page", "ctx": "Each row = one flow state; left = base branch, right = this PR.",
-         "states": [
-             {"name": "Empty folder", "before": uri("01_empty_state_ctas.png"), "after": uri("02_empty_state_storage_off.png")},
-             {"name": "Files + details panel", "before": uri("03_subtoolbar_with_files.png"), "after": uri("06_details_panel_save_to_server.png")},
-             {"name": "Delete folder confirm", "before": None, "after": uri("19_delete_folder_dialog.png"), "note": "New in this PR"},
-         ]},
-        {"id": "move", "title": "Move-to-folder dialog",
-         "states": [
-             {"name": "Dialog opened", "before": uri("07_move_dialog_collapsed.png"), "after": uri("08_move_dialog_create_folder_expanded.png")},
-             {"name": "After folder created", "before": None, "after": uri("08b_move_dialog_after_create_folder.png"), "note": "New flow"},
-         ]},
-    ],
-}
-
-tpl = (HERE / "montage-template.html").read_text(encoding="utf-8")
-out = re.sub(
-    r"/\*__DATA__\*/.*?/\*__END__\*/",
-    lambda _m: "/*__DATA__*/" + json.dumps(data) + "/*__END__*/",
-    tpl, count=1, flags=re.S,
-)
-(HERE / "EXAMPLE.html").write_text(out, encoding="utf-8")
-print("wrote", HERE / "EXAMPLE.html", "(", (HERE / "EXAMPLE.html").stat().st_size // 1024, "KB )")

.claude/skills/ui-before-after/montage-template.html

@@ -1,106 +0,0 @@
-<!doctype html>
-<!--
-  Before/After montage for a PR description. The ui-before-after skill replaces
-  the JSON in the window.__BA__ data block below with the captured manifest, then
-  screenshots each .tab-section (id="section-<tabId>") into a PNG to drag into the
-  PR description. Self-contained; images may be relative paths or data URIs.
-
-  Data shape:
-  {
-    "pr":"6552","title":"...","base":"main","head":"feat/x",
-    "cropSelector":"[data-sidebar=\"tool-panel\"]",
-    "tabs":[
-      { "id":"sign","title":"Sign tool","states":[
-        {"name":"Initial","before":"before/sign__initial.png","after":"after/sign__initial.png"},
-        {"name":"Cert selected","before":null,"after":"after/sign__cert.png","note":"New in this PR"}
-      ]}
-    ]
-  }
--->
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<title>Before / After</title>
-<style>
-  :root { --bg:#ffffff; --ink:#0b0c0e; --muted:#6b7280; --line:#e5e7eb;
-          --before:#6b7280; --after:#1f883d; --frame:#f3f4f6; --note:#b45309; }
-  * { box-sizing: border-box; }
-  body { margin:0; background:var(--bg); color:var(--ink);
-         font:14px/1.5 -apple-system,"Segoe UI",Roboto,system-ui,sans-serif; }
-  .wrap { max-width:1100px; margin:0 auto; padding:24px; }
-  .doc-head { margin-bottom:8px; }
-  .doc-head h1 { font-size:18px; margin:0 0 2px; }
-  .doc-head .sub { color:var(--muted); font-size:12.5px; }
-  .legend { display:flex; gap:14px; align-items:center; margin:10px 0 4px; font-size:12px; color:var(--muted); }
-  .chip { font-size:10px; font-weight:700; letter-spacing:.04em; text-transform:uppercase;
-          padding:2px 8px; border-radius:999px; color:#fff; }
-  .chip.before { background:var(--before); } .chip.after { background:var(--after); }
-
-  .tab-section { border:1px solid var(--line); border-radius:14px; padding:18px 18px 8px;
-                 margin:18px 0; background:var(--bg); }
-  .tab-section > h2 { font-size:16px; margin:0 0 2px; }
-  .tab-section > .ctx { color:var(--muted); font-size:12px; margin-bottom:14px; }
-  .state { margin-bottom:18px; }
-  .state .name { font-weight:600; font-size:13.5px; margin-bottom:8px; display:flex; gap:8px; align-items:center; }
-  .state .name .note { font-weight:500; color:var(--note); font-size:12px; }
-  .pair { display:grid; grid-template-columns:1fr 1fr; gap:14px; align-items:start; }
-  .cell { border:1px solid var(--line); border-radius:10px; overflow:hidden; background:var(--frame); }
-  .cell .cap { display:flex; align-items:center; gap:8px; padding:7px 10px; border-bottom:1px solid var(--line);
-               background:var(--bg); }
-  .cell .cap .meta { color:var(--muted); font-size:11px; }
-  .cell img { display:block; width:100%; height:auto; background:#fff; }
-  .cell.empty .ph { display:flex; align-items:center; justify-content:center; height:160px; color:var(--muted);
-                    font-size:12.5px; text-align:center; padding:0 16px; }
-  .single .pair { grid-template-columns:1fr; }
-  .empty-doc { color:var(--muted); padding:40px; text-align:center; }
-  @media (max-width:760px){ .pair{ grid-template-columns:1fr; } }
-</style>
-</head>
-<body>
-<div class="wrap" id="root"></div>
-
-<script id="data">
-window.__BA__ = /*__DATA__*/{"pr":"","title":"No data","base":"","head":"","cropSelector":"","tabs":[]}/*__END__*/;
-</script>
-<script>
-(function(){
-  var D = window.__BA__ || { tabs: [] };
-  var root = document.getElementById("root");
-  function el(html){ var t=document.createElement("template"); t.innerHTML=html.trim(); return t.content.firstChild; }
-  function esc(s){ return (s==null?"":String(s)).replace(/[&<>]/g, function(c){return {"&":"&amp;","<":"&lt;",">":"&gt;"}[c];}); }
-
-  function cell(kind, src){
-    if (src) {
-      return '<div class="cell"><div class="cap"><span class="chip '+kind+'">'+kind+'</span></div>'+
-             '<img src="'+esc(src)+'" alt="'+kind+'"/></div>';
-    }
-    return '<div class="cell empty"><div class="cap"><span class="chip '+kind+'">'+kind+'</span>'+
-           '<span class="meta">not present</span></div><div class="ph">No '+kind+' screenshot for this state</div></div>';
-  }
-
-  var head = '<div class="doc-head"><h1>'+esc(D.title || ("PR #"+D.pr))+'</h1>'+
-    '<div class="sub">Before / after &nbsp;·&nbsp; base <code>'+esc(D.base)+'</code> → head <code>'+esc(D.head)+'</code>'+
-    (D.cropSelector ? ' &nbsp;·&nbsp; cropped to <code>'+esc(D.cropSelector)+'</code>' : '')+'</div></div>'+
-    '<div class="legend"><span class="chip before">Before</span> base branch'+
-    '<span class="chip after">After</span> this PR</div>';
-  root.appendChild(el('<div>'+head+'</div>'));
-
-  if (!D.tabs || !D.tabs.length){ root.appendChild(el('<div class="empty-doc">No tabs captured yet.</div>')); return; }
-
-  D.tabs.forEach(function(tab){
-    var states = (tab.states||[]).map(function(s){
-      var onlyOne = (!s.before || !s.after);
-      return '<div class="state'+(onlyOne?' ':'')+'">'+
-        '<div class="name">'+esc(s.name)+(s.note?'<span class="note">'+esc(s.note)+'</span>':'')+'</div>'+
-        '<div class="pair">'+cell("before", s.before)+cell("after", s.after)+'</div></div>';
-    }).join("");
-    var sec = '<section class="tab-section" id="section-'+esc(tab.id)+'">'+
-      '<h2>'+esc(tab.title)+'</h2>'+
-      (tab.ctx?'<div class="ctx">'+esc(tab.ctx)+'</div>':'')+
-      states+'</section>';
-    root.appendChild(el(sec));
-  });
-})();
-</script>
-</body>
-</html>

.claude/skills/ui-before-after/shoot-sections.mjs

@@ -1,25 +0,0 @@
-// Render each .tab-section of a montage HTML into its own PNG (the PR-ready image).
-// Run from frontend (so @playwright/test resolves):
-//   node <skill>/shoot-sections.mjs <montage.html> <outDir>
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-import { createRequire } from "node:module";
-
-const require = createRequire(path.join(process.cwd(), "noop.js"));
-const { chromium } = require("@playwright/test");
-
-const htmlPath = path.resolve(process.argv[2]);
-const outDir = path.resolve(process.argv[3] || path.dirname(htmlPath));
-
-const browser = await chromium.launch();
-const page = await browser.newPage({ viewport: { width: 1200, height: 1200 }, deviceScaleFactor: 2 });
-await page.goto(pathToFileURL(htmlPath).href, { waitUntil: "load" });
-await page.waitForTimeout(250); // let images/fonts paint
-const ids = await page.$$eval(".tab-section", (els) => els.map((e) => e.id));
-if (!ids.length) { console.error("no .tab-section found"); process.exit(1); }
-for (const id of ids) {
-  const name = id.replace(/^section-/, "");
-  await page.locator("#" + id).screenshot({ path: path.join(outDir, `montage_${name}.png`) });
-  console.log("wrote montage_" + name + ".png");
-}
-await browser.close();

.claude/skills/ui-walkthrough/SKILL.md

@@ -1,120 +0,0 @@
----
-name: ui-walkthrough
-description: >-
-  Full UI investigation of the current branch's feature. Enumerates every view
-  and state (empty, populated, loading, error, each dialog/menu/panel, responsive
-  breakpoints, light + dark + RTL), captures them with the stubbed Playwright
-  harness, assembles a single-image HTML walkthrough with a global light/dark
-  toggle slider, then runs two review passes: visual/consistency (alignment,
-  spacing, professionalism, dark/light parity, contrast, truncation) and
-  UX/ease-of-use (flow, discoverability, affordances, empty/error states,
-  expectations). Use when asked for a UI walkthrough, screenshot review, design
-  or QA pass, "find anywhere to make it easier/better for users", or before
-  merging frontend work. Pass --fix to auto-apply safe frontend fixes and
-  re-capture; --theme to limit themes; --no-rtl to skip RTL.
-argument-hint: "[feature/area] [--fix] [--theme light|dark|both] [--no-rtl] [--breakpoints]"
-allowed-tools: Read, Write, Edit, Glob, Grep, Bash
----
-
-# UI Walkthrough
-
-Produce a reviewable HTML walkthrough of a feature's UI in every state and theme,
-then critique it. Optionally auto-fix and re-capture.
-
-`$ARGUMENTS` may name the feature/area to focus on. If empty, scope from the
-current branch diff. Flags: `--fix`, `--theme light|dark|both` (default both),
-`--no-rtl`, `--breakpoints` (also capture phone/narrow widths).
-
-## What this repo gives you (use it, don't reinvent)
-
-- **Stubbed Playwright project** = backend-free screenshots via `page.route()` mocks.
-  Reference implementation: `frontend/src/editor/core/tests/stubbed/files-page-screenshots.spec.ts`.
-  It already shows the light / **dark** / **RTL** passes, JWT seeding, IndexedDB
-  seeding, and dumping PNGs to a `screenshots/<area>/` folder. Copy its shape.
-- Helpers: `frontend/src/editor/core/tests/helpers/ui-helpers.ts`
-  (`uploadFiles`, `openSettings`, `waitForModalOpen`, `dismissTourTooltip`, …)
-  and the `stub-test-base` fixtures (`autoGoto`, `seedJwt`, `viewport`).
-- Config: `frontend/playwright.config.ts` (run from `frontend/`).
-- Report template: [report-template.html](report-template.html) - self-contained,
-  one big image at a time, a global light/dark slider that flips every shot,
-  thumbnail rail, prev/next + arrow keys, and a Findings tab.
-
-## Process
-
-### 1. Scope the feature
-- If `$ARGUMENTS` is empty: `git diff --name-only main...HEAD` and read the PR/commits.
-  Identify changed pages, tools (`core/components/tools/<tool>` or `core/tools/<tool>`),
-  dialogs, panels, and routes.
-- Enumerate **every view and state** to capture, e.g.:
-  empty / populated / loading / error / disabled; each dialog, menu, popover, tooltip;
-  each tab or step; selection + multi-select; success/result panel; and (if relevant)
-  permission/role variants. Write the list down before capturing - it's the report's spine.
-
-### 2. Prepare the harness (worktree-safe)
-Worktrees have no `node_modules` and no generated icons. From repo root:
-```
-cd frontend && npm ci                       # or junction main's node_modules (see memory)
-cd frontend && node scripts/generate-icons.js
-```
-Kill any stale dev server first (it serves old modules):
-`Get-NetTCPConnection -LocalPort 5173 -State Listen | %{ Stop-Process -Id $_.OwningProcess -Force }`
-
-### 3. Write the capture spec
-Create `frontend/src/editor/core/tests/stubbed/<feature>-walkthrough.spec.ts`,
-modeled on `files-page-screenshots.spec.ts`. For each enumerated view:
-- stub the APIs it needs, drive the UI to that state, wait on a real locator
-  (not a fixed sleep), `await settle(page)` for Mantine portals, then
-  `page.screenshot({ path: shotPath("NN_name_<theme>") })`.
-- Capture each view in **light and dark** (and RTL unless `--no-rtl`). Reuse the
-  `enableDarkMode` / `enableRtl` init-script pattern from the reference spec
-  (`localStorage["mantine-color-scheme"]="dark"` + `emulateMedia({colorScheme:"dark"})`).
-- Name shots `NN_<view>_<theme>.png` so light/dark pair up by suffix.
-- Prefer **stable test-ids** over translated accessible names (RTL/i18n breaks text locators).
-
-Run it: `cd frontend && npx playwright test --project=stubbed <feature>-walkthrough.spec.ts`.
-Add `--project=stubbed-firefox`/`-webkit` only if cross-browser layout matters.
-
-### 4. Build the report
-- Copy `report-template.html` to `screenshots/<feature>/walkthrough.html` (so the
-  relative `screenshots/...` image paths resolve, or rewrite paths to sit beside it).
-- Build the manifest and inject it: replace the JSON between the
-  `/*__DATA__*/` … `/*__END__*/` markers with one `views[]` entry per view
-  (`{id,title,light,dark,viewport,notes}`) and an empty `findings` object you'll
-  fill in step 5. Keep `light`/`dark` as relative paths.
-- The toggle slider answers the "one big image + flip light/dark for all" request:
-  it shows a single large screenshot, and switching the slider re-themes every view.
-
-### 5. Review pass 1 - visual & consistency
-Open each screenshot (Read the PNG) and judge against the others:
-alignment & spacing rhythm, control placement, button hierarchy, typography,
-**light/dark parity** (contrast, invisible borders, washed-out text, wrong tokens),
-truncation/overflow, RTL mirroring, focus states, icon consistency, professional polish.
-Record each issue as a finding `{severity:high|med|low, view, title, detail, fix}`.
-
-### 6. Review pass 2 - UX & ease of use
-Walk the flow as a first-time user: discoverability, number of steps, affordance
-clarity, empty-state guidance, error recovery, destructive-action confirmation,
-defaults, loading feedback, mobile reachability, accessible names, and whether the
-UI matches user expectations for this kind of tool. Record findings the same way.
-
-Write both finding lists into the report's `findings.visual` / `findings.ux`,
-and add short per-view `notes`. Re-inject the manifest.
-
-### 7. If `--fix`
-Only safe, self-contained frontend fixes (spacing, alignment, tokens, missing
-dark-mode colors, labels, aria, obvious copy). For each: edit the component/CSS,
-mark the finding `fixed:true` with what changed, then **re-run the spec** to
-re-capture the affected shots and regenerate the report. Run `task frontend:check`.
-Leave anything risky or ambiguous as a finding, not a change.
-
-### 8. Deliver
-Tell the user the report path and give a tight chat summary: N views ×
-themes captured, top findings by severity, and (if `--fix`) what changed.
-Optionally `SendUserFile` the `walkthrough.html`.
-
-## Gotchas
-- Stale `:5173` server serves old bundles - kill it before capturing (see step 2).
-- Missing `material-symbols-icons.json` → blank app → every shot times out. Run
-  `generate-icons.js` first.
-- `await settle(page)` before shots or portals/transitions tear mid-capture.
-- Don't commit the generated `screenshots/` or the throwaway spec unless asked.

.claude/skills/ui-walkthrough/make_example.py

@@ -1,116 +0,0 @@
-"""Build a self-contained EXAMPLE.html from report-template.html with mock
-light/dark screenshots, so the viewer + global theme slider can be demoed
-without a real capture run. Run: python make_example.py"""
-import base64
-import json
-import pathlib
-import re
-
-HERE = pathlib.Path(__file__).parent
-
-
-def svg(bg, fg, panel, accent, muted, label, kind):
-    """A simple fake 'screen' SVG: title bar, sidebar, content varies by kind."""
-    parts = [
-        f'<svg xmlns="http://www.w3.org/2000/svg" width="1600" height="900" viewBox="0 0 1600 900">',
-        f'<rect width="1600" height="900" fill="{bg}"/>',
-        # top bar
-        f'<rect width="1600" height="64" fill="{panel}"/>',
-        f'<circle cx="40" cy="32" r="12" fill="{accent}"/>',
-        f'<rect x="64" y="24" width="160" height="16" rx="6" fill="{muted}"/>',
-        f'<rect x="1430" y="20" width="130" height="24" rx="12" fill="{accent}"/>',
-        # left sidebar
-        f'<rect x="0" y="64" width="220" height="836" fill="{panel}"/>',
-    ]
-    for i in range(6):
-        y = 100 + i * 56
-        parts.append(f'<rect x="24" y="{y}" width="172" height="32" rx="8" fill="{bg}"/>')
-    if kind == "empty":
-        parts += [
-            f'<rect x="700" y="360" width="200" height="120" rx="16" fill="none" stroke="{muted}" stroke-width="3" stroke-dasharray="10 8"/>',
-            f'<rect x="690" y="510" width="220" height="44" rx="10" fill="{accent}"/>',
-            f'<text x="800" y="600" fill="{muted}" font-family="sans-serif" font-size="26" text-anchor="middle">{label}</text>',
-        ]
-    elif kind == "form":
-        for i in range(4):
-            y = 140 + i * 90
-            parts.append(f'<rect x="280" y="{y}" width="160" height="16" rx="6" fill="{muted}"/>')
-            parts.append(f'<rect x="280" y="{y+26}" width="900" height="44" rx="8" fill="{panel}" stroke="{muted}" stroke-width="1"/>')
-        parts.append(f'<rect x="280" y="560" width="200" height="50" rx="10" fill="{accent}"/>')
-        parts.append(f'<text x="800" y="850" fill="{muted}" font-family="sans-serif" font-size="24" text-anchor="middle">{label}</text>')
-    else:  # dialog
-        parts += [
-            f'<rect width="1600" height="900" fill="{fg}" opacity="0.45"/>',
-            f'<rect x="520" y="280" width="560" height="360" rx="18" fill="{panel}"/>',
-            f'<rect x="556" y="320" width="280" height="22" rx="8" fill="{fg}"/>',
-            f'<rect x="556" y="372" width="488" height="14" rx="6" fill="{muted}"/>',
-            f'<rect x="556" y="398" width="420" height="14" rx="6" fill="{muted}"/>',
-            f'<rect x="820" y="560" width="110" height="44" rx="9" fill="{bg}" stroke="{muted}"/>',
-            f'<rect x="946" y="560" width="98" height="44" rx="9" fill="{accent}"/>',
-            f'<text x="800" y="700" fill="#fff" font-family="sans-serif" font-size="24" text-anchor="middle">{label}</text>',
-        ]
-    parts.append("</svg>")
-    return "".join(parts)
-
-
-def data_uri(s):
-    return "data:image/svg+xml;base64," + base64.b64encode(s.encode()).decode()
-
-
-LIGHT = dict(bg="#ffffff", fg="#111418", panel="#f1f3f6", accent="#2f6fed", muted="#c2c8d0")
-DARK = dict(bg="#16181c", fg="#000000", panel="#1f232a", accent="#5b8cff", muted="#3a414b")
-
-
-def pair(kind, label):
-    return (
-        data_uri(svg(LIGHT["bg"], LIGHT["fg"], LIGHT["panel"], LIGHT["accent"], LIGHT["muted"], label, kind)),
-        data_uri(svg(DARK["bg"], DARK["fg"], DARK["panel"], DARK["accent"], DARK["muted"], label, kind)),
-    )
-
-
-views = []
-for idx, (kind, title, label) in enumerate([
-    ("empty", "Empty state", "Drop a PDF to start"),
-    ("form", "Tool options panel", "Compress options"),
-    ("dialog", "Confirm dialog", "Replace original file?"),
-], start=1):
-    light, dark = pair(kind, label)
-    views.append({
-        "id": f"{idx:02d}_{kind}",
-        "title": title,
-        "light": light,
-        "dark": dark,
-        "viewport": "1600x900",
-        "notes": ["This is mock data to demo the viewer."],
-    })
-
-data = {
-    "feature": "EXAMPLE - Compress PDF (mock data)",
-    "branch": "demo",
-    "generated": "example",
-    "views": views,
-    "findings": {
-        "visual": [
-            {"severity": "high", "view": "03_dialog", "title": "Dialog buttons too close",
-             "detail": "Cancel/Confirm have only 8px gap; easy to misclick.",
-             "fix": "Increase gap to var(--mantine-spacing-md)."},
-            {"severity": "low", "view": "02_form", "title": "Field labels low contrast in dark mode",
-             "detail": "Muted token fails WCAG AA on the dark panel.",
-             "fix": "Use --mantine-color-dimmed instead of a hard-coded grey."},
-        ],
-        "ux": [
-            {"severity": "med", "view": "01_empty", "title": "Primary CTA below the dropzone",
-             "detail": "Users expect the action button adjacent to the dropzone.",
-             "fix": "Move the button directly under the dashed zone."},
-        ],
-    },
-}
-
-tpl = (HERE / "report-template.html").read_text(encoding="utf-8")
-out = re.sub(
-    r"/\*__DATA__\*/.*?/\*__END__\*/",
-    lambda _m: "/*__DATA__*/" + json.dumps(data) + "/*__END__*/",
-    tpl, count=1, flags=re.S,
-)
-(HERE / "EXAMPLE.html").write_text(out, encoding="utf-8")
-print("wrote", (HERE / "EXAMPLE.html"))

.claude/skills/ui-walkthrough/report-template.html

@@ -1,298 +0,0 @@
-<!doctype html>
-<!--
-  UI Walkthrough report template (self-contained, works from file://).
-  The ui-walkthrough skill replaces the JSON in the window.__WALKTHROUGH__ data
-  block below with the captured manifest. Do not add external CDN deps - it must open offline.
-
-  Data shape:
-  {
-    "feature": "Compress PDF tool",
-    "branch": "claude/...",
-    "generated": "2026-06-21",
-    "views": [
-      { "id": "01_empty", "title": "Empty state",
-        "light": "screenshots/compress/01_empty_light.png",
-        "dark":  "screenshots/compress/01_empty_dark.png",
-        "viewport": "1600x900",
-        "notes": ["Heading is centered", "Primary CTA below the fold on mobile"] }
-    ],
-    "findings": {
-      "visual": [ { "severity":"high", "view":"01_empty", "title":"...", "detail":"...", "fix":"..." } ],
-      "ux":     [ { "severity":"med",  "view":"03_dialog", "title":"...", "detail":"...", "fix":"..." } ]
-    }
-  }
--->
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>UI Walkthrough</title>
-<style>
-  :root {
-    --bg: #f6f7f9; --panel: #ffffff; --panel-2: #f0f2f5; --text: #1a1b1e;
-    --muted: #6b7280; --border: #e2e5ea; --accent: #2f6fed; --accent-weak: #e8f0fe;
-    --shadow: 0 1px 3px rgba(0,0,0,.08), 0 8px 24px rgba(0,0,0,.06);
-    --hi: #d92d20; --med: #d98e00; --low: #2f6fed; --stage: #0b0c0e;
-  }
-  html[data-theme="dark"] {
-    --bg: #0d0e10; --panel: #16181c; --panel-2: #1d2024; --text: #e6e8eb;
-    --muted: #9aa3ad; --border: #2a2e35; --accent: #5b8cff; --accent-weak: #1a2336;
-    --shadow: 0 1px 3px rgba(0,0,0,.5), 0 8px 24px rgba(0,0,0,.4); --stage: #000;
-  }
-  * { box-sizing: border-box; }
-  body { margin: 0; font: 14px/1.5 -apple-system, "Segoe UI", Roboto, system-ui, sans-serif;
-         background: var(--bg); color: var(--text); }
-  header { display: flex; align-items: center; gap: 16px; padding: 12px 20px;
-           background: var(--panel); border-bottom: 1px solid var(--border); position: sticky; top: 0; z-index: 5; }
-  header h1 { font-size: 15px; margin: 0; font-weight: 650; }
-  header .sub { color: var(--muted); font-size: 12px; }
-  .spacer { flex: 1; }
-  .counter { color: var(--muted); font-variant-numeric: tabular-nums; font-size: 13px; }
-  .tabs { display: flex; gap: 4px; }
-  .tab { border: 1px solid var(--border); background: var(--panel-2); color: var(--text);
-         padding: 6px 12px; border-radius: 8px; cursor: pointer; font-size: 13px; }
-  .tab.active { background: var(--accent); color: #fff; border-color: var(--accent); }
-
-  /* Light/Dark slider */
-  .theme-toggle { display: flex; align-items: center; gap: 9px; user-select: none; }
-  .theme-toggle .lbl { font-size: 12px; color: var(--muted); }
-  .theme-toggle .lbl.on { color: var(--text); font-weight: 600; }
-  .switch { position: relative; width: 52px; height: 28px; }
-  .switch input { opacity: 0; width: 0; height: 0; }
-  .slider { position: absolute; inset: 0; cursor: pointer; background: var(--panel-2);
-            border: 1px solid var(--border); border-radius: 999px; transition: .2s; }
-  .slider:before { content: ""; position: absolute; height: 20px; width: 20px; left: 3px; top: 3px;
-                   background: #fbbf24; border-radius: 50%; transition: .2s; box-shadow: 0 1px 2px rgba(0,0,0,.3); }
-  .switch input:checked + .slider { background: var(--accent); }
-  .switch input:checked + .slider:before { transform: translateX(24px); background: #c7d2fe; }
-
-  main { display: grid; grid-template-columns: 240px 1fr; height: calc(100vh - 53px); }
-  .rail { border-right: 1px solid var(--border); overflow-y: auto; background: var(--panel); padding: 8px; }
-  .rail .group-label { font-size: 11px; text-transform: uppercase; letter-spacing: .05em;
-                       color: var(--muted); padding: 10px 8px 4px; }
-  .thumb { display: flex; gap: 9px; align-items: center; padding: 7px; border-radius: 8px;
-           cursor: pointer; border: 1px solid transparent; }
-  .thumb:hover { background: var(--panel-2); }
-  .thumb.active { background: var(--accent-weak); border-color: var(--accent); }
-  .thumb img { width: 64px; height: 40px; object-fit: cover; border-radius: 4px; border: 1px solid var(--border); background: var(--stage); }
-  .thumb .t { font-size: 12.5px; line-height: 1.3; }
-  .thumb .badge { font-size: 10px; color: var(--muted); }
-  .thumb .dot { width: 7px; height: 7px; border-radius: 50%; margin-left: auto; flex: none; }
-
-  .stagewrap { display: flex; flex-direction: column; min-width: 0; }
-  .stage { flex: 1; display: flex; align-items: center; justify-content: center; padding: 22px;
-           background: var(--stage); position: relative; min-height: 0; }
-  .stage img { max-width: 100%; max-height: 100%; object-fit: contain; border-radius: 8px;
-               box-shadow: 0 4px 30px rgba(0,0,0,.4); background: #fff; }
-  html[data-theme="dark"] .stage img { background: #16181c; }
-  .nav-btn { position: absolute; top: 50%; transform: translateY(-50%); width: 42px; height: 42px;
-             border-radius: 50%; border: 1px solid var(--border); background: var(--panel);
-             color: var(--text); cursor: pointer; font-size: 18px; opacity: .85; }
-  .nav-btn:hover { opacity: 1; } .nav-btn.prev { left: 16px; } .nav-btn.next { right: 16px; }
-  .nav-btn:disabled { opacity: .25; cursor: default; }
-  .missing { color: var(--muted); font-size: 13px; text-align: center; }
-
-  .detail { border-top: 1px solid var(--border); background: var(--panel); padding: 14px 20px;
-            max-height: 38vh; overflow-y: auto; }
-  .detail h2 { margin: 0 0 4px; font-size: 15px; }
-  .detail .meta { color: var(--muted); font-size: 12px; margin-bottom: 10px; }
-  .notes { list-style: none; padding: 0; margin: 0; display: grid; gap: 6px; }
-  .notes li { display: flex; gap: 8px; align-items: flex-start; }
-  .sev { font-size: 10px; font-weight: 700; text-transform: uppercase; padding: 2px 7px; border-radius: 999px;
-         color: #fff; flex: none; margin-top: 1px; }
-  .sev.high { background: var(--hi); } .sev.med { background: var(--med); } .sev.low { background: var(--low); }
-  .finding .fix { color: var(--muted); font-size: 12.5px; }
-  .finding .fix b { color: var(--text); font-weight: 600; }
-
-  /* Summary tab */
-  .summary { padding: 20px 28px; overflow-y: auto; }
-  .summary h2 { font-size: 16px; margin: 22px 0 8px; }
-  .summary .empty { color: var(--muted); }
-  .card { background: var(--panel); border: 1px solid var(--border); border-radius: 10px;
-          padding: 12px 14px; margin-bottom: 8px; box-shadow: var(--shadow); }
-  .card .head { display: flex; gap: 8px; align-items: center; }
-  .card a { color: var(--accent); text-decoration: none; cursor: pointer; }
-  .hide { display: none !important; }
-  kbd { font: 11px ui-monospace, monospace; background: var(--panel-2); border: 1px solid var(--border);
-        border-radius: 4px; padding: 1px 5px; }
-</style>
-</head>
-<body>
-<header>
-  <div>
-    <h1 id="feature-title">UI Walkthrough</h1>
-    <div class="sub" id="feature-sub"></div>
-  </div>
-  <div class="spacer"></div>
-  <div class="tabs">
-    <button class="tab active" data-tab="viewer">Walkthrough</button>
-    <button class="tab" data-tab="summary">Findings</button>
-  </div>
-  <div class="counter" id="counter"></div>
-  <label class="theme-toggle" title="Toggle light / dark for every screenshot">
-    <span class="lbl" id="lbl-light">Light</span>
-    <span class="switch"><input type="checkbox" id="theme-switch" /><span class="slider"></span></span>
-    <span class="lbl" id="lbl-dark">Dark</span>
-  </label>
-</header>
-
-<main id="viewer-pane">
-  <aside class="rail" id="rail"></aside>
-  <section class="stagewrap">
-    <div class="stage">
-      <button class="nav-btn prev" id="prev" aria-label="Previous">&#8249;</button>
-      <img id="stage-img" alt="" />
-      <div class="missing hide" id="missing"></div>
-      <button class="nav-btn next" id="next" aria-label="Next">&#8250;</button>
-    </div>
-    <div class="detail">
-      <h2 id="view-title"></h2>
-      <div class="meta" id="view-meta"></div>
-      <ul class="notes" id="view-notes"></ul>
-    </div>
-  </section>
-</main>
-
-<section class="summary hide" id="summary-pane"></section>
-
-<script id="data">
-window.__WALKTHROUGH__ = /*__DATA__*/{"feature":"No data","branch":"","generated":"","views":[],"findings":{"visual":[],"ux":[]}}/*__END__*/;
-</script>
-<script>
-(function () {
-  var D = window.__WALKTHROUGH__ || { views: [], findings: { visual: [], ux: [] } };
-  var views = D.views || [];
-  var state = { i: 0, theme: localStorage.getItem("ui-wt-theme") || "light", tab: "viewer" };
-
-  var $ = function (id) { return document.getElementById(id); };
-  function sevClass(s) { return s === "high" ? "high" : s === "med" || s === "medium" ? "med" : "low"; }
-
-  function applyChrome() {
-    document.documentElement.setAttribute("data-theme", state.theme);
-    $("theme-switch").checked = state.theme === "dark";
-    $("lbl-light").classList.toggle("on", state.theme === "light");
-    $("lbl-dark").classList.toggle("on", state.theme === "dark");
-  }
-
-  function srcFor(v) { return state.theme === "dark" ? (v.dark || v.light) : (v.light || v.dark); }
-
-  function findingsForView(id) {
-    var all = (D.findings && D.findings.visual || []).concat(D.findings && D.findings.ux || []);
-    return all.filter(function (f) { return f.view === id; });
-  }
-
-  function renderRail() {
-    var rail = $("rail");
-    rail.innerHTML = "";
-    if (!views.length) { rail.innerHTML = '<div class="group-label">No views captured</div>'; return; }
-    views.forEach(function (v, idx) {
-      var fs = findingsForView(v.id);
-      var worst = fs.some(function (f){return sevClass(f.severity)==="high";}) ? "var(--hi)"
-                : fs.some(function (f){return sevClass(f.severity)==="med";}) ? "var(--med)"
-                : fs.length ? "var(--low)" : "transparent";
-      var el = document.createElement("div");
-      el.className = "thumb" + (idx === state.i ? " active" : "");
-      el.innerHTML = '<img src="' + srcFor(v) + '" alt="" />' +
-        '<div><div class="t">' + (v.title || v.id) + '</div>' +
-        '<div class="badge">' + (v.viewport || "") + '</div></div>' +
-        '<span class="dot" style="background:' + worst + '"></span>';
-      el.onclick = function () { state.i = idx; render(); };
-      rail.appendChild(el);
-    });
-  }
-
-  function render() {
-    applyChrome();
-    if (!views.length) {
-      $("missing").classList.remove("hide"); $("stage-img").classList.add("hide");
-      $("missing").textContent = "No screenshots in this report yet.";
-      $("counter").textContent = ""; return;
-    }
-    var v = views[state.i];
-    var src = srcFor(v);
-    var img = $("stage-img");
-    if (src) {
-      img.classList.remove("hide"); $("missing").classList.add("hide");
-      img.src = src; img.alt = v.title || v.id;
-    } else {
-      img.classList.add("hide"); $("missing").classList.remove("hide");
-      $("missing").textContent = "No " + state.theme + " screenshot for this view.";
-    }
-    $("counter").textContent = (state.i + 1) + " / " + views.length;
-    $("view-title").textContent = v.title || v.id;
-    $("view-meta").textContent = [v.viewport, state.theme + " mode"].filter(Boolean).join("  ·  ");
-    var notes = $("view-notes"); notes.innerHTML = "";
-    var fs = findingsForView(v.id);
-    (v.notes || []).forEach(function (n) {
-      var li = document.createElement("li"); li.textContent = "· " + n; notes.appendChild(li);
-    });
-    fs.forEach(function (f) {
-      var li = document.createElement("li"); li.className = "finding";
-      li.innerHTML = '<span class="sev ' + sevClass(f.severity) + '">' + (f.severity || "note") + '</span>' +
-        '<span><b>' + (f.title || "") + '</b> — ' + (f.detail || "") +
-        (f.fix ? ' <span class="fix"><b>Fix:</b> ' + f.fix + '</span>' : '') + '</span>';
-      notes.appendChild(li);
-    });
-    $("prev").disabled = state.i === 0;
-    $("next").disabled = state.i === views.length - 1;
-    renderRail();
-  }
-
-  function renderSummary() {
-    var pane = $("summary-pane");
-    function block(title, arr) {
-      var h = '<h2>' + title + ' (' + arr.length + ')</h2>';
-      if (!arr.length) return h + '<div class="empty">None found.</div>';
-      return h + arr.map(function (f) {
-        return '<div class="card"><div class="head">' +
-          '<span class="sev ' + sevClass(f.severity) + '">' + (f.severity || "note") + '</span>' +
-          '<b>' + (f.title || "") + '</b>' +
-          (f.view ? ' <a data-jump="' + f.view + '">' + f.view + '</a>' : '') + '</div>' +
-          '<div style="margin-top:6px">' + (f.detail || "") + '</div>' +
-          (f.fix ? '<div class="finding" style="margin-top:6px"><span class="fix"><b>Fix:</b> ' + f.fix + '</span></div>' : '') +
-          '</div>';
-      }).join("");
-    }
-    pane.innerHTML = block("Visual & consistency", (D.findings && D.findings.visual) || []) +
-                     block("UX & ease of use", (D.findings && D.findings.ux) || []);
-    pane.querySelectorAll("[data-jump]").forEach(function (a) {
-      a.onclick = function () {
-        var id = a.getAttribute("data-jump");
-        var idx = views.findIndex(function (v) { return v.id === id; });
-        if (idx >= 0) { state.i = idx; setTab("viewer"); }
-      };
-    });
-  }
-
-  function setTab(t) {
-    state.tab = t;
-    document.querySelectorAll(".tab").forEach(function (b) { b.classList.toggle("active", b.dataset.tab === t); });
-    $("viewer-pane").classList.toggle("hide", t !== "viewer");
-    $("summary-pane").classList.toggle("hide", t !== "summary");
-    if (t === "viewer") $("viewer-pane").style.display = "grid";
-    if (t === "summary") renderSummary();
-  }
-
-  // wiring
-  $("feature-title").textContent = D.feature || "UI Walkthrough";
-  $("feature-sub").textContent = [D.branch, D.generated].filter(Boolean).join("  ·  ");
-  $("theme-switch").onchange = function () {
-    state.theme = this.checked ? "dark" : "light";
-    localStorage.setItem("ui-wt-theme", state.theme);
-    render();
-  };
-  $("prev").onclick = function () { if (state.i > 0) { state.i--; render(); } };
-  $("next").onclick = function () { if (state.i < views.length - 1) { state.i++; render(); } };
-  document.addEventListener("keydown", function (e) {
-    if (state.tab !== "viewer") return;
-    if (e.key === "ArrowLeft") $("prev").click();
-    if (e.key === "ArrowRight") $("next").click();
-    if (e.key.toLowerCase() === "t") $("theme-switch").click();
-  });
-  document.querySelectorAll(".tab").forEach(function (b) { b.onclick = function () { setTab(b.dataset.tab); }; });
-
-  render();
-})();
-</script>
-</body>
-</html>

.devcontainer/init-setup.sh

@@ -20,8 +20,8 @@ set -e
 # - To build the project, use:
 #     ./gradlew build
 #
-# - To run the lint/format/secret checks, use:
-#     task pre-commit
+# - For running pre-commit hooks (if configured), use:
+#     pre-commit run --all-files
 #
 # Make sure you are in the project root directory after this script executes.
 # =============================================================================
@@ -70,6 +70,6 @@ echo ""
 echo "  To build the project: "
 echo -e "\e[34m    gradle build\e[0m"
 echo ""
-echo "  To run the lint/format/secret checks:"
-echo -e "\e[34m    task pre-commit\e[0m"
+echo "  To run pre-commit hooks (if configured):"
+echo -e "\e[34m    pre-commit run --all-files -c .pre-commit-config.yaml\e[0m"
 echo "=================================================================="

.dockerignore

@@ -1,110 +1,75 @@
-# Version control
-.git/
+# Node modules and build artifacts
+node_modules
+frontend/node_modules
+frontend/dist
+frontend/build
+frontend/.vite
+frontend/.tauri
+frontend/src-tauri/target
+
+# Gradle build artifacts
+.gradle
+build
+bin
+target
+out
+
+# Git
+.git
 .gitignore
-.git-blame-ignore-revs
-.gitattributes
 
-# Build outputs
-build/
-*/build/
-**/build/
-out/
-target/
-**/target/
-bin/
-version_builds/
-
-# Gradle caches (local, not what's in the container)
-.gradle/
-**/.gradle/
-.gradle-home/
-
-# Task (go-task) cache
-.task/
-
-# Node / frontend
-node_modules/
-**/node_modules/
-frontend/node_modules/
-frontend/dist/
-frontend/playwright-report/
-.npm/
-.yarn/
-
-# Tauri/desktop builds
-src-tauri/target/
-src-tauri/dist/
-frontend/src-tauri/target/
-frontend/src-tauri/dist/
-
-# IDE and editor
-.idea/
-.vscode/
-.settings/
-.settings.zip
-.classpath
-.project
-.devcontainer/
+# IDE
+.vscode
+.idea
 *.iml
-*.ipr
 *.iws
+*.ipr
 
-# Logs and temp files
+# Logs
 *.log
-*.tmp
-*.pid
-.DS_Store
-Thumbs.db
-logs/
+logs
 
-# Docker itself
-Dockerfile*
-.dockerignore
-
-# CI / CD configs (not needed in build context)
-.github/
-.circleci/
-.gitlab-ci.yml
-
-# Test reports
-**/test-results/
-**/jacoco/
-test_*.pdf
-
-# Testing and documentation (not needed in build)
-testing/
-docs/
-devGuide/
-devTools/
-*.md
-README*
-
-# Separate projects not consumed by the Java/frontend build
-commonforms-onnx/
-
-# Runtime mount points used by docker-compose volumes, not build input
-stirling/
-customFiles/
-configs/
-
-# Claude Code workspace
-.claude/
-
-# Python caches
-.pytest_cache/
-.ruff_cache/
-__pycache__/
-**/__pycache__/
-
-# Local env
+# Environment files
 .env
 .env.*
 !.env.example
-!engine/.env
 
-# Misc
-*.swp
-*.swo
-*~
+# OS files
 .DS_Store
-.cache/
+Thumbs.db
+
+# Java compiled files
+*.class
+*.jar
+*.war
+*.ear
+
+# Test reports
+test-results
+coverage
+
+# Docker
+docker-compose.override.yml
+.dockerignore
+
+# Temporary files
+tmp
+temp
+*.tmp
+*.swp
+*~
+
+# Runtime database and config files (locked by running app)
+app/core/configs/**
+stirling/**
+stirling-pdf-DB*.mv.db
+stirling-pdf-DB*.trace.db
+
+# Documentation
+*.md
+!README.md
+docs
+
+# CI/CD
+.github
+.gitlab-ci.yml

.editorconfig

@@ -14,8 +14,7 @@ indent_size = 4
 max_line_length = 100
 
 [*.py]
-indent_size = 4
-max_line_length = 120
+indent_size = 2
 
 [*.gradle]
 indent_size = 4

.github/CODEOWNERS

@@ -2,17 +2,20 @@
 * @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
 
 # Backend
-/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh
+
+#V1 frontend
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/app/core/src/main/resources/templates/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
 
 #V2 frontend
-/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
-/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle
 
 #V2 docker
-/docker/backend/** @Frooodle @Ludy87 @DarioGii
+/docker/backend/** @Frooodle @Ludy87 @DarioGii @Ludy87
 /docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
 /docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87
 
 
 #GHA (All users)
-/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87

.github/actions/setup-bot/action.yml

@@ -22,9 +22,9 @@ runs:
   steps:
     - name: Generate a GitHub App Token
       id: generate-token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
       with:
-        client-id: ${{ inputs.app-id }}
+        app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
     - name: Configure Git
       run: |

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,29 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-desktop
-pkgver=2.14.2
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
-arch=('x86_64')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
-provides=('stirling-pdf')
-conflicts=('stirling-pdf' 'stirling-pdf-git' 'stirling-pdf-bin')
-options=('!strip')
-
-source_x86_64=("${pkgname}-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")
-sha256sums_x86_64=('PLACEHOLDER_DEB_SHA256')
-
-package() {
-    # Extract the .deb archive
-    bsdtar -xf data.tar* -C "${pkgdir}"
-
-    # Fix permissions
-    find "${pkgdir}" -type d -exec chmod 755 {} \;
-
-    # Install license
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<EOF
-Copyright (c) 2025 Stirling PDF Inc
-All rights reserved. See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,77 +0,0 @@
-# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-server-bin
-pkgver=2.14.2
-pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
-arch=('any')
-url="https://www.stirling.com"
-license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('java-runtime>=25')
-provides=('stirling-pdf-server')
-conflicts=('stirling-pdf-server' 'stirling-pdf-server-git')
-backup=('etc/stirling-pdf-server/settings.yml')
-
-source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar")
-sha256sums=('PLACEHOLDER_JAR_SHA256')
-
-package() {
-    # JAR
-    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
-        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
-
-    # Wrapper script
-    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
-#!/bin/sh
-exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
-EOF
-
-    # systemd unit
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service" << 'EOF'
-[Unit]
-Description=Stirling-PDF Server
-After=network.target
-
-[Service]
-Type=simple
-User=stirling-pdf
-Group=stirling-pdf
-WorkingDirectory=/var/lib/stirling-pdf-server
-ExecStart=/usr/bin/java -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar
-Restart=on-failure
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=stirling-pdf-server
-Environment=JAVA_OPTS=-Xmx512m
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-    # sysusers
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf" << 'EOF'
-u stirling-pdf - "Stirling-PDF Server" /var/lib/stirling-pdf-server -
-EOF
-
-    # tmpfiles
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf" << 'EOF'
-d /var/lib/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-d /var/log/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
-EOF
-
-    # Default config stub
-    install -dm755 "${pkgdir}/etc/stirling-pdf-server"
-    install -Dm644 /dev/stdin "${pkgdir}/etc/stirling-pdf-server/settings.yml" << 'EOF'
-# Stirling-PDF Server configuration
-# See https://github.com/Stirling-Tools/Stirling-PDF for all options
-server:
-  port: 8080
-EOF
-
-    # License
-    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
-MIT License with proprietary carve-outs (open-core).
-SPDX: MIT AND LicenseRef-Stirling-PDF-Proprietary
-See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
-EOF
-}

.github/config/.files.yaml

@@ -1,54 +1,32 @@
-# CI routing infra. Editing the top-level router (build.yml) or this filter
-# config re-runs every area's jobs, so every job-gating filter below includes
-# *ci. That makes a change to how jobs are dispatched actually exercise those
-# jobs (self-testing), instead of a router edit only matching the project filter.
-ci: &ci
-  - .github/workflows/build.yml
-  - .github/config/.files.yaml
-
 build: &build
-  - *ci
   - build.gradle
-  - gradle/spotless.gradle
-  - app/(common|core|proprietary|saas)/build.gradle
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .github/workflows/check-licence.yml
+  - app/(common|core|proprietary)/build.gradle
+
+app: &app
+  - app/(common|core|proprietary)/src/main/java/**
 
 openapi: &openapi
-  - *ci
   - *build
-  - app/(common|core|proprietary|saas)/src/main/java/**
-  - .github/workflows/check-openapi.yml
-
-docker-base: &docker-base
-  - docker/base/Dockerfile
-
-# Dockerfiles only (base + embedded + unoserver). Gates the slow multi-arch
-# (arm64) leg of the PR docker test build: arm64 is only rebuilt when a
-# Dockerfile itself changes, not on every code PR.
-dockerfiles: &dockerfiles
-  - docker/**/Dockerfile*
+  - *app
 
 docker: &docker
-  - docker/embedded/Dockerfile
-  - docker/embedded/Dockerfile.fat
-  - docker/embedded/Dockerfile.ultra-lite
+  - Dockerfile
+  - Dockerfile.fat
+  - Dockerfile.ultra-lite
   - ".github/workflows/build.yml"
-  - ".github/workflows/push-docker.yml"
   - scripts/init.sh
   - scripts/init-without-ocr.sh
   - exampleYmlFiles/**
-  - *docker-base
 
 project: &project
-  - *ci
-  - app/(common|core|proprietary|saas)/src/(main|test)/java/**
+  - app/(common|core|proprietary)/src/(main|test)/java/**
   - *build
-  - "app/(common|core|proprietary|saas)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
+  - "app/(common|core|proprietary)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
   - exampleYmlFiles/**
+  - gradle/**
+  - libs/**
+  - "testing/**/!(requirements*.txt|requirements*.in)*"
   - *docker
-  - *docker-base
   - gradle.properties
   - gradlew
   - gradlew.bat
@@ -56,108 +34,9 @@ project: &project
   - settings.gradle
   - frontend/**
   - docker/**
-  - scripts/RestartHelper.java
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .taskfiles/docker.yml
-  - scripts/db-migration/**
-  - .github/workflows/db-migration-test.yml
-  - .github/workflows/docker-compose-tests.yml
-  - .github/workflows/test-build-docker.yml
 
 frontend: &frontend
-  - *ci
   - frontend/**
   - .github/workflows/testdriver.yml
   - testing/**
   - docker/**
-  - scripts/translations/*.py
-  - .taskfiles/desktop.yml
-  - scripts/convert_cff_to_ttf.py
-  - scripts/harvest_type3_fonts.py
-  - scripts/ignore_translation.toml
-  - scripts/index_type3_catalogue.py
-  - scripts/summarize_type3_signatures.py
-  - scripts/type3_to_cff.py
-  - scripts/update_type3_library.py
-  - Taskfile.yml
-  - .taskfiles/frontend.yml
-  - .taskfiles/e2e.yml
-  - .github/workflows/frontend-validation.yml
-  - .github/workflows/frontend-a11y.yml
-  - .github/workflows/e2e-stubbed.yml
-  - .github/workflows/e2e-live.yml
-
-# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
-# job on changes to any of these.
-tauri: &tauri
-  - *ci
-  - frontend/src-tauri/**
-  - frontend/src/editor/desktop/**
-  - frontend/tsconfig.desktop.vite.json
-  - frontend/package.json
-  - frontend/package-lock.json
-  - frontend/vite.config.ts
-  - .github/workflows/tauri-build.yml
-  - Taskfile.yml
-  - .taskfiles/desktop.yml
-
-# Files that affect the AI engine (Python tool models, fixers, tests). Gate
-# the engine validation job on changes to engine sources or to the Java
-# tool surfaces it generates models from.
-engine: &engine
-  - *ci
-  - engine/**
-  - app/(common|core|proprietary|saas)/src/main/java/**
-  - .github/workflows/ai-engine.yml
-  - Taskfile.yml
-  - .taskfiles/engine.yml
-
-# Files that can make the committed generated API models (frontend tool API
-# types + engine tool models) go stale: the Java tool surfaces they derive from,
-# the generators, the generated files themselves (to catch a hand-edit), and the
-# tasks that drive generation. Deliberately excludes the broad frontend/docker/
-# testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
-generated-models: &generated-models
-  - *ci
-  - *openapi
-  - frontend/scripts/generate-tool-api-types.mts
-  - frontend/src/editor/core/types/toolApiTypes.ts
-  - frontend/src/editor/core/types/toolIO.ts
-  - engine/scripts/generate_tool_models.py
-  - engine/src/stirling/models/tool_models.py
-  - engine/src/stirling/models/tool_io.py
-  - .taskfiles/frontend.yml
-  - .taskfiles/engine.yml
-  - .github/workflows/check-generated-models.yml
-
-licenses-frontend: &licenses-frontend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - "frontend/package.json"
-  - "frontend/package-lock.json"
-  - "frontend/scripts/generate-licenses.js"
-
-licenses-backend: &licenses-backend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - *build
-
-# Files that can affect premium / enterprise behaviour. Gate the enterprise
-# Playwright job on changes to any of these on PRs.
-proprietary: &proprietary
-  - *ci
-  - app/proprietary/**
-  - frontend/src/editor/proprietary/**
-  - frontend/src/editor/core/tests/enterprise/**
-  - testing/compose/docker-compose-keycloak-oauth.yml
-  - testing/compose/docker-compose-keycloak-saml.yml
-  - testing/compose/keycloak-realm-oauth.json
-  - testing/compose/keycloak-realm-saml.json
-  - testing/compose/start-oauth-test.sh
-  - testing/compose/start-saml-test.sh
-  - testing/compose/validate-oauth-test.sh
-  - testing/compose/validate-saml-test.sh
-  - configs/settings.yml.template
-  - build.gradle
-  - app/proprietary/build.gradle
-  - gradle/spotless.gradle
-  - .github/workflows/build-enterprise.yml

.github/config/repo_devs.json

@@ -13,8 +13,6 @@
     "reecebrowne",
     "DarioGii",
     "ConnorYoh",
-    "EthanHealy01",
-    "jbrunton96",
-    "balazs-szucs"
+    "EthanHealy01"
   ]
 }

.github/dependabot.yml

@@ -6,159 +6,18 @@
 version: 2
 updates:
   - package-ecosystem: "gradle" # See documentation for possible values
-    directories:
-      - "/" # Location of package manifests
-      - "/app/common"
-      - "/app/core"
-      - "/app/proprietary"
+    directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
+    open-pull-requests-limit: 10
     rebase-strategy: "auto"
 
   - package-ecosystem: "docker"
-    directories:
-      - "/" # Location of Dockerfile
-      - "/docker/backend"
-      - "/docker/embedded"
-      - "/docker/frontend"
-      - "/docker/base"
-      - "/docker/engine"
-      - "/docker/unoserver"
-      - "/engine"
+    directory: "/" # Location of Dockerfile
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directories:
-      - /devTools
-      - /frontend
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
-    groups:
-      embedpdf:
-        patterns:
-          - "@embedpdf/*"
-      mantine:
-        patterns:
-          - "@mantine/*"
-          - "postcss-preset-mantine"
-      mui:
-        patterns:
-          - "@mui/*"
-      tauri-js:
-        patterns:
-          - "@tauri-apps/*"
-      emotion:
-        patterns:
-          - "@emotion/*"
-      react:
-        patterns:
-          - "react"
-          - "react-dom"
-          - "@types/react"
-          - "@types/react-dom"
-      typescript-eslint:
-        patterns:
-          - "@typescript-eslint/*"
-          - "typescript-eslint"
-      eslint:
-        patterns:
-          - "eslint"
-          - "@eslint/*"
-      vite:
-        patterns:
-          - "vite"
-          - "vite-*"
-          - "@vitejs/*"
-      vitest:
-        patterns:
-          - "vitest"
-          - "@vitest/*"
-      testing-library:
-        patterns:
-          - "@testing-library/*"
-      i18next:
-        patterns:
-          - "i18next"
-          - "i18next-*"
-          - "react-i18next"
-      iconify:
-        patterns:
-          - "@iconify/*"
-          - "@iconify-json/*"
-      stripe:
-        patterns:
-          - "@stripe/*"
-      posthog:
-        patterns:
-          - "@posthog/*"
-          - "posthog-js"
-      supabase:
-        patterns:
-          - "@supabase/*"
-      dnd-kit:
-        patterns:
-          - "@dnd-kit/*"
-      tailwind:
-        patterns:
-          - "tailwindcss"
-          - "@tailwindcss/*"
-      postcss:
-        patterns:
-          - "postcss"
-          - "postcss-*"
-        exclude-patterns:
-          - "postcss-preset-mantine"
-
-  - package-ecosystem: cargo
-    directories:
-      - /frontend/src-tauri
-      - /frontend/src-tauri/thumbnail-handler
-      - /frontend/src-tauri/provisioner
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"
-    groups:
-      tauri:
-        patterns:
-          - "tauri"
-          - "tauri-build"
-          - "tauri-plugin-*"
-      serde:
-        patterns:
-          - "serde"
-          - "serde_*"
-      tracing:
-        patterns:
-          - "tracing"
-          - "tracing-*"
-      tokio:
-        patterns:
-          - "tokio"
-          - "tokio-*"
-
-  - package-ecosystem: pip
-    directory: /testing/cucumber
-    schedule:
-      interval: "weekly"
-    cooldown:
-      default-days: 7
-    rebase-strategy: "auto"

.github/labeler-config-srvaroa.yml

@@ -46,45 +46,32 @@ labels:
   - label: 'API'
     title: '.*openapi.*|.*swagger.*|.*api.*'
 
-  - label: 'v3'
-    base-branch: 'V3'
+  - label: 'v2'
+    base-branch: 'V2'
 
   - label: 'Translation'
     files:
-      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}.properties'
       - 'scripts/ignore_translation.toml'
-      - 'scripts/remove_translation_keys.sh'
-      - 'scripts/replace_translation_line.sh'
-      - 'scripts/translations/.*'
-      - '.github/scripts/check_language_toml.py'
-      - 'scripts/counter_translation_v3.py'
+      - 'app/core/src/main/resources/templates/fragments/languages.html'
+      - '.github/scripts/check_language_properties.py'
 
   - label: 'Front End'
     files:
+      - 'app/core/src/main/resources/templates/.*'
+      - 'app/proprietary/src/main/resources/templates/.*'
       - 'app/core/src/main/resources/static/.*'
       - 'app/proprietary/src/main/resources/static/.*'
-      - 'app/saas/src/main/resources/static/.*'
+      - 'app/core/src/main/java/stirling/software/SPDF/controller/web/.*'
+      - 'app/core/src/main/java/stirling/software/SPDF/UI/.*'
+      - 'app/proprietary/src/main/java/stirling/software/proprietary/security/controller/web/.*'
       - 'frontend/**'
-      - 'frontend/.*'
-      - 'frontend/**/.*'
-
-  - label: 'Tauri'
-    files:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src-tauri/.*'
-
-  - label: 'engine'
-    files:
-      - 'engine/**'
-      - 'engine/.*'
-      - 'engine/**/.*'
 
   - label: 'Java'
     files:
       - 'app/common/src/main/java/.*.java'
       - 'app/proprietary/src/main/java/.*.java'
       - 'app/core/src/main/java/.*.java'
-      - 'app/saas/src/main/java/.*.java'
 
   - label: 'Back End'
     files:
@@ -92,9 +79,6 @@ labels:
       - 'app/core/src/main/java/stirling/software/SPDF/controller/.*'
       - 'app/core/src/main/resources/settings.yml.template'
       - 'app/core/src/main/resources/application.properties'
-      - 'app/proprietary/src/main/resources/application-proprietary.properties'
-      - 'app/saas/src/main/resources/application-dev.properties'
-      - 'app/saas/src/main/resources/application-saas.properties'
       - 'app/core/src/main/resources/banner.txt'
       - 'app/core/src/main/resources/static/python/png_to_webp.py'
       - 'app/core/src/main/resources/static/python/split_photos.py'
@@ -158,12 +142,11 @@ labels:
       - 'app/common/src/test/.*'
       - 'app/proprietary/src/test/.*'
       - 'app/core/src/test/.*'
-      - 'app/saas/src/test/.*'
       - 'testing/.*'
       - '.github/workflows/scorecards.yml'
       - 'exampleYmlFiles/test_cicd.yml'
 
-  - label: 'GitHub'
+  - label: 'Github'
     files:
       - '.github/.*'
 
@@ -177,4 +160,3 @@ labels:
       - 'app/common/build.gradle'
       - 'app/proprietary/build.gradle'
       - 'app/core/build.gradle'
-      - 'app/saas/build.gradle'

.github/labels.yml

@@ -5,7 +5,6 @@
 # the GitHub Action https://github.com/marketplace/actions/github-labeler.
 - name: "Licenses"
   color: "EDEDED"
-  description: "Issues or pull requests related to licenses"
   from_name: "licenses"
 - name: "Back End"
   color: "20CE6C"
@@ -85,9 +84,6 @@
 - name: "v2"
   color: "FFFF00"
   description: "Issues or pull requests related to the v2 branch"
-- name: "v3"
-  color: "FFA500"
-  description: "Issues or pull requests related to the v3 branch"
 - name: "wontfix"
   description: "This will not be worked on"
   color: "FFFFFF"
@@ -147,21 +143,21 @@
   description: "Changes that do not affect the meaning of the code (formatting, etc.)"
 - name: "admin"
   color: "195055"
-- name: "GitHub"
+- name: "codex"
+  color: "ededed"
+  description: null
+- name: "Github"
   color: "0052CC"
-  description: "Issues or pull requests related to GitHub configuration and integrations"
-  from_name: "Github"
+- name: "github_actions"
+  color: "000000"
+  description: "Pull requests that update GitHub Actions code"
 - name: "needs-changes"
   color: "A65A86"
-  description: "Pull requests that require changes before they can be merged"
 - name: "on-hold"
   color: "2526F9"
 - name: "python"
   color: "2b67c6"
   description: "Pull requests that update Python code"
-- name: "engine"
-  color: "2b67c6"
-  description: "Issues or pull requests related to the engine"
 - name: "size:L"
   color: "eb9500"
   description: "This PR changes 100-499 lines ignoring generated files."
@@ -191,17 +187,3 @@
 - name: "break-change"
   color: "FF0000"
   description: "This PR introduces a breaking API change."
-- name: "Rust"
-  color: "DEA584"
-  description: "Pull requests that update Rust code"
-  from_name: "rust"
-- name: "Tauri"
-  color: "24C8FF"
-  description: "Pull requests that update Tauri code"
-  from_name: "tauri"
-- name: "license-review-required"
-  color: "EDEDED"
-  description: "This PR requires a license review"
-- name: "has conflicts"
-  color: "D93F0B"
-  description: "Pull request has merge conflicts with the base branch"

.github/pull_request_template.md

@@ -17,7 +17,7 @@ Closes #(issue_number)
 ### General
 
 - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
-- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable)
+- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable)
 - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable)
 - [ ] I have performed a self-review of my own code
 - [ ] My changes generate no new warnings
@@ -37,5 +37,4 @@ Closes #(issue_number)
 
 ### Testing (if applicable)
 
-- [ ] I have run `task check` to verify linters, typechecks, and tests pass
-- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details.
+- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.

.github/release.yml

@@ -1,11 +1,4 @@
 changelog:
-  exclude:
-    labels:
-      - ignore-for-release
-      # engine: Python AI engine - not currently live / not yet shipped to users.
-      # Remove this entry once the engine is released.
-      - engine
-
   categories:
     - title: Breaking Changes
       labels:
@@ -13,22 +6,16 @@ changelog:
 
     - title: Bug Fixes
       labels:
-        - Bugfix
         - Bug
 
     - title: Enhancements
       labels:
         - enhancement
-        - Java
-        - Front End
-        - Back End
-        - Tauri
 
     - title: Minor Enhancements
       labels:
-        - chore
-        - style
-        - refactor
+        - Java
+        - Front End
 
     - title: Docker Updates
       labels:

.github/scripts/check_language_toml.py

@@ -11,16 +11,13 @@ adjusting the format.
 Usage:
     python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
-
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-US/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
 
-import argparse
 import glob
 import os
+import argparse
 import re
-from pathlib import Path
-
 import tomllib  # Python 3.11+ (stdlib)
 import tomli_w  # For writing TOML files
 
@@ -39,8 +36,7 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     duplicates = []
 
     # Load TOML file
-    file_path = Path(file_path)
-    with file_path.open("rb") as file:
+    with open(file_path, "rb") as file:
         data = tomllib.load(file)
 
     def process_dict(obj, current_prefix=""):
@@ -59,8 +55,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for TOML files (e.g., 1 MB)
-MAX_FILE_SIZE = 1000 * 1024
+# Maximum size for TOML files (e.g., 500 KB)
+MAX_FILE_SIZE = 500 * 1024
 
 
 def parse_toml_file(file_path):
@@ -69,8 +65,7 @@ def parse_toml_file(file_path):
     :param file_path: Path to the TOML file.
     :return: Dictionary with flattened keys.
     """
-    file_path = Path(file_path)
-    with file_path.open("rb") as file:
+    with open(file_path, "rb") as file:
         data = tomllib.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
@@ -113,8 +108,7 @@ def write_toml_file(file_path, updated_properties):
     """
     nested_data = unflatten_dict(updated_properties)
 
-    file_path = Path(file_path)
-    with file_path.open("wb") as file:
+    with open(file_path, "wb") as file:
         tomli_w.dump(nested_data, file)
 
 
@@ -125,23 +119,18 @@ def update_missing_keys(reference_file, file_list, branch=""):
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_file = Path(reference_file)
     reference_properties = parse_toml_file(reference_file)
-    branch_path = Path(branch) if branch else Path()
 
     for file_path in file_list:
-        file_path = Path(file_path)
-        language_dir = file_path.parent.name
-        reference_lang_dir = reference_file.parent.name
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
-            language_dir == reference_lang_dir
-            or file_path.suffix != ".toml"
-            or file_path.parents[1].name != "locales"
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".toml")
+            or not os.path.dirname(file_path).endswith("locales")
         ):
-            print(f"Skipping file: {file_path}")
             continue
 
-        current_properties = parse_toml_file(branch_path / file_path)
+        current_properties = parse_toml_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -152,7 +141,7 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_toml_file(branch_path / file_path, updated_properties)
+        write_toml_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
@@ -160,17 +149,14 @@ def check_for_missing_keys(reference_file, file_list, branch):
 
 
 def read_toml_keys(file_path):
-    file_path = Path(file_path)
-    if file_path.is_file():
+    if os.path.isfile(file_path) and os.path.exists(file_path):
         return parse_toml_file(file_path)
     return {}
 
 
 def check_for_differences(reference_file, file_list, branch, actor):
     reference_branch = branch
-    reference_file = Path(reference_file)
-    basename_reference_file = reference_file.name
-    branch_path = Path(branch) if branch else Path()
+    basename_reference_file = os.path.basename(reference_file)
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
@@ -184,44 +170,39 @@ def check_for_differences(reference_file, file_list, branch, actor):
     if len(file_list) == 1:
         file_arr = file_list[0].split()
 
-    base_dir = Path.cwd() / "frontend" / "editor" / "public" / "locales"
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "frontend", "public", "locales")
+    )
 
     for file_path in file_arr:
-        file_path = Path(file_path)
-        file_normpath = file_path
-        absolute_path = file_normpath.resolve()
-
-        basename_current_file = (branch_path / file_normpath).name
-        locale_dir = file_normpath.parent.name
-        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)
 
         # Verify that file is within the expected directory
-        if not absolute_path.is_relative_to(base_dir):
-            has_differences = True
-            report.append(
-                f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n"
-            )
-            continue
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")
 
         # Verify file size before processing
-        if (branch_path / file_normpath).stat().st_size > MAX_FILE_SIZE:
-            has_differences = True
-            report.append(
-                f"\n⚠️ The file `{locale_dir}/{basename_current_file}` is too large and could pose a security risk.\n\n---\n"
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
             )
-            continue
 
-        if basename_current_file == basename_reference_file and locale_dir == "en-US":
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        locale_dir = os.path.basename(os.path.dirname(file_normpath))
+
+        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
             continue
 
         if (
-            file_normpath.suffix != ".toml"
+            not file_normpath.endswith(".toml")
             or basename_current_file != "translation.toml"
         ):
             continue
 
         only_reference_file = False
-        current_keys = read_toml_keys(branch_path / file_path)
+        report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
+        current_keys = read_toml_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -259,37 +240,20 @@ def check_for_differences(reference_file, file_list, branch, actor):
                 report.append(
                     f"    - **_Extra keys in `{locale_dir}/{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                 )
-                report.append("")
-                report.append("    Use the following command to remove them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
-                )
-                report.append("")
             if extra_keys_list:
                 report.append(
                     f"    - **_Missing keys in `{locale_dir}/{basename_current_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_reference_file}`_**."
                 )
-                report.append("")
-                report.append("    Use the following command to add them:")
-                report.append(
-                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
-                )
-                report.append("")
-
-            if missing_keys_list or extra_keys_list:
-                report.append(
-                    "    See: https://github.com/Stirling-Tools/Stirling-PDF/tree/main/scripts/translations#2-translation_mergerpy"
-                )
         else:
             report.append("2. **Test Status:** ✅ **_Passed_**")
 
-        if find_duplicate_keys(branch_path / file_normpath):
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
             has_differences = True
             output = "\n".join(
                 [
                     f"      - `{key}`: first at {first}, duplicate at `{duplicate}`"
                     for key, first, duplicate in find_duplicate_keys(
-                        branch_path / file_normpath
+                        os.path.join(branch, file_normpath)
                     )
                 ]
             )
@@ -308,7 +272,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-US/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -372,7 +336,6 @@ if __name__ == "__main__":
                 os.path.join(
                     os.getcwd(),
                     "frontend",
-                    "editor",
                     "public",
                     "locales",
                     "*",

.github/scripts/requirements_dev.txt

@@ -1,402 +1,372 @@
 #
-# This file is autogenerated by pip-compile with Python 3.13
+# This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
 #    pip-compile --allow-unsafe --generate-hashes --output-file='.github\scripts\requirements_dev.txt' --strip-extras '.github\scripts\requirements_dev.in'
 #
 # WARNING: pip install will require the following package to be hashed.
 # Consider using a hashable URL like https://github.com/jazzband/pip-tools/archive/SOMECOMMIT.zip
+# CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
     # via
     #   -r .github/scripts/requirements_dev.in
     #   fonttools
-cffi==2.1.0 \
-    --hash=sha256:02cb7ff33ded4f1532476731f89ede53e2e488a8e6205515a82144246ffa7dcc \
-    --hash=sha256:03e9810d18c646077e501f661b682fbf5dee4676048527ca3cffe66faa9960dd \
-    --hash=sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d \
-    --hash=sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5 \
-    --hash=sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f \
-    --hash=sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6 \
-    --hash=sha256:0a96b74cda968eebbad56d973efe5098974f0a9fb323865bf99ea1fd24e3e64c \
-    --hash=sha256:10537b1df4967ca26d21e5072d7d54188354483b91dc75058968d3f0cf13fbda \
-    --hash=sha256:11b3fb55f4f8ad92274ed26705f65d8f91457de71f5380061eb6d125a768fecd \
-    --hash=sha256:15faec4adfff450819f3aee0e2e02c812de6edb88203aa58807955db2003472a \
-    --hash=sha256:164bff1657b2a74f0b6d54e11c9b375bc97b931f2ca9c43fcf875838da1570dd \
-    --hash=sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd \
-    --hash=sha256:19c54ac121cad98450b4896fa9a43ee0180d57bc4bc911a33db6cab1efab6cd3 \
-    --hash=sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb \
-    --hash=sha256:1e9f50d192a3e525b15a75ab5114e442d83d657b7ec29182a991bc9a88fd3a66 \
-    --hash=sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d \
-    --hash=sha256:2282cd5e38aa8accd03e99d1256af8411c84cdbee6a89d841b563fdbd1f3e50f \
-    --hash=sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6 \
-    --hash=sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0 \
-    --hash=sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c \
-    --hash=sha256:30b65779d598c370374fefabf138d456fd6f3216bfa7bedfab1ba82025b0cd93 \
-    --hash=sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d \
-    --hash=sha256:35aaea0c7ee0e58a5cd8c2fd1a48fdf7ece0d2699b7ecdda08194e9ce5dd9b3d \
-    --hash=sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8 \
-    --hash=sha256:379de10ce1ba048b1448599d1b37b24caee16309d1ac98d3982fc997f768700b \
-    --hash=sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001 \
-    --hash=sha256:3b926723c13eba9f81d2ef3820d63aeceec3b2d4639906047bf675cb8a7a500d \
-    --hash=sha256:3d7f118b5adbfdfead90c25822690b02bc8074fba949bb7858bec4ebd55adb43 \
-    --hash=sha256:46b1c8db8f6122420f32d02fffb924c2fe9bc772d228c7c711748fff56aabb2b \
-    --hash=sha256:47ff3a8bfd8cb9da1af7524b965127095055654c177fcfc7578debcb015eecd0 \
-    --hash=sha256:4d433a51f1870e43a13b6732f92aaf540ff77c2015097c78556f75a2d6c030e0 \
-    --hash=sha256:4f26194e3d95e06501b942642855aed4f953d55e95d7d01b7c4483db3ecff458 \
-    --hash=sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8 \
-    --hash=sha256:5972433ad71a9e46516584ef60a0fda12d9dc459938d1539c3ddecf9bdc1368d \
-    --hash=sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94 \
-    --hash=sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022 \
-    --hash=sha256:63960549e4f8dc41e31accb97b975abaecfc44c03e396c093a6436763c2ea7db \
-    --hash=sha256:64c753a0f87a256020004f37a1c8c02c480e725f910f0b2a0f3f07debd1b2479 \
-    --hash=sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376 \
-    --hash=sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d \
-    --hash=sha256:6d194185eabd279f1c05ebe3504265ddfc5ad2b58d0714f7db9f01da592e9eb6 \
-    --hash=sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3 \
-    --hash=sha256:716ff8ec22f20b4d988b12884086bcef0fc99737043e503f7a3935a6be99b1ea \
-    --hash=sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd \
-    --hash=sha256:7762faa47e8ff7eb80bd261d9a7d8eea2d8baa69de5e95b70c1f338bbe712f02 \
-    --hash=sha256:78474632761faa0fb96f30b1c928c84ebcf68713cbb80d15bab09dfe61640fde \
-    --hash=sha256:799416bae98336e400981ff6e532d67d5c709cfb30afb79865a1315f94b0e224 \
-    --hash=sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76 \
-    --hash=sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804 \
-    --hash=sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1 \
-    --hash=sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913 \
-    --hash=sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714 \
-    --hash=sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc \
-    --hash=sha256:88023dfe18799507b73f1dbb0d14326a17465de1bc9c9c7655c22845e9ddc3a2 \
-    --hash=sha256:89095c1968b4ba8285840e131bf2891b09ae137fe2146905acae0354fbce1b5e \
-    --hash=sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda \
-    --hash=sha256:8e74a6135550c4748af665b1b1118b6aab33b1fc6a16f9aff630af107c3b4512 \
-    --hash=sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28 \
-    --hash=sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699 \
-    --hash=sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3 \
-    --hash=sha256:961be50688f7fba2fa65f63712d3b9b341a22311f5253460ce933f52f0de1c8c \
-    --hash=sha256:98fff996e983a36d3aa2eca83af40c5821202e7e6f32d13ae94e3d2286f10cfe \
-    --hash=sha256:9b8f0f26ca4e7513c534d351eca551947d053fac438f2a04ac96d882909b0d3a \
-    --hash=sha256:9d72af0cf10a76a600a9690078fe31c63b9588c8e86bf9fd353f713c84b5db0f \
-    --hash=sha256:9d8272c0e483b024e1b9ad029821470ed8ec65631dbd90217469da0e7cd89f1c \
-    --hash=sha256:a016194dbe13d14ee9556e734b772d8d67b947092b268d757fd4290e3ba2dfc2 \
-    --hash=sha256:a5781494d4d400a3f47f8f1da94b324f6e6b440a53387774002890a2a2f4b50f \
-    --hash=sha256:a95b05f9baf29b91171b3a8bd2020b028835243e7b0ff6bb23e2a3c228518b1b \
-    --hash=sha256:aa7a1b53a2a4452ada2d1b5dade9960b2522f1e61293a811a077439e39029565 \
-    --hash=sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056 \
-    --hash=sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629 \
-    --hash=sha256:b6422532152adf4e59b110cb2808cee7a033800952f5c036b4af047ee43199e7 \
-    --hash=sha256:b65f590ef2a44640f9a05dbb548a429b4ade77913ce683ac8b1480777658a6c0 \
-    --hash=sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9 \
-    --hash=sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853 \
-    --hash=sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13 \
-    --hash=sha256:bf5c6cf48238b0eb4c086978c492ad1cbc22373fc5b2d7353b3a598ce6db887a \
-    --hash=sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4 \
-    --hash=sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce \
-    --hash=sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac \
-    --hash=sha256:c5f5df567f6eb216de69be06ce55c8b714090fae02b18a3b40da8163b8c5fa9c \
-    --hash=sha256:c941bb58d5a6e1c3892d86e42927ed6c180302f07e6d395d08c416e594b98b46 \
-    --hash=sha256:c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384 \
-    --hash=sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b \
-    --hash=sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210 \
-    --hash=sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc \
-    --hash=sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a \
-    --hash=sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5 \
-    --hash=sha256:d9fafc5aa2e2a39aaf7f8cc0c1f044a9b07fca12e558dca53a3cc5c654ad67a7 \
-    --hash=sha256:db3eb7d46527159a878ec3460e9d40615bc25ba337d477db681aea6e4f05c5d2 \
-    --hash=sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326 \
-    --hash=sha256:df2b82571a1b30f58a87bf4e5a9e78d2b1eff6c6ce8fd3aa3757221f93f0863f \
-    --hash=sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca \
-    --hash=sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98 \
-    --hash=sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9 \
-    --hash=sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5 \
-    --hash=sha256:f5bce581e6b8c235e566a14768a943b172ada3ed73537bb0c0be1edee312d4e7 \
-    --hash=sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc \
-    --hash=sha256:fb62edb5bb52cca65fab91a63afa7561607120d26090a7e8fda6fb9f064726da \
-    --hash=sha256:ff067a8d8d880e7809e4ac88eb009bb848870115317b306666502ccad30b147f
+cffi==2.0.0 \
+    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
+    --hash=sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b \
+    --hash=sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f \
+    --hash=sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9 \
+    --hash=sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44 \
+    --hash=sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2 \
+    --hash=sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c \
+    --hash=sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75 \
+    --hash=sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65 \
+    --hash=sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e \
+    --hash=sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a \
+    --hash=sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e \
+    --hash=sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25 \
+    --hash=sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a \
+    --hash=sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe \
+    --hash=sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b \
+    --hash=sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91 \
+    --hash=sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592 \
+    --hash=sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187 \
+    --hash=sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c \
+    --hash=sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1 \
+    --hash=sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94 \
+    --hash=sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba \
+    --hash=sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb \
+    --hash=sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165 \
+    --hash=sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529 \
+    --hash=sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca \
+    --hash=sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c \
+    --hash=sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6 \
+    --hash=sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c \
+    --hash=sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0 \
+    --hash=sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743 \
+    --hash=sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63 \
+    --hash=sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5 \
+    --hash=sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5 \
+    --hash=sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4 \
+    --hash=sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d \
+    --hash=sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b \
+    --hash=sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93 \
+    --hash=sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205 \
+    --hash=sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27 \
+    --hash=sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512 \
+    --hash=sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d \
+    --hash=sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c \
+    --hash=sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037 \
+    --hash=sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26 \
+    --hash=sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322 \
+    --hash=sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb \
+    --hash=sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c \
+    --hash=sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8 \
+    --hash=sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4 \
+    --hash=sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414 \
+    --hash=sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9 \
+    --hash=sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664 \
+    --hash=sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9 \
+    --hash=sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775 \
+    --hash=sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739 \
+    --hash=sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc \
+    --hash=sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062 \
+    --hash=sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe \
+    --hash=sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9 \
+    --hash=sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92 \
+    --hash=sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5 \
+    --hash=sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13 \
+    --hash=sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d \
+    --hash=sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26 \
+    --hash=sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f \
+    --hash=sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495 \
+    --hash=sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b \
+    --hash=sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6 \
+    --hash=sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c \
+    --hash=sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef \
+    --hash=sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5 \
+    --hash=sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18 \
+    --hash=sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad \
+    --hash=sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3 \
+    --hash=sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7 \
+    --hash=sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5 \
+    --hash=sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534 \
+    --hash=sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49 \
+    --hash=sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2 \
+    --hash=sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5 \
+    --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
+    --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
     # via weasyprint
-cfgv==3.5.0 \
-    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
-    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+cfgv==3.4.0 \
+    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
+    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
     # via pre-commit
-cssselect2==0.9.0 \
-    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
-    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
+cssselect2==0.8.0 \
+    --hash=sha256:46fc70ebc41ced7a32cd42d58b1884d72ade23d21e5a4eaaf022401c13f0e76e \
+    --hash=sha256:7674ffb954a3b46162392aee2a3a0aedb2e14ecf99fcc28644900f4e6e3e9d3a
     # via weasyprint
-distlib==0.4.3 \
-    --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \
-    --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed
+distlib==0.4.0 \
+    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
+    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
     # via virtualenv
-filelock==3.30.0 \
-    --hash=sha256:1774e682dbe443bd60f9609162fc596e2c80dc84ffc2957068953406d0520090 \
-    --hash=sha256:40632998f0772e64183bb819f086a1b9def6be1090cf1dcb9d45f46806ef279b
-    # via
-    #   python-discovery
-    #   virtualenv
-fonttools==4.63.0 \
-    --hash=sha256:032038247a96c1690f9f31e377c389383c902531b085aa4e4dabd6f57f870e69 \
-    --hash=sha256:063e08bd17bd5a90127a14123de0d6a952dbc847695fd98b63c043d58057f90c \
-    --hash=sha256:0c18358a155d75034911c5ee397a5b44cd19dd325dbb8b35fb60bf421d6a72ac \
-    --hash=sha256:0eac00b9118c3c2f87d272e45341871c5b3066baa3c86897fa634a7c3fb59096 \
-    --hash=sha256:1e874792a8212b44583ea02189d9e693906b2f78b261f372f95d6c563210ac1d \
-    --hash=sha256:22135da48a348785c5e2d5d2d9d6bec5ed44adacbaeb9db12d9493bf6c6bfa68 \
-    --hash=sha256:22693918177bd9ceabec4736d338045f357769416fc6b0b2508eefef75b08616 \
-    --hash=sha256:27fdc65af8da6f88b9c6121c47a464cbe359fcfff7ff6fc2d37a1f395d755b78 \
-    --hash=sha256:2b8ae05d9eacf6081414d759c0a352769ac28ce31280d6bb8e77b03f9e3c449f \
-    --hash=sha256:2c14b4fd138c4bafcca294765c547914e1aa431ae1ca94ab99d8db08c958bd3b \
-    --hash=sha256:308f957cdeaf8abe4e5f2f124902ef405448af92c90f80e302a3b771c2e6116b \
-    --hash=sha256:37dd23e621e3b0aef1baa70a303b80aaf38449632cfc8fd2a55fb285bbccfc02 \
-    --hash=sha256:445af2eab030a16b9171ea8bdda7ebf7d96bda2df88ee182a464252f6e05e20d \
-    --hash=sha256:51394295f1a51de8b5f30bdb1e1b9a4231536c7064ef5c6e211eec19fa36036f \
-    --hash=sha256:58dc6bb86a78d782f00f9190ca02c119cf5bbe2807536e361e18d42019f877d8 \
-    --hash=sha256:59ac449f8cca9b4ffa08d2e7bbadad87ce710d69d1eda5c3c1ce579baa987272 \
-    --hash=sha256:6b2248c5decb223562f7902ff6325077a073f608ee8e33e88ad88db734eb9f49 \
-    --hash=sha256:6d4741eb179121cab9eea4cb2393d24492373a260d7945006358c08cfbf45419 \
-    --hash=sha256:6db5140a60a5d731d21ec076745b40a310607731b0a565b50776393188649001 \
-    --hash=sha256:6e528da43bc3791085f8cb6141b1d13e459226790240340fcbb4625649238b03 \
-    --hash=sha256:796f27556dbe094c4824f75ca85267e4df776c79036c8441469a4df37038c196 \
-    --hash=sha256:79cdc9f567aec74a72918fd060283911406750cbc9fd28c1316023deb6ce31a9 \
-    --hash=sha256:7d76edbff9014094dbf03bd2d074709dfa6ec7aba13d838c937a2b33d2d6a86e \
-    --hash=sha256:7d782fac32985914c351556f68ac0855391572bcd87de50e05970d3cd4c96fc5 \
-    --hash=sha256:7dd683fef0663e9f0f45cf541d788d24caa3ec9db50796b588e1757d8b3bc007 \
-    --hash=sha256:85be818f5506e8a7753153def2c9550178f0ecae6a47b5e0e8dbb23f7cc90380 \
-    --hash=sha256:948428a275741f0b64b113c955425a953314f4b9ab9997f73a72c83e68e569c8 \
-    --hash=sha256:9ced0bd02ac751dd6319b0da88aaef24414e3b0dbc32bb4f24944821a3741a27 \
-    --hash=sha256:9e12f105d2b6342c559c298afb674006bb2893afc7102dcf8a1b55b0486b4e40 \
-    --hash=sha256:a8b33a82979e0a6a34ff435cc81317be1f95ec1ebb7a3a2d1c8a6a54f02ae44e \
-    --hash=sha256:a9faff9e0c1f76f9fd55899d2ce785832efebab37eb8ae13995853aef178bef0 \
-    --hash=sha256:af2fd1664d00a397d75f806985ddb36282091c2131a73a6485c23b4a34722263 \
-    --hash=sha256:afefc1ed0a59785a7fb06ea7e1678e849c193e1e387db783579bc7b3056fcfcb \
-    --hash=sha256:b1cd75a03ad8cb5bc40c90bfde68c0c47de423aa19e5c0f362b43520645eea94 \
-    --hash=sha256:ba04cb5891d4c0c21b6da95eda8d7b090021508a294fff33464fc7d241e0856b \
-    --hash=sha256:bf00f21eb5fb721dbaf73d1e9da6d02a1af7768f2ebcf9798be98beab8ba90f6 \
-    --hash=sha256:c0425b277a59cff3d80ca42162a8de360f318438a2ac83570842a678d826d579 \
-    --hash=sha256:c1aaa4b9c75798400ac043ce04d74e7830376c85095a5a6ed7cba2f17a266bf4 \
-    --hash=sha256:c2a2a42198b696a6f48fad91709afb55176e66a5e566131219dba372fb7f8c59 \
-    --hash=sha256:caeb583deeb5168e694b65cda8b4ee62abedfa66cf88488734466f2366b9c4e0 \
-    --hash=sha256:cb014d58140a38135f16064c74c652ed57aa0b75cbf8bb59cac821f7edb5334e \
-    --hash=sha256:ccf41f2efdf56994d22d73bef4ced1052161958169428d06ba9724ea9e9a64be \
-    --hash=sha256:cd7e9857e5e63738b9d9fd707bc1f59c8b09e5177726d23664db393c59bb08bd \
-    --hash=sha256:d76ac49f929aecaf82d83250b8347e099d7aecba0f4726c1d9b6df3b8bb5fe18 \
-    --hash=sha256:d7e5c9973aa04c95650c96e5f5ad865fbf42d62079163ecfab1e01cbc2504c22 \
-    --hash=sha256:dcf076a4474fe0d7367e5bbf5b052c7284fa1feca729c04176ce513521afd8a0 \
-    --hash=sha256:e3297a6a4059b4acc3a1e9a8b04741f240a80044eef08ebd32e8b5bcdddce75b \
-    --hash=sha256:ee08ebfa58f6e1aeff5697ab9582105bb620008c1caafb681e4c557e7483027b \
-    --hash=sha256:ef3048ef05dbb552b89817713d9cac912e00d0fde4a3105c00d29e52e10c89af \
-    --hash=sha256:fd1e3094f42d806d3d7c79162fc59e5910fcbe3a7360c385b8da969bc4493745
+filelock==3.20.0 \
+    --hash=sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2 \
+    --hash=sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4
+    # via virtualenv
+fonttools==4.60.1 \
+    --hash=sha256:022beaea4b73a70295b688f817ddc24ed3e3418b5036ffcd5658141184ef0d0c \
+    --hash=sha256:026290e4ec76583881763fac284aca67365e0be9f13a7fb137257096114cb3bc \
+    --hash=sha256:0b0835ed15dd5b40d726bb61c846a688f5b4ce2208ec68779bc81860adb5851a \
+    --hash=sha256:0eae96373e4b7c9e45d099d7a523444e3554360927225c1cdae221a58a45b856 \
+    --hash=sha256:122e1a8ada290423c493491d002f622b1992b1ab0b488c68e31c413390dc7eb2 \
+    --hash=sha256:1410155d0e764a4615774e5c2c6fc516259fe3eca5882f034eb9bfdbee056259 \
+    --hash=sha256:145daa14bf24824b677b9357c5e44fd8895c2a8f53596e1b9ea3496081dc692c \
+    --hash=sha256:1525796c3ffe27bb6268ed2a1bb0dcf214d561dfaf04728abf01489eb5339dce \
+    --hash=sha256:154cb6ee417e417bf5f7c42fe25858c9140c26f647c7347c06f0cc2d47eff003 \
+    --hash=sha256:2299df884c11162617a66b7c316957d74a18e3758c0274762d2cc87df7bc0272 \
+    --hash=sha256:2409d5fb7b55fd70f715e6d34e7a6e4f7511b8ad29a49d6df225ee76da76dd77 \
+    --hash=sha256:268ecda8ca6cb5c4f044b1fb9b3b376e8cd1b361cef275082429dc4174907038 \
+    --hash=sha256:282dafa55f9659e8999110bd8ed422ebe1c8aecd0dc396550b038e6c9a08b8ea \
+    --hash=sha256:2ee06fc57512144d8b0445194c2da9f190f61ad51e230f14836286470c99f854 \
+    --hash=sha256:3630e86c484263eaac71d117085d509cbcf7b18f677906824e4bace598fb70d2 \
+    --hash=sha256:398447f3d8c0c786cbf1209711e79080a40761eb44b27cdafffb48f52bcec258 \
+    --hash=sha256:4ba4bd646e86de16160f0fb72e31c3b9b7d0721c3e5b26b9fa2fc931dfdb2652 \
+    --hash=sha256:5664fd1a9ea7f244487ac8f10340c4e37664675e8667d6fee420766e0fb3cf08 \
+    --hash=sha256:583b7f8e3c49486e4d489ad1deacfb8d5be54a8ef34d6df824f6a171f8511d99 \
+    --hash=sha256:596ecaca36367027d525b3b426d8a8208169d09edcf8c7506aceb3a38bfb55c7 \
+    --hash=sha256:5c1015318e4fec75dd4943ad5f6a206d9727adf97410d58b7e32ab644a807914 \
+    --hash=sha256:66929e2ea2810c6533a5184f938502cfdaea4bc3efb7130d8cc02e1c1b4108d6 \
+    --hash=sha256:6ec722ee589e89a89f5b7574f5c45604030aa6ae24cb2c751e2707193b466fed \
+    --hash=sha256:6f68576bb4bbf6060c7ab047b1574a1ebe5c50a17de62830079967b211059ebb \
+    --hash=sha256:7473a8ed9ed09aeaa191301244a5a9dbe46fe0bf54f9d6cd21d83044c3321217 \
+    --hash=sha256:7b0c6d57ab00dae9529f3faf187f2254ea0aa1e04215cf2f1a8ec277c96661bc \
+    --hash=sha256:7b4c32e232a71f63a5d00259ca3d88345ce2a43295bb049d21061f338124246f \
+    --hash=sha256:8177ec9676ea6e1793c8a084a90b65a9f778771998eb919d05db6d4b1c0b114c \
+    --hash=sha256:839565cbf14645952d933853e8ade66a463684ed6ed6c9345d0faf1f0e868877 \
+    --hash=sha256:875cb7764708b3132637f6c5fb385b16eeba0f7ac9fa45a69d35e09b47045801 \
+    --hash=sha256:8a44788d9d91df72d1a5eac49b31aeb887a5f4aab761b4cffc4196c74907ea85 \
+    --hash=sha256:8b4eb332f9501cb1cd3d4d099374a1e1306783ff95489a1026bde9eb02ccc34a \
+    --hash=sha256:906306ac7afe2156fcf0042173d6ebbb05416af70f6b370967b47f8f00103bbb \
+    --hash=sha256:992775c9fbe2cf794786fa0ffca7f09f564ba3499b8fe9f2f80bd7197db60383 \
+    --hash=sha256:996a4d1834524adbb423385d5a629b868ef9d774670856c63c9a0408a3063401 \
+    --hash=sha256:9a52f254ce051e196b8fe2af4634c2d2f02c981756c6464dc192f1b6050b4e28 \
+    --hash=sha256:9d0ced62b59e0430b3690dbc5373df1c2aa7585e9a8ce38eff87f0fd993c5b01 \
+    --hash=sha256:a140761c4ff63d0cb9256ac752f230460ee225ccef4ad8f68affc723c88e2036 \
+    --hash=sha256:a184b2ea57b13680ab6d5fbde99ccef152c95c06746cb7718c583abd8f945ccc \
+    --hash=sha256:a3db56f153bd4c5c2b619ab02c5db5192e222150ce5a1bc10f16164714bc39ac \
+    --hash=sha256:a46b2f450bc79e06ef3b6394f0c68660529ed51692606ad7f953fc2e448bc903 \
+    --hash=sha256:a884aef09d45ba1206712c7dbda5829562d3fea7726935d3289d343232ecb0d3 \
+    --hash=sha256:b2cf105cee600d2de04ca3cfa1f74f1127f8455b71dbad02b9da6ec266e116d6 \
+    --hash=sha256:b33a7884fabd72bdf5f910d0cf46be50dce86a0362a65cfc746a4168c67eb96c \
+    --hash=sha256:b42d86938e8dda1cd9a1a87a6d82f1818eaf933348429653559a458d027446da \
+    --hash=sha256:b6379e7546ba4ae4b18f8ae2b9bc5960936007a1c0e30b342f662577e8bc3299 \
+    --hash=sha256:c7420a2696a44650120cdd269a5d2e56a477e2bfa9d95e86229059beb1c19e15 \
+    --hash=sha256:c8651e0d4b3bdeda6602b85fdc2abbefc1b41e573ecb37b6779c4ca50753a199 \
+    --hash=sha256:d066ea419f719ed87bc2c99a4a4bfd77c2e5949cb724588b9dd58f3fd90b92bf \
+    --hash=sha256:e6c58beb17380f7c2ea181ea11e7db8c0ceb474c9dd45f48e71e2cb577d146a1 \
+    --hash=sha256:e852d9dda9f93ad3651ae1e3bb770eac544ec93c3807888798eccddf84596537 \
+    --hash=sha256:ec3681a0cb34c255d76dd9d865a55f260164adb9fa02628415cdc2d43ee2c05d \
+    --hash=sha256:ee0c0b3b35b34f782afc673d503167157094a16f442ace7c6c5e0ca80b08f50c \
+    --hash=sha256:eedacb5c5d22b7097482fa834bda0dafa3d914a4e829ec83cdea2a01f8c813c4 \
+    --hash=sha256:ef00af0439ebfee806b25f24c8f92109157ff3fac5731dc7867957812e87b8d9 \
+    --hash=sha256:f0e8817c7d1a0c2eedebf57ef9a9896f3ea23324769a9a2061a80fe8852705ed \
+    --hash=sha256:f3d5be054c461d6a2268831f04091dc82753176f6ea06dc6047a5e168265a987 \
+    --hash=sha256:f4b5c37a5f40e4d733d3bbaaef082149bee5a5ea3156a785ff64d949bd1353fa
     # via weasyprint
-identify==2.6.19 \
-    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
-    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+identify==2.6.15 \
+    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
+    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
     # via pre-commit
-nodeenv==1.10.0 \
-    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
-    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+nodeenv==1.9.1 \
+    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
+    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
     # via pre-commit
-numpy==2.4.6 \
-    --hash=sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1 \
-    --hash=sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4 \
-    --hash=sha256:043191bfa8eab18c776647b62723ac9dddece59743b13f49b2016094129c2b3f \
-    --hash=sha256:06ca2f61ec4385a07a6977c55ba998a4466c123642b4a32694d3128fce18c079 \
-    --hash=sha256:0a041d3d761dc3c35cc56ce0351506a02bcbc25f7b169f652435141a17db9096 \
-    --hash=sha256:0ab0a9c4ffb1a6d95ef519fe4247dba8eb6b18ad93999f76b7f657039acabd47 \
-    --hash=sha256:0c9136e14ed34a9e343a31c533d78a9813a69a3148332bce5e9821cb2f996e66 \
-    --hash=sha256:110f8b71aacb688ec69062bb7f6938a0f8acb01b7c1c4beb453c65b6d234584d \
-    --hash=sha256:112b06a867b235ef466ed3508ddf0238050df9c727cafb5301ac385b899189a1 \
-    --hash=sha256:17f9ade344e7d9b464a084d69bcf18fc691cb1db67c62ed80820bf4926d78f0e \
-    --hash=sha256:1e254a00cdf42b1e4d5b3d68d33af63268d41340d8885df2ab6470f2e1500147 \
-    --hash=sha256:1e978ec1e8bd0e0e4de6bb75de9d30cbb74db6b6a2bb727618613703ca0167dd \
-    --hash=sha256:25c692919ac5a01f170a3bfcd62d745b24fd095c353d50812637d6fcab442e75 \
-    --hash=sha256:260a5d70215b61ab4fadf5c7baacd64821842975eea312125ed3c39a6391b063 \
-    --hash=sha256:2803abfebfc990042cd494d8ce2d5f82e9d847af6d35ec486923aa19dbad5e73 \
-    --hash=sha256:29a287e0cf63ff528da061de6b9f64a4618da591ca1046aafc54062e40ca7eab \
-    --hash=sha256:29cb7f67d10b479ff07c17d33e39f78c07f71c40ef30d63c153d340e96cd3fb4 \
-    --hash=sha256:3213d622a0283a39a93d188f3cf72b26862df52fbb4ca3697f51705016523d41 \
-    --hash=sha256:33111801a01c12a8a1e3721f0a9232f8cfc8ae2c6b7098167e6f623c6073f402 \
-    --hash=sha256:357cc07a6d7b0b182ff02249616a03742827ebb1277546b5c7cd7f7620a45698 \
-    --hash=sha256:38efbc8de75c7a0fc1ac190162d892787f3f47b57cc291231aafee36b80982b7 \
-    --hash=sha256:4081eb135ac24158bd51cdfbef16f1c64df7063b1143f24731387137c092bec8 \
-    --hash=sha256:40fdc1ae7125e518ea98e53e69a4ebc27e1fd50510c47b7ea130cf21e5e1d42b \
-    --hash=sha256:4cfe66903cc32a9921a6733d96b19bb6abf310397581bbad89c228f5abaf0ee8 \
-    --hash=sha256:511dbaf848decaaaf4b4ca48032619fb3138710c4bf7da7617765edad1ef96b0 \
-    --hash=sha256:55cced7c52e981362f708ad635198e97a752dfba412cc03c23bbf3bd8d5cd662 \
-    --hash=sha256:56b39e5e0622a09a25bf5baf62f4bcf0cb8a41ae6e2819cf49bbc5a74c083f91 \
-    --hash=sha256:5dbbdb29840ca3d91ee0fece42fc29278886d908280bfec0a5846c6f901a3eb0 \
-    --hash=sha256:5f9fb9157b4ce2971008323afe46053787b526ef624fea915b261468a8421a0f \
-    --hash=sha256:6180d8b35af935aed8ece3a85e0a43f87393ae0ac87c8d2c8bd2c993f7270ef3 \
-    --hash=sha256:68a5124b13fa6cc2086764a20005d30bc0548146f7f5322f02fce212ca14317f \
-    --hash=sha256:68bb27509ac1b9a3443094260f6326150663b06abe40b73a2f81160623da5b67 \
-    --hash=sha256:6f41ae150c4e32db4f3310cdaf64b1593a03dbabe29eec77fc9b50fe64061df6 \
-    --hash=sha256:7265a2f3d436e54ef9f2b52b5c937e6be778781bd97a590319d7348f1c1ca997 \
-    --hash=sha256:72fbe16c6fac95aedf5937fa873445cec2110be35d8a4e9433d7501fd98dae6b \
-    --hash=sha256:7d92c3819208a60205a12a245c91ad70cb0a85336659b19b834205573ac8456e \
-    --hash=sha256:8155154c7c691289fe18f510b5d4657c68c67989f293f0535a91360392ff6538 \
-    --hash=sha256:81a1cca95ed5bb92aa8b10dd2cdc9a0d3853a50fad926c28b5d7e8ea54389627 \
-    --hash=sha256:89cd468399cfd2504718f0ba50e410dca55a170b61a02ad92bb18c8a65186e93 \
-    --hash=sha256:8ad03c0965fb3c692200e74d458ca28c1dbb4ce96f9a479a8aa041ad5fabca02 \
-    --hash=sha256:90f9849678c75fe7afa2d348ac842c168b0a4d3d61919687216dfc547976d853 \
-    --hash=sha256:948424b06129ce883307e8cff868c31396d8dc7630a59c61d70d98dbe70f222c \
-    --hash=sha256:9cd5ffd25db4e7ba6a375693b3fc0fc1791ec636c17db3720da19bde7180ec43 \
-    --hash=sha256:a0df0043bdb289bde1f62da130d20df23d58b45429f752bc7a8fc5325a225ecd \
-    --hash=sha256:a2c306dea656c12c68f51f4cea133cbe78ca7435eb28c735eac1d3ebe73be6e8 \
-    --hash=sha256:a7830bab239b79cda9c08c2da014761cafb48da6150e1da17ac06283f43b6089 \
-    --hash=sha256:a7c711e21628b52034bb5ab8d1bce291f752fcc5e92accc615778acee1ff4778 \
-    --hash=sha256:aaf159caa35993cb1f56fb9b8e4610d35758e7ca005412eb1daa856a78c9c4b1 \
-    --hash=sha256:ae506e6902902557576a26ff33eda8695e7ecb3cb36c3b573a0765dee114ebdb \
-    --hash=sha256:b507f5c4c1d508876d1819b6bf9a49d365b96320b5d4993426b33a23ca4b8261 \
-    --hash=sha256:bf162abab1c1a736333192707cef898e735a5ca00f38f27eeedf44b39d9e85eb \
-    --hash=sha256:c1a2af6c6ef86344a6b0db6b97834208bf598db514f2b155042439b62605601a \
-    --hash=sha256:c2d37ab77531417474168eb79d6d80b14f821a966818505d03013d0833edb7a8 \
-    --hash=sha256:c4fc99836233ea196540b17ab0983aff60ed07941751930f5f4d05bc3b3b7359 \
-    --hash=sha256:d581b735e177fdcdce6fed8e7e8880a3fb6ee4e3653a3ac6af01c6f4c03effc5 \
-    --hash=sha256:d6da64deb6b8ed903e7560180a92f2d804ee1ba5eeb849ac2748b8c1aba1f6d7 \
-    --hash=sha256:d8e8286dd7cea7895157318d1b91cdacac64c479f3cbc8dce548331728484751 \
-    --hash=sha256:ddea102b48f9e339f3948bf22040944184627a30fdf7f858667673b9c5f033c8 \
-    --hash=sha256:dfa20cc6ca228e6b155b11da03825975ce66aea520985dbbddf0f2a5a495c605 \
-    --hash=sha256:e3e5193ef5a3dc73bceee50f7fdc2c90dbb76c42df8d8fae3d1067a583df579e \
-    --hash=sha256:e3eeb0aabd6bd5ce64faae67e9935203a6991b4bc2a485a767fbafb2c5125f45 \
-    --hash=sha256:e5805d5a22fd19c8ccff10a9561f9df94436b0545619ea579db2d3c35294bce2 \
-    --hash=sha256:e85b752a1e912b70eaad4fafbd4d1238007ab221de2009b9a2f5ae7461239895 \
-    --hash=sha256:eaf7fa2de5c0be8ae6ff8e9bea2ccd725e980541244521d8d4b5f3354a27babe \
-    --hash=sha256:ebfb099f8dcf083deef3ac1ca4c1503f387cf76296fcb3816b66f5ecb5f54fdb \
-    --hash=sha256:ece3d2cfe132e7d51f44a832b303895e6f2d499c5e74dfbdb06ee246147a304a \
-    --hash=sha256:ed9749eef4cbd126da3dc1d6bcb3a57f5eb7ac6a6484146bdbf743f552dfc577 \
-    --hash=sha256:ede83e07a75dd06bc501566c1eca2afc0d61677c1472ac9ad93fdee6e638a48d \
-    --hash=sha256:ef4aea96ce4d3b074422cb4f2f64e216bf9e213004bb58ecfdf50ea02ea8eb9a \
-    --hash=sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda \
-    --hash=sha256:f407cb6b8e9d6d8c626bc73c945db1706035af8fd632295547bf1c9e46d092d6 \
-    --hash=sha256:f74a575920ab21fe304421a3fc28793d82e299cae9eccb37084e9fc7f3617c20
+numpy==2.2.6 \
+    --hash=sha256:038613e9fb8c72b0a41f025a7e4c3f0b7a1b5d768ece4796b674c8f3fe13efff \
+    --hash=sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47 \
+    --hash=sha256:0811bb762109d9708cca4d0b13c4f67146e3c3b7cf8d34018c722adb2d957c84 \
+    --hash=sha256:0b605b275d7bd0c640cad4e5d30fa701a8d59302e127e5f79138ad62762c3e3d \
+    --hash=sha256:0bca768cd85ae743b2affdc762d617eddf3bcf8724435498a1e80132d04879e6 \
+    --hash=sha256:1bc23a79bfabc5d056d106f9befb8d50c31ced2fbc70eedb8155aec74a45798f \
+    --hash=sha256:287cc3162b6f01463ccd86be154f284d0893d2b3ed7292439ea97eafa8170e0b \
+    --hash=sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49 \
+    --hash=sha256:37e990a01ae6ec7fe7fa1c26c55ecb672dd98b19c3d0e1d1f326fa13cb38d163 \
+    --hash=sha256:389d771b1623ec92636b0786bc4ae56abafad4a4c513d36a55dce14bd9ce8571 \
+    --hash=sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42 \
+    --hash=sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff \
+    --hash=sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491 \
+    --hash=sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4 \
+    --hash=sha256:55a4d33fa519660d69614a9fad433be87e5252f4b03850642f88993f7b2ca566 \
+    --hash=sha256:5a6429d4be8ca66d889b7cf70f536a397dc45ba6faeb5f8c5427935d9592e9cf \
+    --hash=sha256:5bd4fc3ac8926b3819797a7c0e2631eb889b4118a9898c84f585a54d475b7e40 \
+    --hash=sha256:5beb72339d9d4fa36522fc63802f469b13cdbe4fdab4a288f0c441b74272ebfd \
+    --hash=sha256:6031dd6dfecc0cf9f668681a37648373bddd6421fff6c66ec1624eed0180ee06 \
+    --hash=sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282 \
+    --hash=sha256:74d4531beb257d2c3f4b261bfb0fc09e0f9ebb8842d82a7b4209415896adc680 \
+    --hash=sha256:7befc596a7dc9da8a337f79802ee8adb30a552a94f792b9c9d18c840055907db \
+    --hash=sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3 \
+    --hash=sha256:8e41fd67c52b86603a91c1a505ebaef50b3314de0213461c7a6e99c9a3beff90 \
+    --hash=sha256:8e9ace4a37db23421249ed236fdcdd457d671e25146786dfc96835cd951aa7c1 \
+    --hash=sha256:8fc377d995680230e83241d8a96def29f204b5782f371c532579b4f20607a289 \
+    --hash=sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab \
+    --hash=sha256:b0544343a702fa80c95ad5d3d608ea3599dd54d4632df855e4c8d24eb6ecfa1c \
+    --hash=sha256:b093dd74e50a8cba3e873868d9e93a85b78e0daf2e98c6797566ad8044e8363d \
+    --hash=sha256:b412caa66f72040e6d268491a59f2c43bf03eb6c96dd8f0307829feb7fa2b6fb \
+    --hash=sha256:b4f13750ce79751586ae2eb824ba7e1e8dba64784086c98cdbbcc6a42112ce0d \
+    --hash=sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a \
+    --hash=sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf \
+    --hash=sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1 \
+    --hash=sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2 \
+    --hash=sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a \
+    --hash=sha256:ce47521a4754c8f4593837384bd3424880629f718d87c5d44f8ed763edd63543 \
+    --hash=sha256:d042d24c90c41b54fd506da306759e06e568864df8ec17ccc17e9e884634fd00 \
+    --hash=sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c \
+    --hash=sha256:e1dda9c7e08dc141e0247a5b8f49cf05984955246a327d4c48bda16821947b2f \
+    --hash=sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd \
+    --hash=sha256:e3143e4451880bed956e706a3220b4e5cf6172ef05fcc397f6f36a550b1dd868 \
+    --hash=sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303 \
+    --hash=sha256:efd28d4e9cd7d7a8d39074a4d44c63eda73401580c5c76acda2ce969e0a38e83 \
+    --hash=sha256:f0fd6321b839904e15c46e0d257fdd101dd7f530fe03fd6359c1ea63738703f3 \
+    --hash=sha256:f1372f041402e37e5e633e586f62aa53de2eac8d98cbfb822806ce4bbefcb74d \
+    --hash=sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87 \
+    --hash=sha256:f447e6acb680fd307f40d3da4852208af94afdfab89cf850986c3ca00562f4fa \
+    --hash=sha256:f92729c95468a2f4f15e9bb94c432a9229d0d50de67304399627a943201baa2f \
+    --hash=sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae \
+    --hash=sha256:fc0c5673685c508a142ca65209b4e79ed6740a4ed6b2267dbba90f34b0b3cfda \
+    --hash=sha256:fc7b73d02efb0e18c000e9ad8b83480dfcd5dfd11065997ed4c6747470ae8915 \
+    --hash=sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249 \
+    --hash=sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de \
+    --hash=sha256:fee4236c876c4e8369388054d02d0e9bb84821feb1a64dd59e137e6511a551f8
     # via opencv-python-headless
-opencv-python-headless==5.0.0.93 \
-    --hash=sha256:030ca5e0837a2963ab36ef896baa9767eb8d2b83353fb28af5a521e40dd8756f \
-    --hash=sha256:09a872a157c1376ab922a69bbf22f9a95bcc7b658a9d8b436a60212b02b2eeb4 \
-    --hash=sha256:10818d91510e05c04568ae12b5cd120779c70c01bf897b001a6221fe430df80f \
-    --hash=sha256:1e55af3abfb462eeeabe5c775f12bdb36216d8a93a3583d69e6bd6e1d6ba7d00 \
-    --hash=sha256:829717b6a95554f273e49e357cee3b3a2a26b6f4842fbc1bed2b45bdd8f87e0e \
-    --hash=sha256:840bd717c21e5c11cadadc022a823315ea417f961213d06b4df010e019eb16f4 \
-    --hash=sha256:b82f9831daab90b725c7c1ee1b36cb5732c367096ac76d119e64e14eb70d5f3c \
-    --hash=sha256:c6bcd96b185975ea240d22cfdb15a1f6d080cc95264cfbe2621f21bb144d89b9 \
-    --hash=sha256:ed709fdf9aa0bd1f2ed8549e71d19449b03a675bb581eb292285f6861953be37
+opencv-python-headless==4.12.0.88 \
+    --hash=sha256:1e58d664809b3350c1123484dd441e1667cd7bed3086db1b9ea1b6f6cb20b50e \
+    --hash=sha256:236c8df54a90f4d02076e6f9c1cc763d794542e886c576a6fee46ec8ff75a7a9 \
+    --hash=sha256:365bb2e486b50feffc2d07a405b953a8f3e8eaa63865bc650034e5c71e7a5154 \
+    --hash=sha256:86b413bdd6c6bf497832e346cd5371995de148e579b9774f8eba686dee3f5528 \
+    --hash=sha256:aeb4b13ecb8b4a0beb2668ea07928160ea7c2cd2d9b5ef571bbee6bafe9cc8d0 \
+    --hash=sha256:cfdc017ddf2e59b6c2f53bc12d74b6b0be7ded4ec59083ea70763921af2b6c09 \
+    --hash=sha256:fde2cf5c51e4def5f2132d78e0c08f9c14783cd67356922182c6845b9af87dbd
     # via -r .github/scripts/requirements_dev.in
 pdf2image==1.17.0 \
     --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
     --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
     # via -r .github/scripts/requirements_dev.in
-pillow==12.3.0 \
-    --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \
-    --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \
-    --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \
-    --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \
-    --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
-    --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \
-    --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \
-    --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \
-    --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \
-    --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
-    --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \
-    --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \
-    --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \
-    --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \
-    --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \
-    --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \
-    --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
-    --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \
-    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
-    --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \
-    --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \
-    --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \
-    --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \
-    --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \
-    --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \
-    --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \
-    --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \
-    --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
-    --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \
-    --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \
-    --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \
-    --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \
-    --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \
-    --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \
-    --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \
-    --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \
-    --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \
-    --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \
-    --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
-    --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \
-    --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \
-    --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \
-    --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \
-    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
-    --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \
-    --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \
-    --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \
-    --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \
-    --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \
-    --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \
-    --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \
-    --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \
-    --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \
-    --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \
-    --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \
-    --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \
-    --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \
-    --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \
-    --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \
-    --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \
-    --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \
-    --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
-    --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
-    --hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \
-    --hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \
-    --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
-    --hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \
-    --hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \
-    --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
-    --hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \
-    --hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \
-    --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
-    --hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \
-    --hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \
-    --hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \
-    --hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \
-    --hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \
-    --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
-    --hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \
-    --hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \
-    --hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \
-    --hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \
-    --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
-    --hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \
-    --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
-    --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \
-    --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
+pillow==12.0.0 \
+    --hash=sha256:0869154a2d0546545cde61d1789a6524319fc1897d9ee31218eae7a60ccc5643 \
+    --hash=sha256:09f2d0abef9e4e2f349305a4f8cc784a8a6c2f58a8c4892eea13b10a943bd26e \
+    --hash=sha256:0b817e7035ea7f6b942c13aa03bb554fc44fea70838ea21f8eb31c638326584e \
+    --hash=sha256:0fd00cac9c03256c8b2ff58f162ebcd2587ad3e1f2e397eab718c47e24d231cc \
+    --hash=sha256:110486b79f2d112cf6add83b28b627e369219388f64ef2f960fef9ebaf54c642 \
+    --hash=sha256:1979f4566bb96c1e50a62d9831e2ea2d1211761e5662afc545fa766f996632f6 \
+    --hash=sha256:1ac11e8ea4f611c3c0147424eae514028b5e9077dd99ab91e1bd7bc33ff145e1 \
+    --hash=sha256:1b1b133e6e16105f524a8dec491e0586d072948ce15c9b914e41cdadd209052b \
+    --hash=sha256:1ee80a59f6ce048ae13cda1abf7fbd2a34ab9ee7d401c46be3ca685d1999a399 \
+    --hash=sha256:21f241bdd5080a15bc86d3466a9f6074a9c2c2b314100dd896ac81ee6db2f1ba \
+    --hash=sha256:266cd5f2b63ff316d5a1bba46268e603c9caf5606d44f38c2873c380950576ad \
+    --hash=sha256:26d9f7d2b604cd23aba3e9faf795787456ac25634d82cd060556998e39c6fa47 \
+    --hash=sha256:27f95b12453d165099c84f8a8bfdfd46b9e4bda9e0e4b65f0635430027f55739 \
+    --hash=sha256:2c54c1a783d6d60595d3514f0efe9b37c8808746a66920315bfd34a938d7994b \
+    --hash=sha256:2fa5f0b6716fc88f11380b88b31fe591a06c6315e955c096c35715788b339e3f \
+    --hash=sha256:32ed80ea8a90ee3e6fa08c21e2e091bba6eda8eccc83dbc34c95169507a91f10 \
+    --hash=sha256:3830c769decf88f1289680a59d4f4c46c72573446352e2befec9a8512104fa52 \
+    --hash=sha256:38df9b4bfd3db902c9c2bd369bcacaf9d935b2fff73709429d95cc41554f7b3d \
+    --hash=sha256:3adfb466bbc544b926d50fe8f4a4e6abd8c6bffd28a26177594e6e9b2b76572b \
+    --hash=sha256:3e42edad50b6909089750e65c91aa09aaf1e0a71310d383f11321b27c224ed8a \
+    --hash=sha256:4078242472387600b2ce8d93ade8899c12bf33fa89e55ec89fe126e9d6d5d9e9 \
+    --hash=sha256:455247ac8a4cfb7b9bc45b7e432d10421aea9fc2e74d285ba4072688a74c2e9d \
+    --hash=sha256:4cc6b3b2efff105c6a1656cfe59da4fdde2cda9af1c5e0b58529b24525d0a098 \
+    --hash=sha256:4cf7fed4b4580601c4345ceb5d4cbf5a980d030fd5ad07c4d2ec589f95f09905 \
+    --hash=sha256:5193fde9a5f23c331ea26d0cf171fbf67e3f247585f50c08b3e205c7aeb4589b \
+    --hash=sha256:5269cc1caeedb67e6f7269a42014f381f45e2e7cd42d834ede3c703a1d915fe3 \
+    --hash=sha256:53561a4ddc36facb432fae7a9d8afbfaf94795414f5cdc5fc52f28c1dca90371 \
+    --hash=sha256:55f818bd74fe2f11d4d7cbc65880a843c4075e0ac7226bc1a23261dbea531953 \
+    --hash=sha256:58eea5ebe51504057dd95c5b77d21700b77615ab0243d8152793dc00eb4faf01 \
+    --hash=sha256:5d5c411a8eaa2299322b647cd932586b1427367fd3184ffbb8f7a219ea2041ca \
+    --hash=sha256:6846bd2d116ff42cba6b646edf5bf61d37e5cbd256425fa089fee4ff5c07a99e \
+    --hash=sha256:6ace95230bfb7cd79ef66caa064bbe2f2a1e63d93471c3a2e1f1348d9f22d6b7 \
+    --hash=sha256:6e51b71417049ad6ab14c49608b4a24d8fb3fe605e5dfabfe523b58064dc3d27 \
+    --hash=sha256:71db6b4c1653045dacc1585c1b0d184004f0d7e694c7b34ac165ca70c0838082 \
+    --hash=sha256:7438839e9e053ef79f7112c881cef684013855016f928b168b81ed5835f3e75e \
+    --hash=sha256:759de84a33be3b178a64c8ba28ad5c135900359e85fb662bc6e403ad4407791d \
+    --hash=sha256:792a2c0be4dcc18af9d4a2dfd8a11a17d5e25274a1062b0ec1c2d79c76f3e7f8 \
+    --hash=sha256:7d87ef5795da03d742bf49439f9ca4d027cde49c82c5371ba52464aee266699a \
+    --hash=sha256:7dfb439562f234f7d57b1ac6bc8fe7f838a4bd49c79230e0f6a1da93e82f1fad \
+    --hash=sha256:7fa22993bac7b77b78cae22bad1e2a987ddf0d9015c63358032f84a53f23cdc3 \
+    --hash=sha256:805ebf596939e48dbb2e4922a1d3852cfc25c38160751ce02da93058b48d252a \
+    --hash=sha256:82240051c6ca513c616f7f9da06e871f61bfd7805f566275841af15015b8f98d \
+    --hash=sha256:87d4f8125c9988bfbed67af47dd7a953e2fc7b0cc1e7800ec6d2080d490bb353 \
+    --hash=sha256:8d8ca2b210ada074d57fcee40c30446c9562e542fc46aedc19baf758a93532ee \
+    --hash=sha256:8dc232e39d409036af549c86f24aed8273a40ffa459981146829a324e0848b4b \
+    --hash=sha256:90387104ee8400a7b4598253b4c406f8958f59fcf983a6cea2b50d59f7d63d0b \
+    --hash=sha256:905b0365b210c73afb0ebe9101a32572152dfd1c144c7e28968a331b9217b94a \
+    --hash=sha256:99353a06902c2e43b43e8ff74ee65a7d90307d82370604746738a1e0661ccca7 \
+    --hash=sha256:99a7f72fb6249302aa62245680754862a44179b545ded638cf1fef59befb57ef \
+    --hash=sha256:9f0b04c6b8584c2c193babcccc908b38ed29524b29dd464bc8801bf10d746a3a \
+    --hash=sha256:9fe611163f6303d1619bbcb653540a4d60f9e55e622d60a3108be0d5b441017a \
+    --hash=sha256:a3475b96f5908b3b16c47533daaa87380c491357d197564e0ba34ae75c0f3257 \
+    --hash=sha256:a6597ff2b61d121172f5844b53f21467f7082f5fb385a9a29c01414463f93b07 \
+    --hash=sha256:a7921c5a6d31b3d756ec980f2f47c0cfdbce0fc48c22a39347a895f41f4a6ea4 \
+    --hash=sha256:aa5129de4e174daccbc59d0a3b6d20eaf24417d59851c07ebb37aeb02947987c \
+    --hash=sha256:aeaefa96c768fc66818730b952a862235d68825c178f1b3ffd4efd7ad2edcb7c \
+    --hash=sha256:afbefa430092f71a9593a99ab6a4e7538bc9eabbf7bf94f91510d3503943edc4 \
+    --hash=sha256:aff9e4d82d082ff9513bdd6acd4f5bd359f5b2c870907d2b0a9c5e10d40c88fe \
+    --hash=sha256:b22bd8c974942477156be55a768f7aa37c46904c175be4e158b6a86e3a6b7ca8 \
+    --hash=sha256:b290fd8aa38422444d4b50d579de197557f182ef1068b75f5aa8558638b8d0a5 \
+    --hash=sha256:b2e4b27a6e15b04832fe9bf292b94b5ca156016bbc1ea9c2c20098a0320d6cf6 \
+    --hash=sha256:b583dc9070312190192631373c6c8ed277254aa6e6084b74bdd0a6d3b221608e \
+    --hash=sha256:b87843e225e74576437fd5b6a4c2205d422754f84a06942cfaf1dc32243e45a8 \
+    --hash=sha256:bc91a56697869546d1b8f0a3ff35224557ae7f881050e99f615e0119bf934b4e \
+    --hash=sha256:bd87e140e45399c818fac4247880b9ce719e4783d767e030a883a970be632275 \
+    --hash=sha256:bde737cff1a975b70652b62d626f7785e0480918dece11e8fef3c0cf057351c3 \
+    --hash=sha256:bdee52571a343d721fb2eb3b090a82d959ff37fc631e3f70422e0c2e029f3e76 \
+    --hash=sha256:bee2a6db3a7242ea309aa7ee8e2780726fed67ff4e5b40169f2c940e7eb09227 \
+    --hash=sha256:beeae3f27f62308f1ddbcfb0690bf44b10732f2ef43758f169d5e9303165d3f9 \
+    --hash=sha256:c50f36a62a22d350c96e49ad02d0da41dbd17ddc2e29750dbdba4323f85eb4a5 \
+    --hash=sha256:c607c90ba67533e1b2355b821fef6764d1dd2cbe26b8c1005ae84f7aea25ff79 \
+    --hash=sha256:c7b2a63fd6d5246349f3d3f37b14430d73ee7e8173154461785e43036ffa96ca \
+    --hash=sha256:c828a1ae702fc712978bda0320ba1b9893d99be0badf2647f693cc01cf0f04fa \
+    --hash=sha256:c85de1136429c524e55cfa4e033b4a7940ac5c8ee4d9401cc2d1bf48154bbc7b \
+    --hash=sha256:c98fa880d695de164b4135a52fd2e9cd7b7c90a9d8ac5e9e443a24a95ef9248e \
+    --hash=sha256:cae81479f77420d217def5f54b5b9d279804d17e982e0f2fa19b1d1e14ab5197 \
+    --hash=sha256:d034140032870024e6b9892c692fe2968493790dd57208b2c37e3fb35f6df3ab \
+    --hash=sha256:d120c38a42c234dc9a8c5de7ceaaf899cf33561956acb4941653f8bdc657aa79 \
+    --hash=sha256:d4827615da15cd59784ce39d3388275ec093ae3ee8d7f0c089b76fa87af756c2 \
+    --hash=sha256:d49e2314c373f4c2b39446fb1a45ed333c850e09d0c59ac79b72eb3b95397363 \
+    --hash=sha256:d52610d51e265a51518692045e372a4c363056130d922a7351429ac9f27e70b0 \
+    --hash=sha256:d64317d2587c70324b79861babb9c09f71fbb780bad212018874b2c013d8600e \
+    --hash=sha256:d77153e14b709fd8b8af6f66a3afbb9ed6e9fc5ccf0b6b7e1ced7b036a228782 \
+    --hash=sha256:d7e091d464ac59d2c7ad8e7e08105eaf9dafbc3883fd7265ffccc2baad6ac925 \
+    --hash=sha256:dd333073e0cacdc3089525c7df7d39b211bcdf31fc2824e49d01c6b6187b07d0 \
+    --hash=sha256:e5d8efac84c9afcb40914ab49ba063d94f5dbdf5066db4482c66a992f47a3a3b \
+    --hash=sha256:f135c702ac42262573fe9714dfe99c944b4ba307af5eb507abef1667e2cbbced \
+    --hash=sha256:f13711b1a5ba512d647a0e4ba79280d3a9a045aaf7e0cc6fbe96b91d4cdf6b0c \
+    --hash=sha256:f4f1231b7dec408e8670264ce63e9c71409d9583dd21d32c163e25213ee2a344 \
+    --hash=sha256:fa3ed2a29a9e9d2d488b4da81dcb54720ac3104a20bf0bd273f1e4648aff5af9 \
+    --hash=sha256:fb3096c30df99fd01c7bf8e544f392103d0795b9f98ba71a8054bcbf56b255f1
     # via
     #   -r .github/scripts/requirements_dev.in
     #   pdf2image
     #   weasyprint
-platformdirs==4.10.0 \
-    --hash=sha256:31e761a6a0ca04faf7353ea759bdba55652be214725111e5aac52dfa29d4bef7 \
-    --hash=sha256:fb516cdb12eb0d857d0cd85a7c57cea4d060bee4578d6cf5a14dfdf8cbf8784a
-    # via
-    #   python-discovery
-    #   virtualenv
-pre-commit==4.6.0 \
-    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
-    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+platformdirs==4.5.0 \
+    --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
+    --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
+    # via virtualenv
+pre-commit==4.3.0 \
+    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
+    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
     # via -r .github/scripts/requirements_dev.in
-pycparser==3.0 \
-    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
-    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+pycparser==2.23 \
+    --hash=sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2 \
+    --hash=sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934
     # via cffi
-pydyf==0.12.1 \
-    --hash=sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc \
-    --hash=sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095
+pydyf==0.11.0 \
+    --hash=sha256:0aaf9e2ebbe786ec7a78ec3fbffa4cdcecde53fd6f563221d53c6bc1328848a3 \
+    --hash=sha256:394dddf619cca9d0c55715e3c55ea121a9bf9cbc780cdc1201a2427917b86b64
     # via weasyprint
 pyphen==0.17.2 \
     --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
     --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
     # via weasyprint
-python-discovery==1.4.4 \
-    --hash=sha256:5cad33982d412c1f3ffb8f9ca4ea292c9680bca3942451d30b69c37fce53a4a3 \
-    --hash=sha256:abebe9120b43453b68c908acfb1e72a19d1a959ed2cb620ad38fc57d08056dbe
-    # via virtualenv
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
     --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -472,27 +442,27 @@ pyyaml==6.0.3 \
     --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
     --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
     # via pre-commit
-tinycss2==1.5.1 \
-    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
-    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
+tinycss2==1.4.0 \
+    --hash=sha256:10c0972f6fc0fbee87c3edb76549357415e94548c1ae10ebccdea16fb404a9b7 \
+    --hash=sha256:3a49cf47b7675da0b15d0c6e1df8df4ebd96e9394bb905a5775adb0d884c5289
     # via
     #   cssselect2
     #   weasyprint
-tinyhtml5==2.1.0 \
-    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
-    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
+tinyhtml5==2.0.0 \
+    --hash=sha256:086f998833da24c300c414d9fe81d9b368fd04cb9d2596a008421cbc705fcfcc \
+    --hash=sha256:13683277c5b176d070f82d099d977194b7a1e26815b016114f581a74bbfbf47e
     # via weasyprint
-unoserver==3.7 \
-    --hash=sha256:b05f9578506ac7374ae1b314c3a79528636c542ac78220a9ce99110584ca424b \
-    --hash=sha256:fc44e6808071c9d2957e705ecf1742cea8a582aa5d5cc23babf36bb332ec6e8e
+unoserver==3.4 \
+    --hash=sha256:3dcf2204013def1d1ddd3671f38b11346bdf349fef9728277462666a8a634419 \
+    --hash=sha256:64c24d33d4f65d680a2d9f676518cb28e7fd6c1f9d9a745c33e4a4cb59afdfcd
     # via -r .github/scripts/requirements_dev.in
-virtualenv==21.6.1 \
-    --hash=sha256:15f978b7cd329f24855ff4a0c4b4899cc7678589f49adbdcbbb4d3232e641128 \
-    --hash=sha256:afe991df855715a2b2f60edfcc0107ef95a79fdfd8cb4cdaa71603d1c12e463b
+virtualenv==20.35.4 \
+    --hash=sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c \
+    --hash=sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b
     # via pre-commit
-weasyprint==69.0 \
-    --hash=sha256:475951cfd917014de6d4d005caff48c6aa867e7e42b80cd5b16a0484a1609ee6 \
-    --hash=sha256:a7a32f39ca16bd82ef11de99c92ea4b5f14951c9033af035e451ce4f4ee0a88c
+weasyprint==66.0 \
+    --hash=sha256:82b0783b726fcd318e2c977dcdddca76515b30044bc7a830cc4fbe717582a6d0 \
+    --hash=sha256:da71dc87dc129ac9cffdc65e5477e90365ab9dbae45c744014ec1d06303dde40
     # via -r .github/scripts/requirements_dev.in
 webencodings==0.5.1 \
     --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
@@ -501,28 +471,86 @@ webencodings==0.5.1 \
     #   cssselect2
     #   tinycss2
     #   tinyhtml5
-zopfli==0.4.3 \
-    --hash=sha256:0087c9a6f0c8a052be0f6d1a9bb71b6caffdd3e10201d6d6166e28d482cebe6d \
-    --hash=sha256:47604eee5c6704bdf0e94d8391fe3b74ddb2abd84128fbcfdc3ee0fc265feaef \
-    --hash=sha256:62248dbf8dbcbd588ee194b210e5be9fa80bce29641f55599d6d394bd2a9d8a3 \
-    --hash=sha256:628c3e941752880b3491db8d44163d0aedb221944e22a17187ff7fc549b050f6 \
-    --hash=sha256:769875152d0625c46707bcca57d4b2233fe653482067acd55fbf6ec525cb9bdc \
-    --hash=sha256:7e9703ca6e7ef66c8d05e0826b6f558b680c9db8206f84f05a3ee93430a12e42 \
-    --hash=sha256:7fa3c35193475290e3f007bbcdebdbae64ba2f012d75c632da0d727e1da50d5e \
-    --hash=sha256:88f4fbe429aad72bc206275d81fab11a097e0f951a5848d1f51083c37ea73073 \
-    --hash=sha256:921c2c9907f4364963848da5ad194b46d68865e07fdb975d04fd09bc42d47357 \
-    --hash=sha256:d3a50f91a13cea9bafe025de8fd87a005eb26de02a4f0c193127ddbf23ac8ebe \
-    --hash=sha256:d4f51dd1ab5312e837e2091284e0d9f1a138188f2e65812f9a5799dc02c45f94 \
-    --hash=sha256:eb0c9c1d40a8cb1d58762d7e57290ccb753e0828c4d01be8acb59aae5d0ca206 \
-    --hash=sha256:f2e0adcf7d36c6fd0dd36cc771ef7f0c5803a05666feafcd90d7170174a4148e
+zopfli==0.2.3.post1 \
+    --hash=sha256:0aa5f90d6298bda02a95bc8dc8c3c19004d5a4e44bda00b67ca7431d857b4b54 \
+    --hash=sha256:0cc20b02a9531559945324c38302fd4ba763311632d0ec8a1a0aa9c10ea363e6 \
+    --hash=sha256:1d8cc06605519e82b16df090e17cb3990d1158861b2872c3117f1168777b81e4 \
+    --hash=sha256:1f990634fd5c5c8ced8edddd8bd45fab565123b4194d6841e01811292650acae \
+    --hash=sha256:2345e713260a350bea0b01a816a469ea356bc2d63d009a0d777691ecbbcf7493 \
+    --hash=sha256:2768c877f76c8a0e7519b1c86c93757f3c01492ddde55751e9988afb7eff64e1 \
+    --hash=sha256:29ea74e72ffa6e291b8c6f2504ce6c146b4fe990c724c1450eb8e4c27fd31431 \
+    --hash=sha256:34a99592f3d9eb6f737616b5bd74b48a589fdb3cb59a01a50d636ea81d6af272 \
+    --hash=sha256:3654bfc927bc478b1c3f3ff5056ed7b20a1a37fa108ca503256d0a699c03bbb1 \
+    --hash=sha256:3657e416ffb8f31d9d3424af12122bb251befae109f2e271d87d825c92fc5b7b \
+    --hash=sha256:37d011e92f7b9622742c905fdbed9920a1d0361df84142807ea2a528419dea7f \
+    --hash=sha256:3827170de28faf144992d3d4dcf8f3998fe3c8a6a6f4a08f1d42c2ec6119d2bb \
+    --hash=sha256:39e576f93576c5c223b41d9c780bbb91fd6db4babf3223d2a4fe7bf568e2b5a8 \
+    --hash=sha256:3a89277ed5f8c0fb2d0b46d669aa0633123aa7381f1f6118c12f15e0fb48f8ca \
+    --hash=sha256:3c163911f8bad94b3e1db0a572e7c28ba681a0c91d0002ea1e4fa9264c21ef17 \
+    --hash=sha256:3f0197b6aa6eb3086ae9e66d6dd86c4d502b6c68b0ec490496348ae8c05ecaef \
+    --hash=sha256:48dba9251060289101343110ab47c0756f66f809bb4d1ddbb6d5c7e7752115c5 \
+    --hash=sha256:4915a41375bdee4db749ecd07d985a0486eb688a6619f713b7bf6fbfd145e960 \
+    --hash=sha256:4c1226a7e2c7105ac31503a9bb97454743f55d88164d6d46bc138051b77f609b \
+    --hash=sha256:4e50ffac74842c1c1018b9b73875a0d0a877c066ab06bf7cccbaa84af97e754f \
+    --hash=sha256:518f1f4ed35dd69ce06b552f84e6d081f07c552b4c661c5312d950a0b764a58a \
+    --hash=sha256:5aad740b4d4fcbaaae4887823925166ffd062db3b248b3f432198fc287381d1a \
+    --hash=sha256:5f272186e03ad55e7af09ab78055535c201b1a0bcc2944edb1768298d9c483a4 \
+    --hash=sha256:5fcfc0dc2761e4fcc15ad5d273b4d58c2e8e059d3214a7390d4d3c8e2aee644e \
+    --hash=sha256:60db20f06c3d4c5934b16cfa62a2cc5c3f0686bffe0071ed7804d3c31ab1a04e \
+    --hash=sha256:615a8ac9dda265e9cc38b2a76c3142e4a9f30fea4a79c85f670850783bc6feb4 \
+    --hash=sha256:6482db9876c68faac2d20a96b566ffbf65ddaadd97b222e4e73641f4f8722fc4 \
+    --hash=sha256:6617fb10f9e4393b331941861d73afb119cd847e88e4974bdbe8068ceef3f73f \
+    --hash=sha256:676919fba7311125244eb0c4393679ac5fe856e5864a15d122bd815205369fa0 \
+    --hash=sha256:6c2d2bc8129707e34c51f9352c4636ca313b52350bbb7e04637c46c1818a2a70 \
+    --hash=sha256:71390dbd3fbf6ebea9a5d85ffed8c26ee1453ee09248e9b88486e30e0397b775 \
+    --hash=sha256:716cdbfc57bfd3d3e31a58e6246e8190e6849b7dbb7c4ce39ef8bbf0edb8f6d5 \
+    --hash=sha256:75a26a2307b10745a83b660c404416e984ee6fca515ec7f0765f69af3ce08072 \
+    --hash=sha256:7be5cc6732eb7b4df17305d8a7b293223f934a31783a874a01164703bc1be6cd \
+    --hash=sha256:7cce242b5df12b2b172489daf19c32e5577dd2fac659eb4b17f6a6efb446fd5c \
+    --hash=sha256:81c341d9bb87a6dbbb0d45d6e272aca80c7c97b4b210f9b6e233bf8b87242f29 \
+    --hash=sha256:89899641d4de97dbad8e0cde690040d078b6aea04066dacaab98e0b5a23573f2 \
+    --hash=sha256:8d5ab297d660b75c159190ce6d73035502310e40fd35170aed7d1a1aea7ddd65 \
+    --hash=sha256:8fbe5bcf10d01aab3513550f284c09fef32f342b36f56bfae2120a9c4d12c130 \
+    --hash=sha256:91a2327a4d7e77471fa4fbb26991c6de4a738c6fc6a33e09bb25f56a870a4b7b \
+    --hash=sha256:95a260cafd56b8fffa679918937401c80bb38e1681c448b988022e4c3610965d \
+    --hash=sha256:96484dc0f48be1c5d7ae9f38ed1ce41e3675fd506b27c11a6607f14b49101e99 \
+    --hash=sha256:9a6aec38a989bad7ddd1ef53f1265699e49e294d08231b5313d61293f3cd6237 \
+    --hash=sha256:9ba214f4f45bec195ee8559651154d3ac2932470b9d91c5715fc29c013349f8c \
+    --hash=sha256:9f4a7ec2770e6af05f5a02733fd3900f30a9cd58e5d6d3727e14c5bcd6e7d587 \
+    --hash=sha256:a1cf720896d2ce998bc8e051d4b4ce0d8bec007aab6243102e8e1d22a0b2fb3f \
+    --hash=sha256:a241a68581d34d67b40c425cce3d1fd211c092f99d9250947824ccba9f491949 \
+    --hash=sha256:a53b18797cdef27e019db595d66c4b077325afe2fd62145953275f53d84ce40c \
+    --hash=sha256:a82fc2dbebe6eb908b9c665e71496f8525c1bc4d2e3a7a7722ef2b128b6227c8 \
+    --hash=sha256:a86eb88e06bd87e1fff31dac878965c26b0c26db59ddcf78bb0379a954b120de \
+    --hash=sha256:aa588b21044f8a74e423d8c8a4c7fc9988501878aacced793467010039c50734 \
+    --hash=sha256:b05296e8bc88c92e2b21e0a9bae4740c1551ee613c1d93a51fd28a7a0b2b6fbb \
+    --hash=sha256:b0ec13f352ea5ae0fc91f98a48540512eed0767d0ec4f7f3cb92d92797983d18 \
+    --hash=sha256:b3df42f52502438ee973042cc551877d24619fa1cd38ef7b7e9ac74200daca8b \
+    --hash=sha256:b78008a69300d929ca2efeffec951b64a312e9a811e265ea4a907ab546d79fa6 \
+    --hash=sha256:b9026a21b6d41eb0e2e63f5bc1242c3fcc43ecb770963cda99a4307863dac12e \
+    --hash=sha256:bbe429fc50686bb2a2608a30843e36fbaa123462a5284f136c7d9e0145220bfd \
+    --hash=sha256:bfa1eb759e07d8b7aa7a310a2bc535e127ee70addf90dc8d4b946b593c3e51a8 \
+    --hash=sha256:c1e0ed5d84ffa2d677cc9582fc01e61dab2e7ef8b8996e055f0a76167b1b94df \
+    --hash=sha256:c4278d1873ce6e803e5d4f8d702fd3026bd67fca744aa98881324d1157ddf748 \
+    --hash=sha256:cac2b37ab21c2b36a10b685b1893ebd6b0f83ae26004838ac817680881576567 \
+    --hash=sha256:cbe6df25807227519debd1a57ab236f5f6bad441500e85b13903e51f93a43214 \
+    --hash=sha256:cd2c002f160502608dcc822ed2441a0f4509c52e86fcfd1a09e937278ed1ca14 \
+    --hash=sha256:e0137dd64a493ba6a4be37405cfd6febe650a98cc1e9dca8f6b8c63b1db11b41 \
+    --hash=sha256:e63d558847166543c2c9789e6f985400a520b7eacc4b99181668b2c3aeadd352 \
+    --hash=sha256:eb45a34f23da4f8bc712b6376ca5396914b0b7c09adbb001dad964eb7f3132f8 \
+    --hash=sha256:ecb7572df5372abce8073df078207d9d1749f20b8b136089916a4a0868d56051 \
+    --hash=sha256:f12000a6accdd4bf0a3fa6eaa1b1c7a7bc80af0a2edf3f89d770d3dcce1d0e22 \
+    --hash=sha256:f7d69c1a7168ad0e9cb864e8663acb232986a0c9c9cb9801f56bf6214f53a54d \
+    --hash=sha256:f815fcc2b2a457977724bad97fb4854022980f51ce7b136925e336b530545ae1 \
+    --hash=sha256:fc39f5c27f962ec8660d8d20c24762431131b5d8c672b44b0a54cf2b5bcde9b9
     # via fonttools
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==26.1.2 \
-    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
-    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
+pip==25.3 \
+    --hash=sha256:8d0538dbbd7babbd207f261ed969c65de439f6bc9e5dbd3b3b9a77f25d95f343 \
+    --hash=sha256:9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd
     # via -r .github/scripts/requirements_dev.in
-setuptools==83.0.0 \
-    --hash=sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef \
-    --hash=sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3
+setuptools==80.9.0 \
+    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922 \
+    --hash=sha256:f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c
     # via -r .github/scripts/requirements_dev.in

.github/scripts/requirements_pre_commit.in

@@ -0,0 +1 @@
+pre-commit

.github/scripts/requirements_pre_commit.txt

@@ -0,0 +1,113 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
+#
+cfgv==3.4.0 \
+    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
+    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
+    # via pre-commit
+distlib==0.4.0 \
+    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
+    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
+    # via virtualenv
+filelock==3.20.0 \
+    --hash=sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2 \
+    --hash=sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4
+    # via virtualenv
+identify==2.6.15 \
+    --hash=sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757 \
+    --hash=sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf
+    # via pre-commit
+nodeenv==1.9.1 \
+    --hash=sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f \
+    --hash=sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9
+    # via pre-commit
+platformdirs==4.5.0 \
+    --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
+    --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
+    # via virtualenv
+pre-commit==4.3.0 \
+    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
+    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
+    # via -r .github/scripts/requirements_pre_commit.in
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via pre-commit
+virtualenv==20.35.4 \
+    --hash=sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c \
+    --hash=sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b
+    # via pre-commit

.github/scripts/requirements_sync_readme.in

@@ -1,2 +1 @@
 tomlkit
-tomli-w

.github/scripts/requirements_sync_readme.txt

@@ -1,14 +1,10 @@
 #
-# This file is autogenerated by pip-compile with Python 3.13
+# This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
 #
-tomli-w==1.2.0 \
-    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
-    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
-    # via -r .github/scripts/requirements_sync_readme.in
-tomlkit==0.15.0 \
-    --hash=sha256:4dbc8f0fc024412b57ced8757ac7461305126a648ff8c2c807fcb8e133a78738 \
-    --hash=sha256:7d1a9ecba3086638211b13814ea79c90dd54dd11993564376f3aa92271f5c7a3
+tomlkit==0.13.3 \
+    --hash=sha256:430cf247ee57df2b94ee3fbe588e71d362a941ebb545dec29b53961d61add2a1 \
+    --hash=sha256:c89c649d79ee40629a9fda55f8ace8c6a1b42deb912b2a8fd8d942ddadb606b0
     # via -r .github/scripts/requirements_sync_readme.in

.github/scripts/verify-updater-signatures.py

@@ -1,81 +0,0 @@
-#!/usr/bin/env python3
-"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
-
-Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
-"""
-
-import binascii
-import sys
-import json
-import base64
-import hashlib
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from cryptography.exceptions import InvalidSignature
-
-ART_ROOT = Path(sys.argv[1])
-CONF = Path(sys.argv[2] if len(sys.argv) > 2 else "frontend/src-tauri/tauri.conf.json")
-
-
-def load_pubkey():
-    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
-    # [2 algo][8 key-id][32 ed25519 public key].
-    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
-    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
-    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
-
-
-def hash_file(path: Path) -> bytes:
-    h = hashlib.blake2b(digest_size=64)
-    with path.open("rb") as f:
-        for chunk in iter(lambda: f.read(1 << 16), b""):
-            h.update(chunk)
-    return h.digest()
-
-
-def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
-    # tauri .sig = base64 of a minisign signature file (4 lines).
-    try:
-        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
-        sig_blob = base64.b64decode(lines[1])
-    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
-        return f"FAIL malformed sig ({type(e).__name__})"
-    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
-    if keyid != keyid_pub:
-        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
-    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
-    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
-    try:
-        pub.verify(sig, msg)
-    except InvalidSignature:
-        return f"FAIL signature invalid (algo={algo.decode()})"
-    # Global signature covers sig + trusted_comment.
-    gc = "global-sig FAIL"
-    try:
-        tc = lines[2].split("trusted comment: ", 1)[1]
-        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
-        gc = "global-sig OK"
-    except (InvalidSignature, IndexError, binascii.Error):
-        pass
-    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
-
-
-keyid_pub, pub = load_pubkey()
-print(f"updater pubkey keyid={keyid_pub.hex()}\n")
-sigs = sorted(ART_ROOT.rglob("*.sig"))
-if not sigs:
-    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
-    sys.exit(0)
-bad = 0
-for sig_file in sigs:
-    artifact = sig_file.with_suffix("")
-    if not artifact.exists():
-        print(f"  ? {sig_file.name}: artifact missing")
-        bad += 1
-        continue
-    res = verify(artifact, sig_file, keyid_pub, pub)
-    print(f"  {artifact.name}: {res}")
-    if not res.startswith("VALID") or "global-sig FAIL" in res:
-        bad += 1
-print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
-sys.exit(1 if bad else 0)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -11,10 +11,6 @@ on:
       allow_fork:
         description: "Allow deploying fork PR?"
         required: false
-        type: choice
-        options:
-          - "true"
-          - "false"
         default: "false"
 
 permissions:
@@ -35,18 +31,18 @@ jobs:
       pr_ref: ${{ steps.resolve.outputs.ref }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Resolve PR info
         id: resolve
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { owner, repo } = context.repo;
             let prNumber = context.eventName === 'workflow_dispatch'
-              ? parseInt(context.payload.inputs.pr, 10)
+              ? parseInt(process.env.INPUT_PR, 10)
               : context.payload.number;
 
             if (!Number.isInteger(prNumber)) { core.setFailed('Invalid PR number'); return; }
@@ -108,19 +104,15 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
-    env:
-      # Single source of truth for whether this preview embeds the admin portal:
-      # drives the image build-arg and the deployment comment.
-      BUILD_PORTAL: "true"
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Checkout main repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: ${{ github.repository }}
           ref: main
@@ -136,13 +128,13 @@ jobs:
 
       - name: Add deployment started comment
         id: deployment-started
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
-
+            
             // Delete previous V2 deployment comments to avoid clutter
             const { data: comments } = await github.rest.issues.listComments({
               owner,
@@ -165,7 +157,7 @@ jobs:
                 comment_id: comment.id
               });
             }
-
+            
             // Create new deployment started comment
             const { data: newComment } = await github.rest.issues.createComment({
               owner,
@@ -176,15 +168,15 @@ jobs:
             return newComment.id;
 
       - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: ${{ needs.check-pr.outputs.pr_repository }}
           ref: ${{ needs.check-pr.outputs.pr_ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0 # Fetch full history for commit hash detection
+          fetch-depth: 0  # Fetch full history for commit hash detection
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Get version number
         id: versionNumber
@@ -193,60 +185,93 @@ jobs:
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
-      - name: Get commit hash for app
-        id: commit-hash
+      - name: Get commit hashes for frontend and backend
+        id: commit-hashes
         run: |
-          # Get last commit that touched the application code
-          APP_HASH=$(git log -1 --format="%H" -- . 2>/dev/null || echo "")
-          if [ -z "$APP_HASH" ]; then
-            APP_HASH="no-changes"
+          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
+          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$FRONTEND_HASH" ]; then
+            FRONTEND_HASH="no-frontend-changes"
           fi
 
-          echo "App hash: $APP_HASH"
-          echo "app_hash=$APP_HASH" >> $GITHUB_OUTPUT
-
-          # Short hash for tags
-          if [ "$APP_HASH" = "no-changes" ]; then
-            echo "app_short=no-changes" >> $GITHUB_OUTPUT
+          # Get last commit that touched backend code, docker/backend, or docker/compose
+          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
+          if [ -z "$BACKEND_HASH" ]; then
+            BACKEND_HASH="no-backend-changes"
+          fi
+          
+          echo "Frontend hash: $FRONTEND_HASH"
+          echo "Backend hash: $BACKEND_HASH"
+          
+          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
+          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
+          
+          # Short hashes for tags
+          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
+            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
           else
-            echo "app_short=${APP_HASH:0:8}" >> $GITHUB_OUTPUT
+            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
+          fi
+          
+          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
+            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
+          else
+            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
           fi
 
-      - name: Check if image exists
-        id: check-image
+      - name: Check if frontend image exists
+        id: check-frontend
         run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
             echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Image already exists, skipping build"
+            echo "Frontend image already exists, skipping build"
           else
             echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Image needs to be built"
+            echo "Frontend image needs to be built"
           fi
 
-      - name: Build and push V2 image
-        if: steps.check-image.outputs.exists == 'false'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - name: Check if backend image exists
+        id: check-backend
+        run: |
+          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Backend image already exists, skipping build"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Backend image needs to be built"
+          fi
+
+      - name: Build and push V2 frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./docker/frontend/Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: |
-            VERSION_TAG=v2-alpha
-            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+          build-args: VERSION_TAG=v2-alpha
+          platforms: linux/amd64
+
+      - name: Build and push V2 backend image
+        if: steps.check-backend.outputs.exists == 'false'
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          file: ./docker/backend/Dockerfile
+          push: true
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
+          build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Deploy V2 to VPS
@@ -254,30 +279,29 @@ jobs:
         run: |
           # Use same port strategy as regular PRs - just the PR number
           V2_PORT=${{ needs.check-pr.outputs.pr_number }}
-
-          # Create docker-compose for V2 with unified embedded image
+          BACKEND_PORT=$((V2_PORT + 10000))  # Backend on higher port to avoid conflicts
+          
+          # Create docker-compose for V2 with separate frontend and backend
           cat > docker-compose.yml << EOF
           version: '3.3'
           services:
-            stirling-pdf-v2:
-              container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
+            stirling-pdf-v2-backend:
+              container_name: stirling-pdf-v2-backend-pr-${{ needs.check-pr.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
               ports:
-                - "${V2_PORT}:8080"
+                - "${BACKEND_PORT}:8080"    # Backend API port
               volumes:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "false"
-                STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
                 SECURITY_ENABLELOGIN: "true"
                 SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
                 SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
-                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
+                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
                 UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 SYSTEM_MAXFILESIZE: "100"
                 METRICS_ENABLED: "true"
@@ -285,14 +309,25 @@ jobs:
                 SWAGGER_SERVER_URL: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
                 baseUrl: "https://${V2_PORT}.ssl.stirlingpdf.cloud"
               restart: on-failure:5
+
+            stirling-pdf-v2-frontend:
+              container_name: stirling-pdf-v2-frontend-pr-${{ needs.check-pr.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
+              ports:
+                - "${V2_PORT}:80"          # Frontend port (same as regular PRs)
+              environment:
+                VITE_API_BASE_URL: "http://${{ secrets.VPS_HOST }}:${BACKEND_PORT}"
+              depends_on:
+                - stirling-pdf-v2-backend
+              restart: on-failure:5
           EOF
 
           # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose-v2.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
             # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
+            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}
 
             # Move docker-compose file to correct location
             mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml
@@ -300,92 +335,31 @@ jobs:
             # Stop any existing container and clean up
             cd /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}
             docker-compose down --remove-orphans 2>/dev/null || true
-
+            
             # Start the new container
             docker-compose pull
             docker-compose up -d
-
+            
             # Clean up unused Docker resources to save space
             docker system prune -af --volumes || true
 
-            # Clean up old images (older than 2 weeks)
+            # Clean up old backend/frontend images (older than 2 weeks)
             docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
           ENDSSH
 
           # Set port for output
           echo "v2_port=${V2_PORT}" >> $GITHUB_OUTPUT
 
-      # ---- Storybook preview (only when this PR touches stories/.storybook) ----
-      # Runs inside the same approved-contributor-gated deploy job, so it deploys
-      # under the exact same access rules as the app preview.
-      - name: Detect Storybook changes
-        id: sb-changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
-        with:
-          list-files: json
-          filters: |
-            storybook:
-              - 'frontend/**/*.stories.@(ts|tsx|mdx)'
-              - 'frontend/**/*.mdx'
-              - 'frontend/.storybook/**'
-
-      - name: Set up Node.js for Storybook
-        if: steps.sb-changes.outputs.storybook == 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task for Storybook
-        if: steps.sb-changes.outputs.storybook == 'true'
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Build and deploy Storybook
-        id: storybook
-        if: steps.sb-changes.outputs.storybook == 'true'
-        env:
-          VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
-          VPS_USER: ${{ secrets.NEW_VPS_USERNAME }}
-        run: |
-          set -euo pipefail
-          # `prepare` generates the icon set stories import (not committed).
-          task frontend:prepare
-          task frontend:storybook:build
-          PR=${{ needs.check-pr.outputs.pr_number }}
-          # Served at the ROOT of its own port so Storybook's global MSW worker
-          # (/mockServiceWorker.js) resolves. Port = PR + 20000 (bijective, offset
-          # from the app preview's bare-PR-number port).
-          SB_PORT=$((PR + 20000))
-          DIR=/stirling/SB-PR-$PR
-          tar czf storybook.tgz -C frontend/storybook-static .
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-            storybook.tgz "$VPS_USER@$VPS_HOST:/tmp/storybook-$PR.tgz"
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T \
-            "$VPS_USER@$VPS_HOST" << ENDSSH
-            set -e
-            rm -rf "$DIR" && mkdir -p "$DIR"
-            tar xzf /tmp/storybook-$PR.tgz -C "$DIR"
-            rm -f /tmp/storybook-$PR.tgz
-            docker rm -f storybook-pr-$PR 2>/dev/null || true
-            docker run -d --name storybook-pr-$PR --restart unless-stopped \
-              -p $SB_PORT:80 -v "$DIR":/usr/share/nginx/html:ro nginx:alpine
-          ENDSSH
-          echo "url=http://$VPS_HOST:$SB_PORT/" >> "$GITHUB_OUTPUT"
-
       - name: Post V2 deployment URL to PR
         if: success()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          SB_URL: ${{ steps.storybook.outputs.url }}
-          SB_FILES: ${{ steps.sb-changes.outputs.storybook_files }}
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
             const v2Port = ${{ steps.deploy.outputs.v2_port }};
-
+            
             // Delete the "deploying..." comment since we're posting the final result
             const deploymentStartedId = ${{ steps.deployment-started.outputs.result }};
             if (deploymentStartedId) {
@@ -400,42 +374,14 @@ jobs:
                 console.log(`Could not delete deployment started comment: ${error.message}`);
               }
             }
-
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
-
-            // Only mention the portal when this image actually embeds it.
-            // Use the direct IP URL - the SSL hostname isn't supported yet.
-            const withPortal = "${{ env.BUILD_PORTAL }}" === "true";
-            const portalNote = withPortal
-              ? `🧩 **Admin portal** included - try it at [${deploymentUrl}/portal](${deploymentUrl}/portal).\n\n`
-              : ``;
-
-            // Storybook preview: only present when this PR changed stories/config.
-            const sbUrl = process.env.SB_URL;
-            let storybookNote = "";
-            if (sbUrl) {
-              const files = JSON.parse(process.env.SB_FILES || "[]");
-              const stories = files.filter((f) => /\.stories\.(ts|tsx|mdx)$/.test(f));
-              const config = files.filter((f) => f.startsWith("frontend/.storybook/"));
-              const shorten = (f) =>
-                f.replace(/^frontend\/editor\/src\//, "").replace(/^frontend\//, "");
-              const storyList = stories.map((f) => `- \`${shorten(f)}\``).join("\n");
-              const configList = config.map((f) => `- \`${shorten(f)}\``).join("\n");
-              const summary =
-                `${stories.length} stor${stories.length === 1 ? "y" : "ies"} changed` +
-                (config.length ? ` (+${config.length} config file${config.length === 1 ? "" : "s"})` : "");
-              storybookNote =
-                `📚 **Storybook:** [${sbUrl}](${sbUrl})\n\n` +
-                `<details>\n<summary>${summary}</summary>\n\n` +
-                (storyList ? `**Stories**\n${storyList}\n\n` : "") +
-                (configList ? `**Config**\n${configList}\n` : "") +
-                `</details>\n\n`;
-            }
+            
+            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${v2Port}`;
+            const httpsUrl = `https://${v2Port}.ssl.stirlingpdf.cloud`;
 
             const commentBody = `## 🚀 V2 Auto-Deployment Complete!\n\n` +
+                              `Your V2 PR with the new frontend/backend split architecture has been deployed!\n\n` +
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
-                              portalNote +
-                              storybookNote +
+                              `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
                               `🔄 **Auto-deployed** for approved V2 contributors.`;
 
@@ -456,12 +402,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -473,25 +419,25 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Clean up V2 deployment comments
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ github.event.pull_request.number }};
-
+            
             // Find and delete V2 deployment comments
             const { data: comments } = await github.rest.issues.listComments({
               owner,
               repo,
               issue_number: prNumber
             });
-
+            
             const v2Comments = comments.filter(c =>
               c.body?.includes("## 🚀 V2 Auto-Deployment Complete!") &&
               c.user?.type === "Bot"
             );
-
+            
             for (const comment of v2Comments) {
               await github.rest.issues.deleteComment({
                 owner,
@@ -504,12 +450,12 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Cleanup V2 deployment
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
             if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found V2 PR directory, proceeding with cleanup..."
 
@@ -523,18 +469,15 @@ jobs:
               # Remove V2 PR-specific directories
               rm -rf /stirling/V2-PR-${{ github.event.pull_request.number }}
 
-              # Clean up V2 container by name (in case compose cleanup missed it)
-              docker rm -f stirling-pdf-v2-pr-${{ github.event.pull_request.number }} || true
+              # Clean up V2 containers by name (in case compose cleanup missed them)
+              docker rm -f stirling-pdf-v2-frontend-pr-${{ github.event.pull_request.number }} || true
+              docker rm -f stirling-pdf-v2-backend-pr-${{ github.event.pull_request.number }} || true
 
               echo "V2 cleanup completed"
             else
               echo "V2 PR directory not found, nothing to clean up"
             fi
-
-            # Remove this PR's Storybook preview (container + files), if any.
-            docker rm -f storybook-pr-${{ github.event.pull_request.number }} 2>/dev/null || true
-            rm -rf /stirling/SB-PR-${{ github.event.pull_request.number }}
-
+            
             # Clean up old unused images (older than 2 weeks) but keep recent ones for reuse
             docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
 

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -3,31 +3,6 @@ name: PR Deployment via Comment
 on:
   issue_comment:
     types: [created]
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number to deploy"
-        required: true
-      enable_prototypes:
-        description: "Build with prototypes frontend"
-        required: false
-        type: boolean
-        default: false
-      enable_pro:
-        description: "Enable pro features"
-        required: false
-        type: boolean
-        default: false
-      enable_enterprise:
-        description: "Enable enterprise features"
-        required: false
-        type: boolean
-        default: false
-      disable_security:
-        description: "Disable security/login"
-        required: false
-        type: boolean
-        default: true
 
 permissions:
   contents: read
@@ -39,27 +14,24 @@ jobs:
     permissions:
       issues: write
     if: |
-      vars.CI_PROFILE != 'lite' && (
-        github.event_name == 'workflow_dispatch' ||
-        (
-          github.event.issue.pull_request &&
-          (
-            contains(github.event.comment.body, 'prdeploy') ||
-            contains(github.event.comment.body, 'deploypr')
-          )
-          &&
-          (
-            github.event.comment.user.login == 'frooodle' ||
-            github.event.comment.user.login == 'sf298' ||
-            github.event.comment.user.login == 'Ludy87' ||
-            github.event.comment.user.login == 'balazs-szucs' ||
-            github.event.comment.user.login == 'reecebrowne' ||
-            github.event.comment.user.login == 'DarioGii' ||
-            github.event.comment.user.login == 'EthanHealy01' ||
-            github.event.comment.user.login == 'jbrunton96' ||
-            github.event.comment.user.login == 'ConnorYoh'
-          )
-        )
+      vars.CI_PROFILE != 'lite' &&
+      github.event.issue.pull_request &&
+      (
+        contains(github.event.comment.body, 'prdeploy') ||
+        contains(github.event.comment.body, 'deploypr')
+      )
+      &&
+      (
+        github.event.comment.user.login == 'frooodle' ||
+        github.event.comment.user.login == 'sf298' ||
+        github.event.comment.user.login == 'Ludy87' ||
+        github.event.comment.user.login == 'LaserKaspar' ||
+        github.event.comment.user.login == 'sbplat' ||
+        github.event.comment.user.login == 'reecebrowne' ||
+        github.event.comment.user.login == 'DarioGii' ||
+        github.event.comment.user.login == 'EthanHealy01' ||
+        github.event.comment.user.login == 'jbrunton96' ||
+        github.event.comment.user.login == 'ConnorYoh'
       )
     outputs:
       pr_number: ${{ steps.get-pr.outputs.pr_number }}
@@ -67,15 +39,14 @@ jobs:
       disable_security: ${{ steps.check-security-flag.outputs.disable_security }}
       enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }}
       enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
-      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -88,12 +59,10 @@ jobs:
 
       - name: Get PR data
         id: get-pr
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            const prNumber = context.eventName === 'workflow_dispatch'
-              ? context.payload.inputs.pr_number
-              : context.payload.issue.number;
+            const prNumber = context.payload.issue.number;
             console.log(`PR Number: ${prNumber}`);
             core.setOutput('pr_number', prNumber);
 
@@ -101,14 +70,12 @@ jobs:
         id: check-security-flag
         env:
           COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_DISABLE_SECURITY: ${{ inputs.disable_security }}
         run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "disable_security=$DISPATCH_DISABLE_SECURITY" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+          if [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
+            echo "Security flags detected in comment"
             echo "disable_security=false" >> $GITHUB_OUTPUT
           else
+            echo "No security flags detected in comment"
             echo "disable_security=true" >> $GITHUB_OUTPUT
           fi
 
@@ -116,45 +83,24 @@ jobs:
         id: check-pro-flag
         env:
           COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PRO: ${{ inputs.enable_pro }}
-          DISPATCH_ENTERPRISE: ${{ inputs.enable_enterprise }}
         run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_pro=$DISPATCH_PRO" >> $GITHUB_OUTPUT
-            echo "enable_enterprise=$DISPATCH_ENTERPRISE" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+          if [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
+            echo "pro flags detected in comment"
             echo "enable_pro=true" >> $GITHUB_OUTPUT
             echo "enable_enterprise=false" >> $GITHUB_OUTPUT
           elif [[ "$COMMENT_BODY" == *"enterprise"* ]]; then
+            echo "enterprise flags detected in comment"
             echo "enable_enterprise=true" >> $GITHUB_OUTPUT
             echo "enable_pro=true" >> $GITHUB_OUTPUT
           else
+            echo "No pro or enterprise flags detected in comment"
             echo "enable_pro=false" >> $GITHUB_OUTPUT
             echo "enable_enterprise=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Check for prototypes flag
-        id: check-prototypes-flag
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
-          DISPATCH_PROTOTYPES: ${{ inputs.enable_prototypes }}
-        run: |
-          if [[ "$IS_DISPATCH" == "true" ]]; then
-            echo "enable_prototypes=$DISPATCH_PROTOTYPES" >> $GITHUB_OUTPUT
-          elif [[ "$COMMENT_BODY" == *"prototypes"* ]]; then
-            echo "Prototypes flag detected in comment"
-            echo "enable_prototypes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No prototypes flag detected in comment"
-            echo "enable_prototypes=false" >> $GITHUB_OUTPUT
-          fi
-
       - name: Add 'in_progress' reaction to comment
-        if: github.event_name == 'issue_comment'
         id: add-eyes-reaction
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -183,12 +129,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -200,30 +146,17 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
           token: ${{ steps.setup-bot.outputs.token }}
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "25"
+          java-version: "17"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Run Gradle Command
         run: |
           if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -231,52 +164,33 @@ jobs:
           else
             export DISABLE_ADDITIONAL_FEATURES=false
           fi
-          task backend:build
+          ./gradlew clean build
         env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           STIRLING_PDF_DESKTOP_UI: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push PR-specific image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image
-        if: needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-engine
-          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          build-args: VERSION_TAG=alpha
           platforms: linux/amd64
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Deploy to VPS
@@ -308,78 +222,47 @@ jobs:
             PREMIUM_PROFEATURES_AUDIT_ENABLED="false"
           fi
 
-          ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
-          PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
-          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
-
-          # Build engine env vars for backend (only set when prototypes enabled)
-          if [ "$ENABLE_PROTOTYPES" == "true" ]; then
-            AI_ENGINE_VARS="
-                SYSTEM_AIENGINE_ENABLED: \"true\"
-                SYSTEM_AIENGINE_URL: \"http://stirling-pdf-engine-pr-${PR_NUMBER}:5001\""
-            ENGINE_SERVICE="
-            stirling-pdf-engine:
-              container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
-              environment:
-                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
-              networks:
-                - pr-network
-              restart: on-failure:5"
-            NETWORK_SECTION="
-          networks:
-            pr-network:"
-            BACKEND_NETWORK="
-              networks:
-                - pr-network"
-          else
-            AI_ENGINE_VARS=""
-            ENGINE_SERVICE=""
-            NETWORK_SECTION=""
-            BACKEND_NETWORK=""
-          fi
-
           # First create the docker-compose content locally
           cat > docker-compose.yml << EOF
           version: '3.3'
           services:
             stirling-pdf:
-              container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
+              container_name: stirling-pdf-pr-${{ needs.check-comment.outputs.pr_number }}
+              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
               ports:
-                - "${PR_NUMBER}:8080"
+                - "${{ needs.check-comment.outputs.pr_number }}:8080"
               volumes:
-                - /stirling/PR-${PR_NUMBER}/data:/usr/share/tessdata:rw
-                - /stirling/PR-${PR_NUMBER}/config:/configs:rw
-                - /stirling/PR-${PR_NUMBER}/logs:/logs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/data:/usr/share/tessdata:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/config:/configs:rw
+                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/logs:/logs:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                 SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
-                SYSTEM_DEFAULTLOCALE: en-US
-                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
-                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
-                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
+                SYSTEM_DEFAULTLOCALE: en-GB
+                UI_APPNAME: "Stirling-PDF PR#${{ needs.check-comment.outputs.pr_number }}"
+                UI_HOMEDESCRIPTION: "PR#${{ needs.check-comment.outputs.pr_number }} for Stirling-PDF Latest"
+                UI_APPNAMENAVBAR: "PR#${{ needs.check-comment.outputs.pr_number }}"
                 SYSTEM_MAXFILESIZE: "100"
                 METRICS_ENABLED: "true"
                 SYSTEM_GOOGLEVISIBILITY: "false"
                 PREMIUM_KEY:                         "${PREMIUM_KEY}"
                 PREMIUM_ENABLED:                     "${PREMIUM_ENABLED}"
-                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"${AI_ENGINE_VARS}
-              restart: on-failure:5${BACKEND_NETWORK}${ENGINE_SERVICE}${NETWORK_SECTION}
+                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"
+              restart: on-failure:5
           EOF
 
           # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
             # Create PR-specific directories
-            mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}
+            mkdir -p /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/{data,config,logs}
 
             # Move docker-compose file to correct location
-            mv /tmp/docker-compose.yml /stirling/PR-${PR_NUMBER}/docker-compose.yml
+            mv /tmp/docker-compose.yml /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/docker-compose.yml
 
             # Start or restart the container
-            cd /stirling/PR-${PR_NUMBER}
+            cd /stirling/PR-${{ needs.check-comment.outputs.pr_number }}
             docker-compose pull
             docker-compose up -d
           ENDSSH
@@ -388,8 +271,8 @@ jobs:
           echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV
 
       - name: Add success reaction to comment
-        if: success() && github.event_name == 'issue_comment'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        if: success()
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -423,8 +306,8 @@ jobs:
             }
 
       - name: Add failure reaction to comment
-        if: failure() && github.event_name == 'issue_comment'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        if: failure()
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -444,7 +327,7 @@ jobs:
 
       - name: Post deployment URL to PR
         if: success()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -453,7 +336,7 @@ jobs:
             const prNumber = ${{ needs.check-comment.outputs.pr_number }};
             const securityStatus = process.env.security_status || "Security Disabled";
 
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
+            const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${prNumber}`;
             const commentBody = `## 🚀 PR Test Deployment\n\n` +
                               `Your PR has been deployed for testing!\n\n` +
                               `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -480,12 +363,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -495,7 +378,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Apply label commands
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |

.github/workflows/PR-Demo-cleanup.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 env:
-  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
+  SERVER_IP: ${{ secrets.VPS_IP }} # Add this to your GitHub secrets
   CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred
 
 jobs:
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Checkout PR
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -39,7 +39,7 @@ jobs:
 
       - name: Remove 'pr-deployed' label if present
         id: remove-label-comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -96,18 +96,19 @@ jobs:
             const hasDeploymentComment = deploymentComments.length > 0;
             core.setOutput('present', (hasLabel || hasDeploymentComment) ? 'true' : 'false');
 
+
       - name: Set up SSH
         if: steps.remove-label-comment.outputs.present == 'true'
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Cleanup PR deployment
         if: steps.remove-label-comment.outputs.present == 'true'
         id: cleanup
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << 'ENDSSH'
             if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found PR directory, proceeding with cleanup..."
 
@@ -121,9 +122,8 @@ jobs:
               # Remove PR-specific directories
               rm -rf /stirling/PR-${{ github.event.pull_request.number }}
 
-              # Remove the Docker images
+              # Remove the Docker image
               docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true
 
               echo "PERFORMED_CLEANUP"
             else

.github/workflows/_runner-pick.yml

@@ -1,67 +0,0 @@
-name: _runner-pick
-
-# Tiny reusable workflow that classifies the trigger as either a "fork PR
-# from an untrusted contributor" or a "trusted commit" so downstream jobs
-# can trust-gate (skip secret-dependent jobs on forks) without each one
-# duplicating the gate expression.
-#
-# Caller pattern:
-#
-#   jobs:
-#     pick:
-#       uses: ./.github/workflows/_runner-pick.yml
-#
-#     real-work:
-#       needs: pick
-#       if: needs.pick.outputs.is_fork != 'true'
-#       steps: [...]
-#
-# Outputs:
-#   is_fork:   "true" when the trigger is a pull_request from a fork or an
-#              untrusted author_association, "false" otherwise.
-
-on:
-  workflow_call:
-    outputs:
-      is_fork:
-        description: '"true" if the trigger is an untrusted fork PR.'
-        value: ${{ jobs.pick.outputs.is_fork }}
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    outputs:
-      is_fork: ${{ steps.decide.outputs.is_fork }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Classify the trigger
-        id: decide
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_REPO_FORK: ${{ github.event.pull_request.head.repo.fork }}
-          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
-        run: |
-          set -eu
-
-          if [ -z "${PR_NUMBER:-}" ]; then
-            # Not a pull_request event at all (push, schedule, workflow_dispatch,
-            # workflow_call from a non-PR trigger) -> trusted by default.
-            is_fork=false
-          elif [ "${HEAD_REPO_FORK}" = "true" ]; then
-            is_fork=true
-          else
-            case "${AUTHOR_ASSOC}" in
-              OWNER|MEMBER|COLLABORATOR) is_fork=false ;;
-              *) is_fork=true ;;
-            esac
-          fi
-
-          echo "is_fork=${is_fork}" >> "$GITHUB_OUTPUT"

.github/workflows/ai-engine.yml

@@ -1,118 +0,0 @@
-name: AI Engine CI
-
-# Runs the engine quality gate (lint, type-check, format-check, tests). Called
-# from build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net. Freshness of the generated tool_models.py is checked
-# by the shared check-generated-models workflow.
-on:
-  workflow_call:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  engine:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          enable-cache: true
-          cache-suffix: ai-engine
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Quality-check engine
-        id: engine-check
-        run: task engine:check
-        continue-on-error: true
-
-      - name: Comment on engine check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const body = [
-              marker,
-              '### Engine Check Failed',
-              '',
-              'There are issues with your Python code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task engine:fix` to auto-fix what can be fixed automatically, then run `task engine:check` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if engine check failed
-        if: steps.engine-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Engine Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your Python code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task engine:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task engine:check'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
-
-      - name: Remove engine check comment on success
-        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }

.github/workflows/ai_pr_title_review.yml

@@ -5,7 +5,7 @@ on:
     types: [opened, edited]
     branches: [main]
 
-permissions: # required for secure-repo hardening
+permissions:  # required for secure-repo hardening
   contents: read
 
 jobs:
@@ -19,11 +19,11 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
 
@@ -87,7 +87,7 @@ jobs:
       - name: AI PR Title Analysis
         if: steps.actor.outputs.is_repo_dev == 'true'
         id: ai-title-analysis
-        uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2.1.1
+        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
         with:
           model: openai/gpt-4o
           system-prompt-file: ".github/config/system-prompt.txt"
@@ -158,7 +158,7 @@ jobs:
 
       - name: Post comment on PR if needed
         if: steps.actor.outputs.is_repo_dev == 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         continue-on-error: true
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}

.github/workflows/aur-publish.yml

@@ -1,128 +0,0 @@
-name: Publish to AUR
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the AUR push (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
-
-  publish-aur:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Update stirling-pdf-desktop PKGBUILD
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DEB_SHA: ${{ needs.get-release-info.outputs.deb_sha256 }}
-        run: |
-          PKGBUILD=".github/aur/stirling-pdf-desktop/PKGBUILD"
-          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-          sed -i "s/'PLACEHOLDER_DEB_SHA256'/'${DEB_SHA}'/" "$PKGBUILD"
-
-      # Disabled until we sort out the server packaging story.
-      # The third-party stirling-pdf-bin on AUR currently covers a similar use case.
-      # - name: Update stirling-pdf-server-bin PKGBUILD
-      #   env:
-      #     VERSION: ${{ needs.get-release-info.outputs.version }}
-      #     JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-      #   run: |
-      #     PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
-      #     sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-      #     sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-      #     sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
-
-      - name: Show updated PKGBUILD (for dry-run visibility)
-        run: |
-          echo "--- stirling-pdf-desktop PKGBUILD ---"
-          cat .github/aur/stirling-pdf-desktop/PKGBUILD
-
-      - name: Publish stirling-pdf-desktop to AUR
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
-        with:
-          pkgname: stirling-pdf-desktop
-          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
-          commit_username: Stirling PDF Inc
-          commit_email: contact@stirlingpdf.com
-          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
-
-      # Disabled until we sort out the server packaging story.
-      # - name: Publish stirling-pdf-server-bin to AUR
-      #   if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-      #   uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
-      #   with:
-      #     pkgname: stirling-pdf-server-bin
-      #     pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
-      #     commit_username: Stirling PDF Inc
-      #     commit_email: contact@stirlingpdf.com
-      #     ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      #     commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"

.github/workflows/auto-labelerV2.yml

@@ -4,7 +4,7 @@ on:
     types: [opened, synchronize]
     branches:
       - main
-      - V3
+      - V2
 
 permissions:
   contents: read
@@ -16,11 +16,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -29,7 +29,7 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - uses: srvaroa/labeler@bf262763a8a8e191f5847873aecc0f29df84f957 # v1.14.0
+      - uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0
         with:
           config_path: .github/labeler-config-srvaroa.yml
           use_local_config: false

.github/workflows/backend-build.yml

@@ -1,247 +0,0 @@
-name: Backend build, format check, and coverage
-
-# Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
-# posts Jacoco coverage to PRs.
-#
-# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
-#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
-#   proprietary  - default build, no saas
-#   saas         - proprietary + the saas subproject (build + JUnit only,
-#                  never any runtime/integration testing)
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-  pull-requests: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        jdk-version: [25]
-        flavor: [core, proprietary, saas]
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: ${{ matrix.jdk-version }}
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Check Java formatting (Spotless)
-        # Runs once per matrix combination - pick the cheapest leg
-        # (core - no proprietary, no saas) so we don't wait for the
-        # heavier flavors just to fail formatting.
-        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
-        id: spotless-check
-        run: task backend:format:check
-        continue-on-error: true
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Comment on backend format check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const body = [
-              marker,
-              '### Backend Format Check Failed',
-              '',
-              'There are formatting issues in your Java code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task backend:format` to auto-fix, then commit and push the changes.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if backend format check failed
-        if: steps.spotless-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Backend Format Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are formatting issues in your Java code"
-          echo "that will need to be fixed before they can be"
-          echo "merged in."
-          echo ""
-          echo "Run 'task backend:format' to auto-fix, then"
-          echo "commit and push the changes."
-          echo "============================================"
-          exit 1
-
-      - name: Remove backend format check comment on success
-        if: steps.spotless-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
-      - name: Build with Gradle (flavor=${{ matrix.flavor }})
-        # STIRLING_FLAVOR is read by settings.gradle and expands into the
-        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
-        # so we don't have to set them by hand. The saas flavor pulls in
-        # the app/saas subproject (unit tests only - no runtime tests).
-        run: task backend:build:ci
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          STIRLING_FLAVOR: ${{ matrix.flavor }}
-
-      - name: Check Test Reports Exist
-        if: always()
-        run: |
-          # Common + core + proprietary always build (proprietary is
-          # excluded only at runtime, not from the gradle subproject
-          # graph). Saas builds add a fourth report dir.
-          declare -a dirs=(
-            "app/core/build/reports/tests/"
-            "app/core/build/test-results/"
-            "app/common/build/reports/tests/"
-            "app/common/build/test-results/"
-            "app/proprietary/build/reports/tests/"
-            "app/proprietary/build/test-results/"
-          )
-          if [ "${{ matrix.flavor }}" = "saas" ]; then
-            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
-          fi
-          for dir in "${dirs[@]}"; do
-            if [ ! -d "$dir" ]; then
-              echo "Missing $dir"
-              exit 1
-            fi
-          done
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
-          path: |
-            app/**/build/reports/jacoco/test
-            app/**/build/reports/tests/
-            app/**/build/test-results/
-            app/**/build/reports/problems/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml to
-        # silence security scanners that pattern-match on the stdlib
-        # xml.etree.ElementTree.parse call.
-        if: always() && matrix.flavor == 'saas'
-        run: python -m pip install --quiet defusedxml
-
-      - name: JaCoCo coverage step summary
-        # Only the saas leg posts the JUnit summary - it's a strict
-        # superset of the core + proprietary legs (same .exec files plus
-        # the saas subproject). Posting from all three would mean three
-        # near-identical tables crowding out the aggregate report.
-        if: always() && matrix.flavor == 'saas'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
-            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload raw JUnit .exec for aggregate merge
-        # Same dedup rationale as the summary step: upload from the saas
-        # leg only (the most complete set, includes app/saas/.../test.exec)
-        # so the aggregate workflow merges the union rather than three
-        # overlapping subsets.
-        #
-        # Separate artifact from the HTML reports so the aggregate
-        # workflow can grab just the .exec files with a name pattern
-        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
-        # tarball.
-        if: always() && matrix.flavor == 'saas'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
-          path: app/*/build/jacoco/*.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
-        # The action only supports the pull_request event (it posts a PR comment),
-        # so skip it for merge_group runs and workflow_dispatch.
-        if: github.event_name == 'pull_request'
-        id: jacoco
-        uses: madrapps/jacoco-report@e51ce1f46f7f8b5331593f935e59cbaf44b84920 # v1.8.0
-        with:
-          paths: |
-            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
-          token: ${{ secrets.GITHUB_TOKEN }}
-          min-coverage-overall: 10
-          min-coverage-changed-files: 0
-          comment-type: summary

.github/workflows/build-enterprise.yml

@@ -1,374 +0,0 @@
-name: Enterprise E2E (Playwright)
-
-# Enterprise Playwright suite — exercises premium-key gated features (audit,
-# teams, analytics) plus full OAuth + SAML logins via the Keycloak compose
-# stacks under testing/compose. Slow and secret-gated, so it runs in four
-# situations:
-#
-#   - PRs that touch proprietary / premium / SSO compose / enterprise tests
-#     (driven by build.yml via workflow_call, path-filtered against
-#     .github/config/.files.yaml `proprietary`),
-#   - every push to main (post-merge safety net),
-#   - on a nightly cron schedule (catches Keycloak image drift, license
-#     expiry, upstream proprietary changes),
-#   - manual workflow_dispatch.
-
-on:
-  workflow_call:
-  push:
-    branches: ["main"]
-  schedule:
-    - cron: "0 4 * * *"
-  workflow_dispatch:
-
-# No `concurrency:` block here on purpose. When this workflow is called via
-# workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
-# resolve to the *caller's* values, producing the same group key as build.yml
-# and causing the workflow_call instantiation to self-cancel — the job
-# silently fails to spawn while `${{ needs.X.result }}` still reports
-# `failure`. Standalone runs (push-to-main, nightly cron, dispatch) don't
-# overlap often enough to need explicit concurrency control.
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  playwright-e2e-enterprise:
-    needs: pick
-    # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE,
-    # so the suite can't boot premium and would fail. See the header comment.
-    # GitHub reports the skipped reusable workflow as success.
-    if: needs.pick.outputs.is_fork != 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
-      PREMIUM_ENABLED: "true"
-      SYSTEM_ENABLEANALYTICS: "false"
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (needed for playwright's vite preview webServer)
-        # Enterprise tests target :8080 (Spring Boot's bundled frontend), but
-        # playwright's webServer config still launches `vite preview --port 5173`
-        # before any test run, which needs dist/ to exist. VITE_BUILD_FOR_PREVIEW
-        # forces absolute asset paths so vite preview can serve deep SPA routes.
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-
-      - name: Resolve kubernetes.docker.internal to localhost
-        # The compose stacks set KC_HOSTNAME=kubernetes.docker.internal so
-        # Keycloak issues redirect URIs against that host. Docker Desktop
-        # auto-resolves it; GHA runners don't. Map it to 127.0.0.1 so the
-        # browser-driven OAuth flow lands back on Stirling-PDF correctly.
-        run: |
-          echo "127.0.0.1 kubernetes.docker.internal" | sudo tee -a /etc/hosts
-
-      # Helper function used by all phases — boots `:stirling-pdf:bootRun`
-      # with the React frontend baked in (-PbuildWithFrontend=true) so the
-      # SPA serves on :8080 and OAuth/SAML callbacks land on the same host
-      # that the browser is interacting with.
-      - name: Define helpers
-        run: |
-          {
-            echo 'wait_for_backend() {'
-            echo '  start=$SECONDS'
-            echo '  for i in $(seq 1 300); do'
-            echo '    if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then'
-            echo '      echo "Backend up after $((SECONDS - start))s"; return 0'
-            echo '    fi; sleep 2'
-            echo '  done'
-            echo '  tail -200 /tmp/backend.log || true; return 1'
-            echo '}'
-            echo 'stop_backend() {'
-            echo '  if [ -f /tmp/backend.pid ]; then'
-            echo '    kill "$(cat /tmp/backend.pid)" 2>/dev/null || true'
-            echo '    rm -f /tmp/backend.pid'
-            echo '  fi'
-            echo '  pkill -f "gradlew :stirling-pdf:bootRun" 2>/dev/null || true'
-            echo '  for i in $(seq 1 30); do'
-            echo '    curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1 || return 0'
-            echo '    sleep 1'
-            echo '  done'
-            echo '}'
-          } > /tmp/helpers.sh
-          chmod +x /tmp/helpers.sh
-
-      # ───────── OAuth round-trip ─────────
-      - name: Bring up Keycloak (OAuth realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-oauth.yml up -d --no-deps keycloak-oauth-db keycloak-oauth
-      - name: Wait for Keycloak (OAuth) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            bash validate-oauth-test.sh 2>/dev/null && exit 0 || true
-            # validate script also pings stirling on :8080 — accept just the
-            # keycloak realm as our gate here, stirling boots in the next step
-            curl -fsS http://localhost:9080/realms/stirling-oauth >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-oauth.yml logs --tail=200 keycloak-oauth
-          exit 1
-      - name: Boot Stirling-PDF (frontend baked in, OAuth env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_OAUTH2_ENABLED: "true"
-          SECURITY_OAUTH2_AUTOCREATEUSER: "true"
-          # Keycloak issues redirect URIs against KC_HOSTNAME, which the
-          # compose default sets to kubernetes.docker.internal. Match here
-          # (resolves to localhost via /etc/hosts mapping above).
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_ISSUER: "http://kubernetes.docker.internal:9080/realms/stirling-oauth"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTID: "stirling-pdf-client"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTSECRET: "test-client-secret-change-in-production"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_USEASUSERNAME: "email"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_SCOPES: "openid,profile,email"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise OAuth Playwright tests
-        id: oauth-tests
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-oauth.json
-        run: task e2e:enterprise -- --grep "OAuth"
-      - name: Stop backend + tear down OAuth Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-oauth.yml down -v)
-
-      # ───────── SAML round-trip ─────────
-      - name: Bring up Keycloak (SAML realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-saml.yml up -d --no-deps keycloak-saml-db keycloak-saml
-      - name: Wait for Keycloak (SAML) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            curl -fsS http://localhost:9080/realms/stirling-saml >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-saml.yml logs --tail=200 keycloak-saml
-          exit 1
-      - name: Generate SAML SP certs + fetch Keycloak IdP cert
-        # The .pem/.crt/.key files are gitignored (test-only certs); the
-        # docker-based start-saml-test.sh generates them at runtime, so do
-        # the same in CI before bootRun reads them.
-        working-directory: testing/compose
-        run: |
-          openssl req -x509 -newkey rsa:2048 \
-            -keyout saml-private-key.key \
-            -out saml-public-cert.crt \
-            -days 3650 -nodes \
-            -subj "/CN=stirling-pdf-saml-sp" >/dev/null 2>&1
-          # Fetch Keycloak's SAML signing cert from the realm descriptor
-          CERT_BODY=$(curl -sf http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor \
-            | awk 'BEGIN{RS="<[^>]*X509Certificate>|</[^>]*X509Certificate>"} NR==2{gsub(/[[:space:]]+/,""); print; exit}')
-          {
-            echo "-----BEGIN CERTIFICATE-----"
-            echo "$CERT_BODY"
-            echo "-----END CERTIFICATE-----"
-          } > keycloak-saml-cert.pem
-          test -s saml-private-key.key
-          test -s saml-public-cert.crt
-          test -s keycloak-saml-cert.pem
-          echo "✓ SAML certs prepared"
-      - name: Boot Stirling-PDF (frontend baked in, SAML env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_SAML2_ENABLED: "true"
-          SECURITY_SAML2_AUTOCREATEUSER: "true"
-          SECURITY_SAML2_PROVIDER: "keycloak"
-          SECURITY_SAML2_REGISTRATIONID: "keycloak"
-          SECURITY_SAML2_IDP_ISSUER: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_ENTITYID: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_METADATAURI: "http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor"
-          SECURITY_SAML2_IDPSINGLELOGINURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDPSINGLELOGOUTURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDP_CERT: "${{ github.workspace }}/testing/compose/keycloak-saml-cert.pem"
-          SECURITY_SAML2_PRIVATEKEY: "${{ github.workspace }}/testing/compose/saml-private-key.key"
-          SECURITY_SAML2_SP_CERT: "${{ github.workspace }}/testing/compose/saml-public-cert.crt"
-          # Realm registers the SP entity as the metadata URL — see
-          # keycloak-realm-saml.json `clientId`. Match it here so Keycloak
-          # accepts the AuthnRequest issuer.
-          SECURITY_SAML2_SP_ENTITYID: "http://localhost:8080/saml2/service-provider-metadata/keycloak"
-          SECURITY_SAML2_SP_ACS: "http://localhost:8080/login/saml2/sso/keycloak"
-          SECURITY_SAML2_SP_SLS: "http://localhost:8080/logout/saml2/slo"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise SAML Playwright tests
-        id: saml-tests
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-saml.json
-        run: task e2e:enterprise -- --grep "SAML"
-      - name: Stop backend + tear down SAML Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-saml.yml down -v)
-
-      # ───────── License-gated feature tests (no IdP needed) ─────────
-      - name: Wipe DB so InitialSecuritySetup re-runs with admin/adminadmin
-        # Earlier phases (OAuth, SAML) create the default admin/stirling user.
-        # InitialSecuritySetup only honours SECURITY_INITIALLOGIN_* when the
-        # admin user doesn't already exist, so the persisted DB has to be
-        # cleared between phases for the feature env vars to take effect.
-        run: |
-          rm -f app/core/configs/stirling-pdf-DB*.mv.db
-          rm -rf app/core/configs/backup
-      - name: Boot Stirling-PDF (frontend baked in, premium only)
-        env:
-          SECURITY_INITIALLOGIN_USERNAME: admin
-          SECURITY_INITIALLOGIN_PASSWORD: adminadmin
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise feature Playwright tests
-        id: feature-tests
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results-feature.json
-        run: task e2e:enterprise -- --grep "Enterprise license"
-      - name: Print backend log on failure
-        if: failure()
-        run: |
-          echo "::group::Enterprise backend log"
-          tail -500 /tmp/backend.log || true
-          echo "::endgroup::"
-      - name: Stop backend (final)
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-      - name: Flag flaky tests
-        # Runs regardless of the test outcomes: a flaky test (passed on retry)
-        # leaves its step green, so this is the only place it surfaces. Merges
-        # all three phase reports (some may be absent if an earlier phase hard-
-        # failed and skipped the rest). Emits ::warning:: annotations + a job
-        # summary; never fails the job.
-        if: always()
-        working-directory: frontend
-        run: >
-          npx tsx scripts/report-flaky-tests.mts
-          "${{ github.workspace }}/frontend/playwright-report/results-oauth.json"
-          "${{ github.workspace }}/frontend/playwright-report/results-saml.json"
-          "${{ github.workspace }}/frontend/playwright-report/results-feature.json"
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7
-
-  # Multi-node regression: builds + seeds the clustered stack (testing/compose/docker-compose-multinode.yml)
-  # and runs behave features/multinode. Licence-gated, so it runs after the Playwright job (not in parallel).
-  multinode-e2e:
-    needs: [pick, playwright-e2e-enterprise]
-    # Nightly cron + manual dispatch only (heavy build), fork-gated for the licence secret.
-    if: >-
-      always() && needs.pick.outputs.is_fork != 'true'
-      && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    timeout-minutes: 60
-    env:
-      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
-      PREMIUM_ENABLED: "true"
-      SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-      MN_COMPOSE: docker-compose-multinode.yml
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-          cache: "pip"
-          cache-dependency-path: ./testing/cucumber/requirements.txt
-      - name: Install behave test deps
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
-      - name: Build the multi-node image
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" build
-      - name: Bring up the cluster and wait for both nodes healthy
-        working-directory: testing/compose
-        run: |
-          docker compose -f "$MN_COMPOSE" up -d
-          for i in $(seq 1 90); do
-            h1=$(docker inspect -f '{{.State.Health.Status}}' multinode-stirling-1 2>/dev/null || echo starting)
-            h2=$(docker inspect -f '{{.State.Health.Status}}' multinode-stirling-2 2>/dev/null || echo starting)
-            if [ "$h1" = healthy ] && [ "$h2" = healthy ]; then echo "both nodes healthy"; exit 0; fi
-            sleep 5
-          done
-          echo "::error::nodes did not become healthy"
-          docker compose -f "$MN_COMPOSE" logs --tail=200 stirling-1 stirling-2
-          exit 1
-      - name: Seed the cluster (teams, users, S3 connection, policy)
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" --profile seed run --rm seed
-      - name: Run multi-node regression (implemented guarantees)
-        working-directory: testing/cucumber
-        # -e overrides behave.ini's exclusion of features/multinode; ~@known_gap skips any tracked-gap scenarios.
-        run: python -m behave features/multinode -e "features/enterprise" --tags="~@known_gap ~@destructive" --no-capture -f plain
-      - name: Run multi-node failover (destructive)
-        working-directory: testing/cucumber
-        run: python -m behave features/multinode -e "features/enterprise" --tags="@destructive ~@known_gap" --no-capture -f plain
-      - name: Dump node logs on failure
-        if: failure()
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" logs --tail=400 stirling-1 stirling-2
-      - name: Tear down
-        if: always()
-        working-directory: testing/compose
-        run: docker compose -f "$MN_COMPOSE" --profile seed down -v --remove-orphans

.github/workflows/build.yml

@@ -1,18 +1,8 @@
 name: Build and Test Workflow
 
-# Top-level PR / merge-queue gate. Detects which paths changed and dispatches
-# to the dedicated reusable workflows under .github/workflows/. Each child
-# workflow keeps its own setup/teardown so this file stays a routing layer.
-#
-# The final `all-checks-passed` job is the single status check that branch
-# protection should require — it succeeds only if every required upstream
-# job either succeeded or was legitimately skipped by its path filter.
-
 on:
   pull_request:
-    branches: ["main"]
-  merge_group:
-    branches: ["main"]
+    branches: ["main", "V2", "V2-gha"]
   workflow_dispatch:
 
 # cancel in-progress jobs if a new job is triggered
@@ -37,309 +27,309 @@ jobs:
     timeout-minutes: 3
     outputs:
       build: ${{ steps.changes.outputs.build }}
+      app: ${{ steps.changes.outputs.app }}
       project: ${{ steps.changes.outputs.project }}
       openapi: ${{ steps.changes.outputs.openapi }}
-      frontend: ${{ steps.changes.outputs.frontend }}
-      docker-base: ${{ steps.changes.outputs.docker-base }}
-      dockerfiles: ${{ steps.changes.outputs.dockerfiles }}
-      tauri: ${{ steps.changes.outputs.tauri }}
-      engine: ${{ steps.changes.outputs.engine }}
-      generated-models: ${{ steps.changes.outputs.generated-models }}
-      proprietary: ${{ steps.changes.outputs.proprietary }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Check for file changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: changes
         with:
           filters: .github/config/.files.yaml
 
-  gradle-cache-prime:
-    name: Prime shared Gradle cache
-    needs: [files-changed]
+  build:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    permissions:
+      actions: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk-version: [17, 21]
+        spring-security: [true, false]
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK ${{ matrix.jdk-version }}
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "25"
+          java-version: ${{ matrix.jdk-version }}
           distribution: "temurin"
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
         with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-      - name: Resolve backend dependencies
-        run: ./gradlew :stirling-pdf:classes -PnoSpotless --no-daemon
+          gradle-version: 8.14
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
+        run: ./gradlew clean build -PnoSpotless
         env:
-          STIRLING_FLAVOR: saas
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-  build:
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-      pull-requests: write
-    uses: ./.github/workflows/backend-build.yml
-    secrets: inherit
-
-  db-migration-test:
-    # Boots the current bootJar against H2 fixtures captured from past
-    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
-    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
-    # the `project` filter so doc-only PRs skip this ~5-minute job.
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/db-migration-test.yml
-    secrets: inherit
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
+      - name: Check Test Reports Exist
+        if: always()
+        run: |
+          declare -a dirs=(
+            "app/core/build/reports/tests/"
+            "app/core/build/test-results/"
+            "app/common/build/reports/tests/"
+            "app/common/build/test-results/"
+            "app/proprietary/build/reports/tests/"
+            "app/proprietary/build/test-results/"
+          )
+          for dir in "${dirs[@]}"; do
+            if [ ! -d "$dir" ]; then
+              echo "Missing $dir"
+              exit 1
+            fi
+          done
+      - name: Upload Test Reports
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
+          path: |
+            app/**/build/reports/tests/
+            app/**/build/test-results/
+            app/**/build/reports/problems/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn
 
   check-generateOpenApiDocs:
     if: needs.files-changed.outputs.openapi == 'true'
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-openapi.yml
-    secrets: inherit
-
-  frontend-validation:
-    if: needs.files-changed.outputs.frontend == 'true'
     needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/frontend-validation.yml
-    secrets: inherit
-
-  # Advisory: deliberately NOT in all-checks-passed. It reports on the stories a
-  # branch touches so a regression is visible in review, but a browser scan is
-  # too new here to block merges on. Promote it once its pass/fail proves stable.
-  frontend-a11y:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/frontend-a11y.yml
-    secrets: inherit
-
-  playwright-e2e:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-stubbed.yml
-    secrets: inherit
-
-  playwright-e2e-live:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-live.yml
-    secrets: inherit
-
-  playwright-e2e-enterprise:
-    if: needs.files-changed.outputs.proprietary == 'true'
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/build-enterprise.yml
-    secrets: inherit
-
-  check-licence:
-    if: needs.files-changed.outputs.build == 'true'
-    needs: [files-changed, build, gradle-cache-prime]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-licence.yml
-    secrets: inherit
-
-  docker-compose-tests:
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-    uses: ./.github/workflows/docker-compose-tests.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
-
-  test-build-docker-images:
-    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, build, check-generateOpenApiDocs, check-licence, gradle-cache-prime]
-    permissions:
-      contents: read
-      packages: read
-    uses: ./.github/workflows/test-build-docker.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
-      dockerfiles-changed: ${{ needs.files-changed.outputs.dockerfiles }}
-
-  tauri-build:
-    if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    secrets: inherit
-    # PR smoke build: macOS + Windows (the platforms our developers use).
-    # sign: true only reaches macOS - tauri-build's per-platform gate keeps
-    # Windows/Linux signing on main, and an unsigned .dmg cannot be opened.
-    # The full signed multi-OS matrix runs on release;
-    # nightly still warms the Rust cache with all-OS defaults.
-    with:
-      platform: windows-macos
-      sign: true
-
-  ai-engine:
-    if: needs.files-changed.outputs.engine == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/ai-engine.yml
-    secrets: inherit
-
-  # The generated frontend types and engine tool models are both derived from
-  # the Java OpenAPI spec. This job regenerates and diffs them; it boots the
-  # backend, so it is gated on the narrow generated-models filter (spec source,
-  # generators, generated files, generation tasks) rather than the broad
-  # frontend filter, so a CSS-only PR does not pay for a backend build.
-  generated-models:
-    if: needs.files-changed.outputs.generated-models == 'true'
-    needs: [files-changed, gradle-cache-prime]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/check-generated-models.yml
-    secrets: inherit
-
-  pre-commit:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/pre_commit.yml
-    secrets: inherit
-
-  dependency-review:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/dependency-review.yml
-    secrets: inherit
-
-  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
-  # artifacts produced by the jobs above into one report, plus pulls
-  # in vitest + Playwright frontend coverage for the per-area matrix.
-  # `if: always()` so a producer failing partway still gets credit
-  # for whatever did record. Advisory only - intentionally NOT in
-  # all-checks-passed, so a flaky aggregate run never blocks merging.
-  coverage-aggregate:
-    if: always()
-    needs:
-      - build
-      - playwright-e2e-live
-      - docker-compose-tests
-      - frontend-validation
-    permissions:
-      contents: read
-    uses: ./.github/workflows/coverage-aggregate.yml
-    secrets: inherit
-    with:
-      frontend-validation-result: ${{ needs.frontend-validation.result }}
-      playwright-e2e-live-result: ${{ needs.playwright-e2e-live.result }}
-
-  # Single status check that branch protection should mark as required.
-  # Succeeds when every upstream job is either `success` or `skipped` (path-
-  # gated jobs that didn't apply this run). Any `failure` or `cancelled`
-  # result fails the gate. `if: always()` ensures the gate evaluates even
-  # when an upstream job fails.
-  all-checks-passed:
-    name: All checks passed
-    if: always()
-    needs:
-      - files-changed
-      - build
-      - db-migration-test
-      - check-generateOpenApiDocs
-      - frontend-validation
-      - playwright-e2e
-      - playwright-e2e-live
-      - playwright-e2e-enterprise
-      - check-licence
-      - docker-compose-tests
-      - test-build-docker-images
-      - tauri-build
-      - ai-engine
-      - generated-models
-      - pre-commit
-      - dependency-review
     runs-on: ubuntu-latest
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Verify every required job passed (or was legitimately skipped)
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - name: Generate OpenAPI documentation
+        run: ./gradlew :stirling-pdf:generateOpenApiDocs
         env:
-          RESULTS: |
-            files-changed=${{ needs.files-changed.result }}
-            build=${{ needs.build.result }}
-            db-migration-test=${{ needs.db-migration-test.result }}
-            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
-            frontend-validation=${{ needs.frontend-validation.result }}
-            playwright-e2e=${{ needs.playwright-e2e.result }}
-            playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
-            playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}
-            check-licence=${{ needs.check-licence.result }}
-            docker-compose-tests=${{ needs.docker-compose-tests.result }}
-            test-build-docker-images=${{ needs.test-build-docker-images.result }}
-            tauri-build=${{ needs.tauri-build.result }}
-            ai-engine=${{ needs.ai-engine.result }}
-            generated-models=${{ needs.generated-models.result }}
-            pre-commit=${{ needs.pre-commit.result }}
-            dependency-review=${{ needs.dependency-review.result }}
+          DISABLE_ADDITIONAL_FEATURES: true
+      
+      - name: Upload OpenAPI Documentation
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: openapi-docs
+          path: ./SwaggerDoc.json
+
+  frontend-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install frontend dependencies
+        run: cd frontend && npm ci
+      - name: Type-check frontend
+        run: cd frontend && npm run prebuild && npm run typecheck:all
+      - name: Lint frontend
+        run: cd frontend && npm run lint
+      - name: Build frontend
+        run: cd frontend && npm run build
+      - name: Run frontend tests
+        run: cd frontend && npm run test -- --run
+      - name: Upload frontend build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: frontend-build
+          path: frontend/dist/
+          retention-days: 3
+
+  check-licence:
+    if: needs.files-changed.outputs.build == 'true'
+    needs: [files-changed, build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: check the licenses for compatibility
+        run: ./gradlew clean checkLicense
+
+      - name: FAILED - check the licenses for compatibility
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
+
+  docker-compose-tests:
+    if: needs.files-changed.outputs.project == 'true'
+    needs: files-changed
+    # if: github.event_name == 'push' && github.ref == 'refs/heads/main' ||
+    #     (github.event_name == 'pull_request' &&
+    #     contains(github.event.pull_request.labels.*.name, 'licenses') == false &&
+    #     (
+    #       contains(github.event.pull_request.labels.*.name, 'Front End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Java') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Back End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Security') ||
+    #       contains(github.event.pull_request.labels.*.name, 'API') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Docker') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Test')
+    #     )
+    #     )
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up Java 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Install Docker Compose
         run: |
-          ok=true
-          while IFS='=' read -r name result; do
-            [ -z "$name" ] && continue
-            case "$result" in
-              success|skipped) printf '  %-30s %s\n' "$name" "$result" ;;
-              *)               printf '✗ %-30s %s\n' "$name" "$result"; ok=false ;;
-            esac
-          done <<< "$RESULTS"
-          if [ "$ok" != "true" ]; then
-            echo ""
-            echo "One or more required checks failed or were cancelled."
-            exit 1
-          fi
-          echo ""
-          echo "All required checks passed."
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo chmod +x /usr/local/bin/docker-compose
+
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: "3.12"
+          cache: 'pip' # caching pip dependencies
+          cache-dependency-path: ./testing/cucumber/requirements.txt
+
+      - name: Pip requirements
+        run: |
+          pip install --require-hashes -r ./testing/cucumber/requirements.txt
+
+      - name: Run Docker Compose Tests
+        run: |
+          chmod +x ./testing/test_webpages.sh
+          chmod +x ./testing/test.sh
+          chmod +x ./testing/test_disabledEndpoints.sh
+          ./testing/test.sh
+
+  test-build-docker-images:
+    if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
+    needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - docker-rev: docker/embedded/Dockerfile
+            artifact-suffix: Dockerfile
+          - docker-rev: docker/embedded/Dockerfile.ultra-lite
+            artifact-suffix: Dockerfile.ultra-lite
+          - docker-rev: docker/embedded/Dockerfile.fat
+            artifact-suffix: Dockerfile.fat
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Free disk space on runner
+        run: |
+          echo "Disk space before cleanup:" && df -h
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
+          docker system prune -af || true
+          echo "Disk space after cleanup:" && df -h
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Build application
+        run: ./gradlew clean build
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Build ${{ matrix.docker-rev }}
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./${{ matrix.docker-rev }}
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Upload Reports
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: reports-docker-${{ matrix.artifact-suffix }}
+          path: |
+            build/reports/tests/
+            build/test-results/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn

.github/workflows/check-generated-models.yml

@@ -1,144 +0,0 @@
-name: Check generated models
-
-# Verifies the committed generated files are still in sync with the Java OpenAPI
-# spec: the request models (toolApiTypes.ts, tool_models.py) and the tool I/O
-# tables saying what each endpoint accepts and produces (toolIO.ts, tool_io.py).
-# Regenerates them all with the single top-level `task tool-models` and fails if
-# any committed file is out of date. Called from build.yml when the
-# backend Java, frontend, or engine changes; also runs on push to main as a
-# post-merge safety net.
-on:
-  workflow_call:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  generated-models:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          enable-cache: true
-          cache-suffix: generated-models
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Verify generated models are up to date
-        id: models-check
-        continue-on-error: true
-        run: task tool-models:check
-
-      - name: Comment on generated models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- generated-models-check -->';
-            const body = [
-              marker,
-              '### Generated Models Check Failed',
-              '',
-              'One or more generated files are out of date with the Java OpenAPI spec and will need to be regenerated before they can be merged in.',
-              '',
-              'Run `task tool-models` to regenerate them, then commit the updated files.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if generated models check failed
-        if: steps.models-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Generated Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "One or more generated files are out of date with the Java"
-          echo "OpenAPI spec and will need to be regenerated before merging."
-          echo ""
-          echo "Run 'task tool-models' to regenerate them, then"
-          echo "commit the updated files."
-          echo "============================================"
-          exit 1
-
-      - name: Remove generated models check comment on success
-        if: steps.models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- generated-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }

.github/workflows/check-licence.yml

@@ -1,55 +0,0 @@
-name: License compatibility check
-
-# Reusable workflow called from build.yml when build.gradle / module gradle
-# files change. Verifies all transitive dependencies use a permitted license.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-licence:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Check licenses for compatibility
-        run: task backend:licenses:check
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: FAILED - check the licenses for compatibility
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-          retention-days: 3

.github/workflows/check-openapi.yml

@@ -1,55 +0,0 @@
-name: Generate OpenAPI documentation
-
-# Reusable workflow called from build.yml when backend Java sources change.
-# Generates SwaggerDoc.json so we know the doc still builds against the
-# current code.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-generate-openapi-docs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Generate OpenAPI documentation
-        run: task backend:swagger
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: openapi-docs
-          path: ./SwaggerDoc.json

.github/workflows/check_toml.yml

@@ -7,8 +7,6 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - "frontend/public/locales/*/translation.toml"
-      - ".github/scripts/check_language_toml.py"
-      - ".github/workflows/check_toml.yml"
 
 # cancel in-progress jobs if a new job is triggered
 concurrency:
@@ -27,12 +25,12 @@ jobs:
       pull-requests: write # Allow writing to pull requests
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Checkout main branch first
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -43,7 +41,7 @@ jobs:
 
       - name: Get PR data
         id: get-pr-data
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -87,7 +85,7 @@ jobs:
 
       - name: Determine reference file
         id: determine-file
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -166,16 +164,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/public/locales/en-US/translation.toml")) {
+            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-US.toml";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -183,11 +181,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-US.toml";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -196,13 +194,13 @@ jobs:
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.12"
 
       - name: Install Python dependencies
         run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+          pip install tomli-w
 
       - name: Run Python script to check files
         id: run-check
@@ -240,7 +238,7 @@ jobs:
 
       - name: Post comment on PR
         if: env.SCRIPT_OUTPUT != ''
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -293,6 +291,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/codeql.yml-disabled

@@ -0,0 +1,79 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+#disable for now
+#on:
+#  push:
+#    branches: ["main"]
+#  pull_request:
+    # The branches below must be a subset of the branches above
+#    branches: ["main"]
+#  schedule:
+#    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/coverage-aggregate.yml

@@ -1,233 +0,0 @@
-name: Aggregate backend coverage
-
-# Reusable workflow called from build.yml after every backend coverage
-# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
-# .exec, merges them into one JaCoCo report, and posts a combined step
-# summary alongside the per-source ones.
-#
-# Kept separate from the per-source jobs so:
-#   - the per-source jobs stay fast and independent (no cross-job waits)
-#   - this job can `if: always()` and still produce something useful when
-#     one of the producers fails partway through
-#   - frontend producers can be added later without touching the
-#     producers themselves
-on:
-  workflow_call:
-    inputs:
-      frontend-validation-result:
-        description: Result of the frontend-validation producer job
-        required: false
-        type: string
-        default: skipped
-      playwright-e2e-live-result:
-        description: Result of the playwright-e2e-live producer job
-        required: false
-        type: string
-        default: skipped
-
-permissions:
-  contents: read
-
-jobs:
-  aggregate:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for coverage scripts
-        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
-        # XML through defusedxml - see the script headers for context.
-        run: python -m pip install --quiet defusedxml
-
-      # Pattern matches every artifact this PR's producers might upload:
-      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
-      #                                         leg of backend-build, which
-      #                                         is a strict superset of the
-      #                                         core + proprietary legs)
-      #   jacoco-exec-e2e-live
-      #   jacoco-exec-cucumber
-      # Each lands as a sibling dir under coverage-execs/, with the .exec
-      # files preserving their original relative paths.
-      - name: Download all .exec artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: jacoco-exec-*
-          path: coverage-execs/
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Inventory .exec files
-        id: inventory
-        # Splits the downloaded artifacts into two buckets:
-        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
-        #   * all       = the above plus JUnit (everything we test)
-        #
-        # Bucketing is by artifact-name prefix: download-artifact preserves
-        # the artifact name as the top-level dir, so JUnit's `.exec`s live
-        # under coverage-execs/jacoco-exec-junit-*/... while the others
-        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
-        #
-        # If nothing was uploaded (e.g. all producers crashed before
-        # writing) we exit gracefully so this advisory job never fails CI.
-        run: |
-          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
-          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
-          if [ "${#all_execs[@]}" -eq 0 ]; then
-            echo "::warning::No .exec artifacts found - skipping aggregate report"
-            echo "found_all=false" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          printf 'All %d .exec files:\n' "${#all_execs[@]}"
-          printf '  %s\n' "${all_execs[@]}"
-          IFS=','; all_joined="${all_execs[*]}"
-          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
-          echo "found_all=true" >> "$GITHUB_OUTPUT"
-          if [ "${#e2e_execs[@]}" -eq 0 ]; then
-            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-          else
-            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
-            printf '  %s\n' "${e2e_execs[@]}"
-            unset IFS
-            IFS=','; e2e_joined="${e2e_execs[*]}"
-            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Compile classes for JaCoCo class lookup
-        # jacocoReportFromExec only needs the compiled .class files
-        # under each subproject's build/classes/java/main/. `classes`
-        # (compileJava + processResources) is enough; we skipped the
-        # heavier `assemble` to avoid building bootJar / fat jars that
-        # add 60+ seconds per run for no gain to the report.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: ./gradlew classes -PnoSpotless
-
-      - name: Generate e2e-only JaCoCo report
-        # "Real user-flow" coverage: only counts code reached by an actual
-        # HTTP request from cucumber or live Playwright. Useful for
-        # questions like "how much of our backend does a user actually
-        # hit?". Skipped when neither producer uploaded a .exec.
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
-            -PreportDir=build/reports/jacoco/aggregate-e2e \
-            -PnoSpotless
-
-      - name: Generate combined JaCoCo report (everything)
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
-            -PreportDir=build/reports/jacoco/aggregate-all \
-            -PnoSpotless
-
-      - name: E2E-only step summary
-        # Rendered first so it gets prime real estate in the Summary
-        # tab - this is the number most readers actually want
-        # ("how much of the backend do real user flows cover?").
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: ALL-sources step summary
-        # Separate call (not a multi-input one) because the helper's
-        # rightmost "Aggregate" column would sum the two reports - which
-        # is meaningless when one is a strict superset of the other.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload combined aggregate report
-        if: steps.inventory.outputs.found_all == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-all-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-all/
-          retention-days: 14
-
-      - name: Upload e2e-only aggregate report
-        if: steps.inventory.outputs.found_e2e == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-e2e-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-e2e/
-          retention-days: 14
-
-      # --------------------------------------------------------------
-      # Per-area matrix: rolls backend + frontend coverage into one
-      # table indexed by core/proprietary/saas/desktop. Pulls the
-      # frontend artifacts now (after the JaCoCo step has done its
-      # work) so the per-source backend summaries still render first
-      # even if the matrix step fails.
-      # --------------------------------------------------------------
-      - name: Download vitest coverage artifact
-        # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence on backend-only runs by skipping the download entirely
-        # when the producer job was not part of this workflow run.
-        if: inputs.frontend-validation-result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: frontend-coverage
-          path: matrix-inputs/vitest/
-        continue-on-error: true
-
-      - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads the artifact with a stable name. Skip the
-        # download entirely when the producer job did not run.
-        if: inputs.playwright-e2e-live-result == 'success'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: playwright-frontend-coverage
-          path: matrix-inputs/playwright/
-        continue-on-error: true
-
-      - name: Coverage matrix step summary
-        if: always()
-        # Matrix references the two aggregate JaCoCo XMLs (already
-        # generated above) plus whichever frontend artifacts landed.
-        # Every input is optional; missing ones render as "-".
-        run: |
-          python scripts/coverage-matrix.py \
-            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
-            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
-            --vitest matrix-inputs/vitest/coverage-summary.json \
-            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
-            --title "Coverage matrix (per-area, e2e vs all)" \
-            --github-step-summary

.github/workflows/db-migration-test.yml

@@ -1,83 +0,0 @@
-name: DB migration smoke test
-
-# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
-# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
-# Catches schema changes that would break existing user databases under
-# Hibernate's `ddl-auto=update` upgrade path.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  migration-test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: 25
-          distribution: temurin
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      # Keep the normal formatting path here so this smoke test exercises the
-      # same Gradle configuration as the backend build.
-      - name: Build Stirling-PDF JAR
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
-
-      - name: Locate built JAR
-        id: jar
-        run: |
-          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
-              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
-          if [[ -z "$jar" ]]; then
-            echo "::error::No JAR under app/core/build/libs"
-            ls -lah app/core/build/libs || true
-            exit 1
-          fi
-          # Absolute path - the migration script pushd's into a temp workdir
-          # before invoking java, which would dangle a relative path.
-          jar=$(realpath "$jar")
-          echo "path=$jar" >> "$GITHUB_OUTPUT"
-          echo "Built JAR: $jar"
-
-      - name: Run migration smoke test
-        env:
-          STIRLING_JAR: ${{ steps.jar.outputs.path }}
-        run: bash scripts/db-migration/run-migration-test.sh
-
-      - name: Upload app logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: db-migration-app-logs
-          # Path matches the preserved workdir in run-migration-test.sh -
-          # only failing fixtures leave a directory behind.
-          path: /tmp/stirling-migration-failed-*/app.log
-          retention-days: 7
-          if-no-files-found: warn

.github/workflows/dependency-review.yml

@@ -1,10 +1,13 @@
-name: Dependency Review
-
-# Reusable workflow called from build.yml. Scans dependency manifest files
-# changing in a PR for known-vulnerable packages, using the rules in
-# .github/config/dependency-review-config.yml.
-on:
-  workflow_call:
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: "Dependency Review"
+on: [pull_request]
 
 permissions:
   contents: read
@@ -14,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: "Checkout Repository"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
         with:
-          config-file: "./.github/config/dependency-review-config.yml"
+          config-file: './.github/config/dependency-review-config.yml'

.github/workflows/deploy-on-v2-commit.yml

@@ -18,15 +18,15 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@v3
 
       - name: Get commit hashes for frontend and backend
         id: commit-hashes
@@ -36,26 +36,26 @@ jobs:
           if [ -z "$FRONTEND_HASH" ]; then
             FRONTEND_HASH="no-frontend-changes"
           fi
-
+          
           # Get last commit that touched backend code, docker/backend, or docker/compose
           BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
           if [ -z "$BACKEND_HASH" ]; then
             BACKEND_HASH="no-backend-changes"
           fi
-
+          
           echo "Frontend hash: $FRONTEND_HASH"
           echo "Backend hash: $BACKEND_HASH"
-
+          
           echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
           echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-
+          
           # Short hashes for tags
           if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
             echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
           else
             echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
           fi
-
+          
           if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
             echo "backend_short=no-backend" >> $GITHUB_OUTPUT
           else
@@ -84,52 +84,51 @@ jobs:
             echo "Backend image needs to be built"
           fi
 
+
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push frontend image
         if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/frontend/Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-v2-frontend
-          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
           tags: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64
-
+      
       - name: Build and push backend image
         if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/backend/Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-v2-backend
-          cache-to: type=gha,mode=max,scope=stirling-v2-backend
           tags: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64
 
+
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           chmod 600 ../private.key
 
+
       - name: Deploy to VPS on port 3000
         run: |
           export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
-
+      
           cat > $UNIQUE_NAME << EOF
           version: '3.3'
           services:
@@ -145,7 +144,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2"
                 UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
                 UI_APPNAMENAVBAR: "V2 Deployment"
@@ -155,24 +154,24 @@ jobs:
                 SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
                 baseUrl: "https://demo.stirlingpdf.cloud"
               restart: on-failure:5
-
+      
             frontend:
               container_name: stirling-v2-frontend
               image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
               ports:
                 - "3000:80"
               environment:
-                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
+                VITE_API_BASE_URL: "http://${{ secrets.VPS_HOST }}:13000"
               depends_on:
                 - backend
               restart: on-failure:5
           EOF
-
+      
           # Copy to remote with unique name
-          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
-
+          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/$UNIQUE_NAME
+      
           # SSH and rename/move atomically to avoid interference
-          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
             mkdir -p /stirling/V2/{data,config,logs}
             mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
             cd /stirling/V2
@@ -187,3 +186,4 @@ jobs:
         if: always()
         run: |
           rm -f ../private.key
+

.github/workflows/docker-compose-tests.yml

@@ -1,182 +0,0 @@
-name: Docker Compose Cucumber tests
-
-# Reusable workflow called from build.yml when project / docker / testing
-# sources change. Boots the docker-compose stack and runs the cucumber
-# scenarios in testing/cucumber.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-
-permissions:
-  contents: read
-
-jobs:
-  docker-compose-tests:
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      # When the PR changes the base image, test.sh builds it locally
-      # (stirling-pdf-base:local) into the daemon image store. A buildx
-      # container builder can't see that store, so skip it here and let
-      # `docker buildx build` fall back to the default docker driver, which
-      # resolves the local base. The gha cache backend is also skipped (its
-      # runtime token isn't exposed) since the docker driver can't use it.
-      - name: Set up Docker Buildx
-        if: inputs.docker-base-changed != 'true'
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
-      - name: Expose GitHub runtime for Buildx cache
-        if: inputs.docker-base-changed != 'true'
-        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
-
-      - name: Install Docker Compose
-        run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-          sudo chmod +x /usr/local/bin/docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-          cache-dependency-path: ./testing/cucumber/requirements.txt
-
-      - name: Pip requirements
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
-
-      - name: Extract JaCoCo agent for cucumber coverage
-        # Stages build/jacoco/jacocoagent.jar where the coverage override
-        # file bind-mounts it into the cucumber container. The agent jar
-        # never goes into the published image - this is host-only.
-        run: ./gradlew copyJacocoAgent -PnoSpotless
-
-      - name: Run Docker Compose Tests
-        run: |
-          chmod +x ./testing/test_webpages.sh
-          chmod +x ./testing/test.sh
-          chmod +x ./testing/test_disabledEndpoints.sh
-          ./testing/test.sh
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
-          # over the cucumber compose so the container starts with the
-          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
-          STIRLING_PDF_TEST_COVERAGE: "1"
-
-      - name: Generate cucumber JaCoCo report
-        # `if: always()` so a behave failure still produces partial
-        # coverage from whatever endpoints did run. The exec file only
-        # exists when the container shut down cleanly - guard so the step
-        # is silent on the (rare) crash path.
-        if: always()
-        id: cucumber-coverage
-        run: |
-          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=testing/cucumber-coverage/cucumber.exec \
-              -PreportDir=build/reports/jacoco/cucumber \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml -
-        # see the script header for context.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-
-      - name: Cucumber coverage step summary
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Cucumber (docker) JaCoCo coverage" \
-            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload cucumber JaCoCo report
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-cucumber-${{ github.run_id }}
-          path: build/reports/jacoco/cucumber/
-          retention-days: 7
-
-      - name: Upload raw cucumber .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-cucumber
-          path: testing/cucumber-coverage/cucumber.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Cucumber Report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cucumber-report
-          path: testing/cucumber/report.html
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docker-compose-test-reports
-          path: testing/reports/
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Cucumber Test Report
-        if: always()
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: Cucumber Tests
-          path: testing/cucumber/junit/*.xml
-          reporter: java-junit
-          fail-on-error: false

.github/workflows/e2e-live.yml

@@ -1,254 +0,0 @@
-name: Playwright E2E (live backend)
-
-# Reusable workflow called from build.yml. Live-backend Playwright suite —
-# boots Spring Boot and runs auth + real tool round-trips against the live
-# server.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e-live:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-      # Gradle does not retry 429s, and a cold cache resolving the buildscript
-      # classpath is exactly where Maven Central rate-limits us. Retry it here,
-      # where a failure is cheap, instead of inside the backgrounded bootRun.
-      - name: Prime Gradle dependencies
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: |
-          for attempt in 1 2 3; do
-            if ./gradlew --quiet -PnoSpotless :stirling-pdf:classes; then
-              exit 0
-            fi
-            echo "::warning::Gradle dependency resolution failed (attempt $attempt of 3)"
-            sleep $((attempt * 30))
-          done
-          echo "::error::Gradle could not resolve dependencies after 3 attempts"
-          exit 1
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-      - name: Run live E2E tests (chromium) with coverage
-        id: live-tests
-        env:
-          # Attaches the JaCoCo agent to the bootRun JVM (see
-          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
-          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
-          # report step below sees a populated file.
-          COVERAGE: "1"
-          # Tells the Playwright fixture (test-base.ts) to capture per-test
-          # V8 JS coverage. Raw dumps land under
-          # .test-state/playwright/coverage-pw/ for the post-process step
-          # to aggregate. Chromium-only - other engines silently skip.
-          PW_COVERAGE: "1"
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-          # Internal mirror, as in backend-build.yml. Empty on Dependabot and
-          # fork PRs, where the build falls back to Maven Central.
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: task e2e:live
-      - name: Flag flaky tests
-        # Runs regardless of the test outcome: a flaky test (passed on retry)
-        # leaves the step green, so this is the only place it surfaces. Emits
-        # ::warning:: annotations + a job summary; never fails the job.
-        if: always()
-        working-directory: frontend
-        run: npx tsx scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-      - name: Generate JaCoCo report from e2e:live .exec
-        if: always()
-        id: live-coverage
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        # `if: always()` so even a failed test run still produces a
-        # report from whatever flows did exercise the backend before
-        # the failure. The task itself tolerates a missing .exec
-        # (jacoco emits an empty report rather than crashing) but we
-        # guard with `test -s` to keep the job log clean.
-        run: |
-          if [ -s .test-state/playwright/jacoco.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=.test-state/playwright/jacoco.exec \
-              -PreportDir=build/reports/jacoco/e2e-live \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set up Python for coverage summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
-        # to dodge XXE / billion-laughs scanner findings.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-      - name: e2e:live coverage step summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live backend) JaCoCo coverage" \
-            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
-            --github-step-summary
-      - name: Upload e2e:live JaCoCo report
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-e2e-live-${{ github.run_id }}
-          path: build/reports/jacoco/e2e-live/
-          retention-days: 7
-
-      - name: Upload raw e2e:live .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-e2e-live
-          path: .test-state/playwright/jacoco.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Set up Python for frontend coverage summary
-        # Separate from the backend-coverage python step because the
-        # frontend path doesn't depend on a JaCoCo report - it produces
-        # a summary even on backend failure, as long as some Playwright
-        # tests ran far enough to dump V8 coverage.
-        if: always()
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for frontend coverage summary
-        # Idempotent re-install: the backend-coverage step may have
-        # installed it already, but this leg can run on its own when the
-        # backend report step skips (e.g. .exec missing).
-        if: always()
-        run: python -m pip install --quiet defusedxml
-
-      - name: Aggregate Playwright frontend (V8) coverage
-        # Rolls per-test V8 dumps from the test-base fixture into one
-        # vitest-shaped coverage-summary.json. Tolerates a missing dump
-        # dir (firefox/webkit runs, or a failure before any test got
-        # far enough to dump).
-        if: always()
-        id: pw-frontend-coverage
-        run: |
-          if [ -d .test-state/playwright/coverage-pw ] && \
-             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            python scripts/playwright-coverage-summary.py \
-              .test-state/playwright/coverage-pw \
-              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
-            echo "summary=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
-            echo "summary=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Playwright frontend coverage step summary
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live) frontend coverage" \
-            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-            --github-step-summary
-
-      - name: Upload Playwright frontend coverage
-        # Bundle both the aggregated summary and the raw V8 dumps so
-        # someone debugging "why is this function showing as covered"
-        # can trace it back to the source dump.
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-frontend-coverage
-          path: |
-            .test-state/playwright/coverage-pw-summary/
-            .test-state/playwright/coverage-pw/
-          retention-days: 7
-
-      - name: Print backend log on failure
-        if: failure() && steps.live-tests.conclusion == 'failure'
-        run: |
-          echo "::group::Spring Boot backend log (last 500 lines)"
-          tail -500 .test-state/playwright/backend.log || echo "no backend log found"
-          echo "::endgroup::"
-      - name: Upload backend log
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: backend-log-live-${{ github.run_id }}
-          path: .test-state/playwright/backend.log
-          retention-days: 7
-      - name: List Playwright output locations (debug)
-        if: always()
-        run: |
-          echo "::group::Playwright output dirs"
-          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend has
-          # none), so artifacts land under frontend/, not frontend/.
-          ls -la frontend/playwright-report 2>/dev/null \
-            || echo "no playwright-report at frontend/"
-          ls -la frontend/test-results 2>/dev/null \
-            || echo "no test-results at frontend/"
-          find . -name node_modules -prune -o -name 'trace.zip' -print 2>/dev/null || true
-          echo "::endgroup::"
-      - name: Upload Playwright report + traces
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-live-${{ github.run_id }}
-          # test-results/ holds the per-test trace.zip (with browser console
-          # logs) + screenshots/video; playwright-report/ is the HTML report.
-          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend has none).
-          path: |
-            frontend/playwright-report/
-            frontend/test-results/
-          retention-days: 7
-          if-no-files-found: warn

.github/workflows/e2e-stubbed.yml

@@ -1,55 +0,0 @@
-name: Playwright E2E (stubbed)
-
-# Reusable workflow called from build.yml. Backend-free Playwright suite —
-# fast, no Spring Boot required. Runs against the `stubbed` project which
-# mocks API responses in the browser.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-      - name: Run stubbed E2E tests (chromium)
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-        run: task e2e:stubbed -- --workers=3
-      - name: Flag flaky tests
-        # Runs regardless of the test outcome: a flaky test (passed on retry)
-        # leaves the step green, so this is the only place it surfaces. Emits
-        # ::warning:: annotations + a job summary; never fails the job.
-        if: always()
-        working-directory: frontend
-        run: npx tsx scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
-        env:
-          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7

.github/workflows/frontend-a11y.yml

@@ -1,60 +0,0 @@
-name: Frontend a11y regression gate
-
-# Reusable workflow called from build.yml when frontend sources change.
-#
-# Scans the stories this branch touches in real Chromium and runs axe against
-# each. Existing violations are grandfathered in .storybook/a11y-baseline.json;
-# the check fails on a NEW violation — a story breaking a rule it wasn't already
-# breaking — or on a story that fails to render at all.
-#
-# Only changed stories, because a full sweep is ~30 minutes: far too slow to sit
-# in front of every merge. The whole suite is scanned nightly instead
-# (nightly.yml), which catches anything a branch didn't touch.
-#
-# Advisory for now: this is not in build.yml's all-checks-passed list, so a
-# failure reports without blocking. Promote it once a few weeks of runs show the
-# pass/fail is stable.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  frontend-a11y:
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # Need the base branch too, to diff against it.
-          fetch-depth: 0
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: a11y gate (changed stories)
-        run: task frontend:storybook:a11y:changed -- origin/${{ github.base_ref || 'main' }}
-      - name: Upload scan reports
-        # The reports carry the offending selector and help text for each
-        # violation; without them a red run can only be understood by
-        # reproducing the whole scan locally.
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: a11y-scan-${{ github.run_id }}
-          path: frontend/.a11y-scan/
-          retention-days: 7
-          if-no-files-found: ignore
-          # The reports live in a dot-directory, which upload-artifact treats as
-          # hidden and silently skips by default.
-          include-hidden-files: true

.github/workflows/frontend-backend-licenses-update.yml

@@ -1,543 +0,0 @@
-name: License Report Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  merge_group:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  files-changed:
-    name: detect what files changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    outputs:
-      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
-      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
-        id: changes
-        with:
-          filters: .github/config/.files.yaml
-
-  generate-frontend-license-report:
-    if: needs.files-changed.outputs.licenses-frontend == 'true'
-    name: Generate Frontend License Report
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout PR head (default)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Checkout BASE branch (safe script)
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        working-directory: frontend
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        run: npm ci --ignore-scripts --audit=false --fund=false
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Generate frontend license report (Push only)
-        if: github.event_name == 'push'
-        env:
-          PR_IS_FORK: "false"
-        run: task frontend:licenses:generate
-
-      - name: Generate frontend license report (internal PR)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        env:
-          PR_IS_FORK: "false"
-        run: task frontend:licenses:generate
-
-      - name: Generate frontend license report (fork PRs, pinned)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        working-directory: frontend
-        run: |
-          mkdir -p src/assets
-          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
-
-      - name: Postprocess with project script (BASE version)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          PR_IS_FORK: "true"
-        run: |
-          node base/frontend/scripts/generate-licenses.js \
-            --input frontend/src/assets/3rdPartyLicenses.json
-
-      - name: Copy postprocessed artifacts back (fork PRs)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        run: |
-          mkdir -p frontend/src/assets
-          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
-          fi
-          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
-            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
-          fi
-
-      - name: Check for license warnings
-        run: |
-          if [ -f "frontend/src/assets/license-warnings.json" ]; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-
-      # PR Event: Check licenses and comment on PR
-      - name: Delete previous license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            // Get all comments on the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            // Filter for license check comments
-            const licenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Frontend License Check Passed') ||
-              comment.body.includes('## ❌ Frontend License Check Failed')
-            );
-
-            // Delete old license check comments
-            for (const comment of licenseComments) {
-              console.log(`Deleting old license check comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Summarize results (fork PRs)
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) || github.actor == 'dependabot[bot]'
-        run: |
-          {
-            echo "## Frontend License Check"
-            echo ""
-            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
-              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/src/assets/license-warnings.json" ]; then
-                echo ""
-                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
-              fi
-            else
-              echo "✅ **Passed** – no license warnings detected."
-            fi
-            echo ""
-            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Comment on PR - License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-
-            let commentBody;
-
-            if (hasWarnings) {
-              // Read warnings file to get specific issues
-              const fs = require('fs');
-              let warningDetails = '';
-              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
-                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
-              } catch (e) {
-                warningDetails = 'Unable to read warning details';
-              }
-
-              commentBody = `## ❌ Frontend License Check Failed
-
-              The frontend license check has detected compatibility warnings that require review:
-
-              ${warningDetails}
-
-              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Frontend License Check Passed
-
-              All frontend licenses have been validated and no compatibility warnings were detected.
-
-              The frontend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ License warnings detected. Failing the workflow."
-          exit 1
-
-      # Push Event: Commit license files and create PR
-      - name: Commit changes (Push only)
-        if: github.event_name == 'push'
-        run: |
-          git add frontend/src/assets/3rdPartyLicenses.json
-          # Note: Do NOT commit license-warnings.json - it's only for PR review
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (Push only)
-        if: github.event_name == 'push'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the frontend license report based on changes to package.json dependencies."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          The following licenses may require review for corporate compatibility:
-
-          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
-
-          Please review these licenses to ensure they are acceptable for your use case."
-          fi
-
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (Push only)
-        id: cpr
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Frontend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-frontend-3rd-party-licenses
-          base: main
-          title: "Update Frontend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: |
-            Licenses
-            github-actions
-            Front End
-          draft: false
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-  generate-backend-license-report:
-    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: files-changed
-    name: Generate Backend License Report
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: Check licenses and generate report
-        id: license-check
-        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: false
-          STIRLING_PDF_DESKTOP_UI: true
-
-      - name: Check for license compatibility issues
-        run: |
-          if [ -f build/reports/dependency-license/dependencies-without-allowed-license.json ] && \
-             jq '.dependenciesWithoutAllowedLicenses | length > 0' build/reports/dependency-license/dependencies-without-allowed-license.json | grep -q true; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-        if: always()
-
-      - name: Upload artifact on license issues
-        if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: backend-dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-
-      - name: Move license file
-        if: env.LICENSE_CHECK_FAILED != 'true' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          mkdir -p app/core/src/main/resources/static
-          cp build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
-
-      - name: Delete previous backend license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            const backendLicenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Backend License Check Passed') ||
-              comment.body.includes('## ❌ Backend License Check Failed')
-            );
-
-            for (const comment of backendLicenseComments) {
-              console.log(`Deleting old backend license comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Comment on PR - Backend License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-            const fs = require('fs');
-            let warningDetails = '';
-
-            if (hasWarnings) {
-              try {
-                const warningsFile = 'build/reports/dependency-license/dependencies-without-allowed-license.json';
-                if (fs.existsSync(warningsFile)) {
-                  const data = JSON.parse(fs.readFileSync(warningsFile, 'utf8'));
-                  if (data.length > 0) {
-                    warningDetails = data.map(dep => `- **${dep.moduleName}@${dep.moduleVersion}** – ${dep.moduleLicenses.map(l => l.licenseName).join(', ')}`).join('\n');
-                  }
-                }
-              } catch (e) {
-                warningDetails = 'Unable to parse warning details.';
-              }
-            }
-
-            let commentBody;
-            if (hasWarnings) {
-              commentBody = `## ❌ Backend License Check Failed
-
-              The backend license check has detected dependencies with incompatible or unallowed licenses:
-
-              ${warningDetails || 'See uploaded artifact for details.'}
-
-              **Action Required:** Please review these licenses and resolve before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Backend License Check Passed
-
-              All backend dependencies have valid and allowed licenses.
-
-              The backend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ Backend license warnings detected. Failing the workflow."
-          exit 1
-
-      - name: Commit changes (push only)
-        if: github.event_name == 'push' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          git config user.name "${{ steps.setup-bot.outputs.committer }}"
-          git config user.email "${{ steps.setup-bot.outputs.committer-email || 'bot@github.com' }}"
-          git add app/core/src/main/resources/static/3rdPartyLicenses.json
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the backend license report based on dependency changes."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          Incompatible licenses detected – manual review required before merge."
-          fi
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        id: cpr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Backend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-backend-3rd-party-licenses
-          base: main
-          title: "Update Backend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: |
-            Licenses
-            github-actions
-            Back End
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (push only, no warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (push only, with warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/frontend-licenses-update.yml

@@ -0,0 +1,282 @@
+name: Frontend License Report Workflow
+
+on:
+  push:
+    branches:
+      - V2
+    paths:
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/scripts/generate-licenses.js"
+  pull_request:
+    branches:
+      - V2
+    paths:
+      - ".github/workflows/frontend-licenses-update.yml"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/scripts/generate-licenses.js"
+
+permissions:
+  contents: read
+
+jobs:
+  generate-frontend-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout PR head (default)
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Checkout BASE branch (safe script)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: base
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        run: npm ci --ignore-scripts --audit=false --fund=false
+
+      - name: Generate frontend license report (internal PR)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        working-directory: frontend
+        env:
+          PR_IS_FORK: "false"
+        run: npm run generate-licenses
+
+      - name: Generate frontend license report (fork PRs, pinned)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        working-directory: frontend
+        run: |
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
+
+      - name: Postprocess with project script (BASE version)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          PR_IS_FORK: "true"
+        run: |
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json
+
+      - name: Copy postprocessed artifacts back (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
+          fi
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
+          fi
+
+      - name: Check for license warnings
+        run: |
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
+            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
+          else
+            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
+          fi
+
+      # PR Event: Check licenses and comment on PR
+      - name: Delete previous license check comments
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            
+            // Get all comments on the PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100
+            });
+            
+            // Filter for license check comments
+            const licenseComments = comments.filter(comment => 
+              comment.body.includes('## ✅ Frontend License Check Passed') ||
+              comment.body.includes('## ❌ Frontend License Check Failed')
+            );
+            
+            // Delete old license check comments
+            for (const comment of licenseComments) {
+              console.log(`Deleting old license check comment: ${comment.id}`);
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id
+              });
+            }
+
+      - name: Summarize results (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          {
+            echo "## Frontend License Check"
+            echo ""
+            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
+              echo "❌ **Failed** – incompatible or unknown licenses found."
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
+                echo ""
+                echo "### Warnings"
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
+              fi
+            else
+              echo "✅ **Passed** – no license warnings detected."
+            fi
+            echo ""
+            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Comment on PR - License Check Results
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
+            
+            let commentBody;
+            
+            if (hasWarnings) {
+              // Read warnings file to get specific issues
+              const fs = require('fs');
+              let warningDetails = '';
+              try {
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
+                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
+              } catch (e) {
+                warningDetails = 'Unable to read warning details';
+              }
+              
+              commentBody = `## ❌ Frontend License Check Failed
+              
+              The frontend license check has detected compatibility warnings that require review:
+
+              ${warningDetails}
+
+              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
+
+              _This check will fail the PR until license issues are resolved._`;
+            } else {
+              commentBody = `## ✅ Frontend License Check Passed
+              
+              All frontend licenses have been validated and no compatibility warnings were detected.
+
+              The frontend license report has been updated successfully.`;
+            }
+            
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
+
+      - name: Fail workflow if license warnings exist (PR only)
+        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: |
+          echo "❌ License warnings detected. Failing the workflow."
+          exit 1
+
+      # Push Event: Commit license files and create PR
+      - name: Commit changes (Push only)
+        if: github.event_name == 'push'
+        run: |
+          git add frontend/src/assets/3rdPartyLicenses.json
+          # Note: Do NOT commit license-warnings.json - it's only for PR review
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Prepare PR body (Push only)
+        if: github.event_name == 'push'
+        run: |
+          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+
+          This PR updates the frontend license report based on changes to package.json dependencies."
+          
+          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
+            PR_BODY="$PR_BODY
+
+          ## ⚠️ License Compatibility Warnings
+
+          The following licenses may require review for corporate compatibility:
+
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
+
+          Please review these licenses to ensure they are acceptable for your use case."
+          fi
+          
+          echo "PR_BODY<<EOF" >> $GITHUB_ENV
+          echo "$PR_BODY" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
+      - name: Create Pull Request (Push only)
+        id: cpr
+        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update Frontend 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-frontend-3rd-party-licenses
+          base: V2
+          title: "Update Frontend 3rd Party Licenses"
+          body: ${{ env.PR_BODY }}
+          labels: Licenses,github-actions,frontend
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+
+      - name: Add review required label (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/frontend-validation.yml

@@ -1,148 +0,0 @@
-name: Frontend lint, type-check, and build
-
-# Reusable workflow called from build.yml when frontend / testing sources
-# change. Runs the consolidated `task frontend:check:all` (lint, types,
-# unit tests, build) and uploads the dist artifact for downstream jobs.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  frontend-validation:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Quality-check frontend
-        id: frontend-check
-        run: task frontend:check:all
-        continue-on-error: true
-      - name: Comment on frontend check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.frontend-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const body = [
-              marker,
-              '### Frontend Check Failed',
-              '',
-              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-      - name: Fail if frontend check failed
-        if: steps.frontend-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Frontend Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your frontend code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task frontend:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task frontend:check:all'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
-      - name: Remove frontend check comment on success
-        if: steps.frontend-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-      - name: Vitest coverage
-        # Separate from `frontend:check:all` so the quality-gate run stays
-        # uninstrumented (faster signal) and coverage stays an informational
-        # follow-up. Continue-on-error keeps the workflow green even when
-        # a handful of test files refuse to import (e.g. missing icon
-        # specifiers) - the summary still gets posted with whatever
-        # vitest managed to instrument.
-        id: frontend-coverage
-        continue-on-error: true
-        run: task frontend:test:coverage
-      - name: Set up Python for coverage summary
-        if: always()
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # See coverage-summary.py header - it parses XML through defusedxml
-        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
-        if: always()
-        run: python -m pip install --quiet defusedxml
-      - name: Vitest coverage step summary
-        if: always()
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Frontend Vitest coverage" \
-            --vitest frontend/coverage/coverage-summary.json \
-            --github-step-summary
-      - name: Upload vitest coverage report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-coverage
-          path: frontend/coverage/
-          retention-days: 7
-          if-no-files-found: warn
-      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-build
-          path: frontend/dist/
-          retention-days: 3

.github/workflows/licenses-update.yml

@@ -0,0 +1,105 @@
+name: License Report Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  generate-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+
+      - name: Check licenses for compatibility
+        run: ./gradlew clean checkLicense
+        env:
+          DISABLE_ADDITIONAL_FEATURES: false
+          STIRLING_PDF_DESKTOP_UI: true
+
+      - name: Upload artifact on failure
+        if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
+
+      - name: Move and rename license file
+        run: |
+          mv build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
+
+      - name: Commit changes
+        run: |
+          git add app/core/src/main/resources/static/3rdPartyLicenses.json
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        id: cpr
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-3rd-party-licenses
+          title: "Update 3rd Party Licenses"
+          body: |
+            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+          labels: Licenses,github-actions
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge
+        if: steps.cpr.outputs.pull-request-operation == 'created'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/manage-label.yml

@@ -15,15 +15,15 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
+        uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           yaml-file: .github/labels.yml

.github/workflows/nightly.yml

@@ -1,110 +0,0 @@
-name: Nightly E2E Tests
-
-on:
-  schedule:
-    - cron: "0 2 * * *" # 2 AM UTC every night
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-all-browsers:
-    name: Playwright (chromium + firefox + webkit)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install all Playwright browsers
-        run: task e2e:install
-
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-
-      - name: Run E2E tests (all browsers)
-        run: task e2e:cross-browser
-
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-nightly-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 14
-
-  # Whole-suite accessibility sweep. Pull requests only scan the stories they
-  # touch (frontend-a11y.yml) because a full pass takes ~30 minutes; this covers
-  # everything else, so a violation introduced by a change somewhere other than
-  # the story itself — a shared component, a theme token — still surfaces within
-  # a day.
-  a11y-all-stories:
-    name: a11y (every story)
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-
-      - name: a11y gate (every story)
-        run: task frontend:storybook:a11y
-
-      - name: Upload scan reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: a11y-scan-nightly-${{ github.run_id }}
-          path: frontend/.a11y-scan/
-          retention-days: 14
-          if-no-files-found: ignore
-          # The reports live in a dot-directory, which upload-artifact treats as
-          # hidden and silently skips by default.
-          include-hidden-files: true
-
-  # Builds all desktop platforms on a schedule so the Rust dependency cache is
-  # written on main, where PR and merge-queue tauri builds can restore it.
-  warm-tauri-cache:
-    name: Warm Tauri Rust cache
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    with:
-      platform: all
-      sign: false
-    secrets: inherit

.github/workflows/package-managers.yml

@@ -1,155 +0,0 @@
-name: Update Package Manager Manifests
-
-on:
-  release:
-    types: [released]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to test (e.g. 2.9.2 — no v prefix)"
-        required: true
-        type: string
-      dry_run:
-        description: "Skip the git push at the end (safe test)"
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  get-release-info:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.info.outputs.version }}
-      dmg_sha256: ${{ steps.hashes.outputs.dmg_sha256 }}
-      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
-      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
-      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Extract version from tag or manual input
-        id: info
-        env:
-          DISPATCH_VERSION: ${{ inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION="$DISPATCH_VERSION"
-          else
-            VERSION="$RELEASE_TAG"
-          fi
-          VERSION="${VERSION#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Download release assets and compute SHA256
-        id: hashes
-        env:
-          VERSION: ${{ steps.info.outputs.version }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
-
-          download_sha256() {
-            local url="$1"
-            local file
-            file=$(basename "$url")
-            curl -fsSL --retry 3 -o "$file" "$url"
-            sha256sum "$file" | awk '{print $1}'
-          }
-
-          DMG_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-universal.dmg")
-          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
-          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
-          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
-
-          echo "dmg_sha256=$DMG_SHA" >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA" >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
-
-  update-homebrew-and-scoop:
-    needs: get-release-info
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: Stirling-Tools/homebrew-stirling-pdf
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          path: tap
-
-      # Stirling-PDF now ships a single universal DMG, so the Cask should
-      # have one sha256 line rather than separate on_arm/on_intel blocks.
-      # We rewrite every `sha256 "..."` in the Cask to the same value so
-      # the workflow keeps working through the Cask migration: pre-migration
-      # both arch blocks get the universal SHA (still correct, since both
-      # would resolve to the same DMG), post-migration the lone sha256 line
-      # is updated.
-      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DMG_SHA: ${{ needs.get-release-info.outputs.dmg_sha256 }}
-        run: |
-          CASK="tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$CASK"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${DMG_SHA}\"/g" "$CASK"
-
-      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          FORMULA="tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
-
-      - name: Update Scoop stirling-pdf.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf.json"
-          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
-            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Update Scoop stirling-pdf-server.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf-server.json"
-          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
-            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Show tap diff (for dry-run visibility)
-        working-directory: tap
-        run: |
-          echo "--- diff --stat ---"
-          git diff --stat
-          echo "--- full diff ---"
-          git diff
-
-      - name: Commit and push all tap updates
-        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        working-directory: tap
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb scoop/stirling-pdf.json scoop/stirling-pdf-server.json
-          git diff --cached --quiet && echo "No changes" && exit 0
-          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
-          git push

.github/workflows/pr-conflict-labeler.yml

@@ -1,159 +0,0 @@
-name: PR conflict labeler
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - edited
-      - ready_for_review
-  schedule:
-    - cron: "17 */6 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: pr-conflict-labeler-${{ github.event.pull_request.number || 'all-open-prs' }}
-  cancel-in-progress: false
-
-env:
-  CONFLICT_LABEL: "has conflicts"
-
-jobs:
-  label-conflicts:
-    name: Label conflicted PRs
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: read
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Check out the repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up stirling-bot token
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Apply conflict label
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const conflictLabel = process.env.CONFLICT_LABEL;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const eventPullRequest = context.payload.pull_request;
-
-            async function sleep(ms) {
-              await new Promise((resolve) => setTimeout(resolve, ms));
-            }
-
-            async function getPullRequestWithMergeableState(pullNumber) {
-              for (let attempt = 1; attempt <= 6; attempt += 1) {
-                const { data: pull } = await github.rest.pulls.get({
-                  owner,
-                  repo,
-                  pull_number: pullNumber,
-                });
-
-                if (pull.mergeable !== null) {
-                  return pull;
-                }
-
-                core.info(`PR #${pullNumber}: mergeable is not ready yet (attempt ${attempt}/6).`);
-                await sleep(5000);
-              }
-
-              const { data: pull } = await github.rest.pulls.get({
-                owner,
-                repo,
-                pull_number: pullNumber,
-              });
-              return pull;
-            }
-
-            async function ensureConflictLabel() {
-              try {
-                await github.rest.issues.getLabel({
-                  owner,
-                  repo,
-                  name: conflictLabel,
-                });
-              } catch (error) {
-                if (error.status !== 404) {
-                  throw error;
-                }
-
-                await github.rest.issues.createLabel({
-                  owner,
-                  repo,
-                  name: conflictLabel,
-                  color: 'D93F0B',
-                  description: 'Pull request has merge conflicts with the base branch',
-                });
-                core.info(`Created '${conflictLabel}' label.`);
-              }
-            }
-
-            async function labelPullRequest(pull) {
-              const existingLabels = pull.labels.map((label) => label.name);
-              const hasConflictLabel = existingLabels.includes(conflictLabel);
-              const hasConflicts = pull.mergeable === false && pull.mergeable_state === 'dirty';
-
-              if (hasConflicts && !hasConflictLabel) {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number: pull.number,
-                  labels: [conflictLabel],
-                });
-                core.info(`Added '${conflictLabel}' to PR #${pull.number}.`);
-                return;
-              }
-
-              if (!hasConflicts && hasConflictLabel) {
-                await github.rest.issues.removeLabel({
-                  owner,
-                  repo,
-                  issue_number: pull.number,
-                  name: conflictLabel,
-                });
-                core.info(`Removed '${conflictLabel}' from PR #${pull.number}.`);
-                return;
-              }
-
-              core.info(`PR #${pull.number}: no label change needed (mergeable=${pull.mergeable}, mergeable_state=${pull.mergeable_state}).`);
-            }
-
-            await ensureConflictLabel();
-
-            let pullNumbers;
-            if (eventPullRequest) {
-              pullNumbers = [eventPullRequest.number];
-            } else {
-              const pulls = await github.paginate(github.rest.pulls.list, {
-                owner,
-                repo,
-                state: 'open',
-                per_page: 100,
-              });
-              pullNumbers = pulls.map((pull) => pull.number);
-              core.info(`Checking ${pullNumbers.length} open PR(s).`);
-            }
-
-            for (const pullNumber of pullNumbers) {
-              const pull = await getPullRequestWithMergeableState(pullNumber);
-              await labelPullRequest(pull);
-            }

.github/workflows/pre_commit.yml

@@ -1,10 +1,10 @@
 name: Pre-commit
 
-# Runs the repo-wide lint/format/secret checks via `task pre-commit`.
-# Called from build.yml on PRs and merge_group; also runnable on demand via workflow_dispatch.
 on:
-  workflow_call:
   workflow_dispatch:
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -12,26 +12,75 @@ permissions:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
-          persist-credentials: false
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
         with:
-          enable-cache: true
-          cache-suffix: pre-commit
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: 3.12
+          cache: 'pip' # caching pip dependencies
+          cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt
 
-      - name: Run pre-commit checks
-        run: task pre-commit
+      - name: Run Pre-Commit Hooks
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt
+
+      - run: pre-commit run --all-files -c .pre-commit-config.yaml
+        continue-on-error: true
+
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: 17
+          distribution: "temurin"
+
+      - name: Build with Gradle
+        run: ./gradlew clean build
+
+      - name: git add
+        run: |
+          git add .
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: ":file_folder: pre-commit"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: pre-commit
+          title: "🤖 format everything with pre-commit by ${{ steps.setup-bot.outputs.app-slug }}"
+          body: |
+            Auto-generated by [create-pull-request][1] with **${{ steps.setup-bot.outputs.app-slug }}**
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true

.github/workflows/push-docker-base.yml

@@ -1,122 +0,0 @@
-name: Push Docker Base Image
-
-on:
-  push:
-    branches:
-      - baseDockerImage
-      - accessIssueFix
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Base image version (e.g., 1.0.0, 1.0.1)'
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  push-base:
-    if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Verify authorized user
-        run: |
-          if [ "${{ github.actor }}" != "Frooodle" ]; then
-            echo "Error: Only Frooodle is authorized to run this workflow"
-            exit 1
-          fi
-
-      - name: Set version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${{ github.event.inputs.version }}"
-          elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
-            VERSION="1.0.3"
-          else
-            VERSION="1.0.0"
-          fi
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for base image
-        id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-base
-          tags: |
-            type=raw,value=${{ steps.version.outputs.version }}
-
-      - name: Build and push base image
-        id: build-push-base
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: docker/base
-          file: ./docker/base/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-base
-          cache-to: type=gha,mode=max,scope=stirling-pdf-base
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Sign base images
-        env:
-          DIGEST: ${{ steps.build-push-base.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --yes \
-                --key env://COSIGN_PRIVATE_KEY \
-                "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping image signing"
-          fi

.github/workflows/push-docker-v2.yml

@@ -0,0 +1,246 @@
+name: Push Docker Image - V2 Branch
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - V2-master
+      - V1_V2_merge
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-24.04-8core
+    permissions:
+      packages: write
+      id-token: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Get version number
+        id: versionNumber
+        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        with:
+          cosign-release: "v2.4.1"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+
+      - name: Generate tags for latest (V2-master branch - production)
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Generate tags for latest (V1_V2_merge branch - test)
+        id: meta-test
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V1_V2_merge'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign regular images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --yes \
+              --key env://COSIGN_PRIVATE_KEY \
+              "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for latest-fat (V2-master branch - production)
+        id: meta-fat
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Generate tags for latest-fat (V1_V2_merge branch - test)
+        id: meta-fat-test
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V1_V2_merge'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Build and push Unified Dockerfile (fat variant)
+        id: build-push-fat
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.fat
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign fat images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite (V2-master branch - production)
+        id: meta-lite
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Generate tags for ultra-lite (V1_V2_merge branch - test)
+        id: meta-lite-test
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref == 'refs/heads/V1_V2_merge'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done

.github/workflows/push-docker.yml

@@ -2,28 +2,10 @@ name: Push Docker Image with VersionNumber
 
 on:
   workflow_dispatch:
-    inputs:
-      build_main_app:
-        description: "Build & push the main Stirling-PDF image (latest, fat, ultra-lite)."
-        required: false
-        type: boolean
-        default: true
-      build_unoserver:
-        description: "Build & push the standalone stirling-unoserver image."
-        required: false
-        type: boolean
-        default: true
-      force_unoserver_rebuild:
-        description: "Rebuild stirling-unoserver even if its source hash is unchanged."
-        required: false
-        type: boolean
-        default: false
   push:
     branches:
       - master
       - main
-      - V2-master
-      - testMain
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -43,89 +25,72 @@ permissions:
 jobs:
   push:
     if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
+    runs-on: ubuntu-latest
     permissions:
       packages: write
       id-token: write
-    # On push events these stay 'true'; on workflow_dispatch they follow the inputs.
-    env:
-      RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
-      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "25"
+          java-version: "17"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
         with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+          gradle-version: 8.14
+
+      - name: Run Gradle Command
+        run: ./gradlew clean build
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/master'
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        with:
+          cosign-release: "v2.4.1"
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        with:
-          cosign-release: "v2.4.1"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Convert repository owner to lowercase
         id: repoowner
         run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
-      - name: Generate tags for latest
+      - name: Generate tags
         id: meta
-        if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref != 'refs/heads/main'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -133,34 +98,31 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
 
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        # Empty-tag guard: build-push-action errors when asked to push with no tags.
-        if: env.RUN_MAIN_APP == 'true' && steps.meta.outputs.tags != ''
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - name: Build and push main Dockerfile
+        id: build-push-regular
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          # No BASE_VERSION pin: inherit the Dockerfile ARG default (single source of truth).
-          build-args: |
-            VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true
 
       - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
+        if: github.ref == 'refs/heads/master'
         env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          DIGEST: ${{ steps.build-push-regular.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -171,10 +133,10 @@ jobs:
               "${tag}@${DIGEST}"
           done
 
-      - name: Generate tags for latest-fat
-        id: meta-fat
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+      - name: Generate tags ultra-lite
+        id: meta2
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        if: github.ref != 'refs/heads/main'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -182,212 +144,65 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' }}
 
-      - name: Build and push Unified Dockerfile (fat variant)
+      - name: Build and push Dockerfile-ultra-lite
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main'
+        with:
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta2.outputs.tags }}
+          labels: ${{ steps.meta2.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Generate tags fat
+        id: meta3
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push main Dockerfile fat
         id: build-push-fat
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-fat.outputs.tags != ''
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
           file: ./docker/embedded/Dockerfile.fat
           push: true
-          cache-from: type=gha,scope=stirling-pdf-fat
-          cache-to: type=gha,mode=max,scope=stirling-pdf-fat
-          tags: ${{ steps.meta-fat.outputs.tags }}
-          labels: ${{ steps.meta-fat.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.meta3.outputs.tags }}
+          labels: ${{ steps.meta3.outputs.labels }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true
 
       - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
+        if: github.ref == 'refs/heads/master'
         env:
           DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          TAGS: ${{ steps.meta3.outputs.tags }}
           COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
         run: |
           echo "$TAGS" | tr ',' '\n' | while read -r tag; do
             cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
           done
-
-      - name: Generate tags for ultra-lite
-        id: meta-lite
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-lite.outputs.tags != ''
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-ultra-lite
-          cache-to: type=gha,mode=max,scope=stirling-pdf-ultra-lite
-          tags: ${{ steps.meta-lite.outputs.tags }}
-          labels: ${{ steps.meta-lite.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
-      # only when the version is new. main/testMain: republish :alpha only
-      # when the source hash differs from the published image's annotation.
-      - name: Read unoserver image version
-        id: unoserverVersion
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          version=$(tr -d '[:space:]' < docker/unoserver/VERSION)
-          if [ -z "$version" ]; then
-            echo "docker/unoserver/VERSION is empty"; exit 1
-          fi
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver image version (from file): ${version}"
-
-      - name: Compute unoserver image source hash
-        id: unoserverHash
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          set -eu
-          hash=$(cat \
-            docker/unoserver/Dockerfile \
-            docker/unoserver/entrypoint.sh \
-            docker/unoserver/healthcheck.sh \
-            docker/unoserver/VERSION \
-            | sha256sum | cut -d' ' -f1)
-          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver source hash: ${hash}"
-
-      - name: Decide whether to publish unoserver image
-        id: unoserverDecision
-        if: env.RUN_UNOSERVER == 'true'
-        env:
-          UNOSERVER_VERSION: ${{ steps.unoserverVersion.outputs.version }}
-          UNOSERVER_HASH: ${{ steps.unoserverHash.outputs.hash }}
-          UNOSERVER_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-unoserver
-          UNOSERVER_HASH_ANNOTATION: org.stirlingpdf.unoserver-source-hash
-          FORCE_REBUILD: ${{ inputs.force_unoserver_rebuild }}
-          GH_REF: ${{ github.ref }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -eu
-          mode="skip"
-          tags=""
-
-          read_published_hash() {
-            local ref="$1"
-            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
-              | jq -r --arg key "$UNOSERVER_HASH_ANNOTATION" \
-                  '.annotations[$key] // empty' \
-              2>/dev/null || true
-          }
-
-          # Manual dispatch from any branch routes to the :alpha publish path.
-          EFFECTIVE_REF="$GH_REF"
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            EFFECTIVE_REF="refs/heads/testMain"
-          fi
-
-          case "$EFFECTIVE_REF" in
-            refs/heads/master|refs/heads/V2-master)
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — building stable regardless"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              elif docker manifest inspect "${UNOSERVER_IMAGE}:${UNOSERVER_VERSION}" >/dev/null 2>&1; then
-                echo "stirling-unoserver:${UNOSERVER_VERSION} already on GHCR — skipping"
-              else
-                echo "stirling-unoserver:${UNOSERVER_VERSION} is new — will publish"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              fi
-              ;;
-            refs/heads/main|refs/heads/testMain)
-              published_hash=$(read_published_hash "${UNOSERVER_IMAGE}:alpha")
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — rebuilding :alpha regardless"
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              elif [ -n "$published_hash" ] && [ "$published_hash" = "$UNOSERVER_HASH" ]; then
-                echo "Published :alpha source hash matches (${published_hash}) — skipping"
-              else
-                if [ -z "$published_hash" ]; then
-                  echo ":alpha has no source-hash annotation (first publish or pre-tracking image) — will publish"
-                else
-                  echo "Source hash changed (was ${published_hash}, now ${UNOSERVER_HASH}) — will publish"
-                fi
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              fi
-              ;;
-            *)
-              echo "Branch ${GH_REF} does not publish unoserver image"
-              ;;
-          esac
-          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
-          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push unoserver image
-        id: build-push-unoserver
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode != 'skip'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          tags: ${{ steps.unoserverDecision.outputs.tags }}
-          # Manifest annotation read by the decision step above to detect drift.
-          annotations: |
-            index:org.stirlingpdf.unoserver-source-hash=${{ steps.unoserverHash.outputs.hash }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign unoserver image
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode == 'stable'
-        env:
-          DIGEST: ${{ steps.build-push-unoserver.outputs.digest }}
-          TAGS: ${{ steps.unoserverDecision.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
-          fi

.github/workflows/releaseArtifacts.yml

@@ -0,0 +1,535 @@
+name: Release Artifacts
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  push:
+    branches: [main, V2, V2-demo]
+
+permissions:
+  contents: read
+
+jobs:
+  determine-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      version: ${{ steps.versionNumber.outputs.versionNumber }}
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Determine build matrix
+        id: set-matrix
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
+          else
+            # For push events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+          fi
+
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
+          retention-days: 30
+
+  sign_verify:
+    needs: build
+    runs-on: ubuntu-latest
+    if: success()
+    strategy:
+      fail-fast: false
+      matrix:
+        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+
+      - name: Generate key pair
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        shell: bash
+        run: |
+          # Sign all artifacts for this platform
+          for file in *; do
+            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
+              echo "Signing: $file"
+
+              # Sign the artifact
+              cosign sign-blob \
+                --key ./cosign.key \
+                --yes \
+                --output-signature "${file}.sig" \
+                "$file"
+
+              # Generate attestation
+              cosign attest-blob \
+                --predicate - \
+                --key ./cosign.key \
+                --yes \
+                --output-attestation "${file}.intoto.jsonl" \
+                "$file"
+
+              # Verify the signature
+              cosign verify-blob \
+                --key ./cosign.pub \
+                --signature "${file}.sig" \
+                "$file"
+
+              echo "✅ Signed and verified: $file"
+            fi
+          done
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}-signed
+          path: |
+            *
+            !cosign.key
+            !cosign.pub
+          retention-days: 30
+
+  release:
+    needs: [determine-matrix, build, sign_verify]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download all signed artifacts
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          pattern: Stirling-PDF-*-signed
+          path: ./artifacts
+
+      - name: Display structure of downloaded files
+        run: ls -R ./artifacts
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        with:
+          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          generate_release_notes: true
+          files: ./artifacts/**/*
+          draft: false
+          prerelease: false

.github/workflows/rollback-latest.yml

@@ -1,93 +0,0 @@
-name: Rollback Latest Tags to Version
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to rollback to (e.g. 2.8.0)"
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  rollback:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Install crane
-        uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Rollback all latest tags to v${{ inputs.version }}
-        env:
-          VERSION: ${{ inputs.version }}
-          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
-          DOCKER_HUB_ORG_USERNAME: ${{ secrets.DOCKER_HUB_ORG_USERNAME }}
-          REPO_OWNER: ${{ steps.repoowner.outputs.lowercase }}
-        run: |
-          set -euo pipefail
-
-          IMAGES=(
-            "${DOCKER_HUB_USERNAME}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/s-pdf"
-            "ghcr.io/${REPO_OWNER}/stirling-pdf"
-            "${DOCKER_HUB_ORG_USERNAME}/stirling-pdf"
-          )
-
-          VARIANTS=(
-            "${VERSION}:latest"
-            "${VERSION}-fat:latest-fat"
-            "${VERSION}-ultra-lite:latest-ultra-lite"
-          )
-
-          FAILED=0
-
-          for image in "${IMAGES[@]}"; do
-            for variant in "${VARIANTS[@]}"; do
-              SOURCE_TAG="${variant%%:*}"
-              TARGET_TAG="${variant##*:}"
-
-              echo "::group::${image} — ${SOURCE_TAG} → ${TARGET_TAG}"
-
-              if crane manifest "${image}:${SOURCE_TAG}" > /dev/null 2>&1; then
-                crane cp "${image}:${SOURCE_TAG}" "${image}:${TARGET_TAG}"
-                echo "✅ ${image}:${TARGET_TAG} now points to ${SOURCE_TAG}"
-              else
-                echo "::warning::⚠️ ${image}:${SOURCE_TAG} not found, skipping"
-                FAILED=1
-              fi
-
-              echo "::endgroup::"
-            done
-          done
-
-          if [ "$FAILED" -ne 0 ]; then
-            echo "::warning::Some source tags were not found. This is expected if not all variants exist for this version."
-          fi
-
-          echo ""
-          echo "🎉 Rollback to ${VERSION} complete!"

.github/workflows/scorecards.yml

@@ -35,12 +35,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
@@ -67,7 +67,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -75,6 +75,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.5
+        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/stale.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -27,28 +27,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "25"
+          java-version: "17"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -56,21 +47,12 @@ jobs:
       - name: Upload Swagger Documentation to SwaggerHub
         run: ./gradlew swaggerhubUpload
         env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
           SWAGGERHUB_USER: "Frooodle"
 
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
       - name: Set API version as published and default on SwaggerHub
         run: |

.github/workflows/sync-portal-docs.yml

@@ -1,95 +0,0 @@
-name: Sync Portal Docs
-
-# Regenerates the portal Developer Docs manifest from the Stirling docs repo and
-# opens a PR when it changes. Runs weekly, on manual dispatch, or when the docs
-# repo fires a `docs-updated` repository_dispatch.
-on:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Docs repo ref (branch or tag) to sync from"
-        required: false
-        default: "main"
-  repository_dispatch:
-    types: [docs-updated]
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    name: Sync docs manifest
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        working-directory: frontend
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        run: npm ci --ignore-scripts --audit=false --fund=false
-
-      - name: Regenerate docs manifest
-        working-directory: frontend
-        env:
-          DOCS_REF: ${{ github.event.inputs.ref || github.event.client_payload.ref || 'main' }}
-          GITHUB_TOKEN: ${{ steps.setup-bot.outputs.token }}
-        run: npm run docs:sync
-
-      - name: Create Pull Request
-        id: cpr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Sync portal docs from docs repo"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: sync-portal-docs
-          base: main
-          title: "Sync portal docs from docs repo"
-          body: |
-            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot].
-
-            Regenerates `frontend/src/processor/proprietary/generated/docsManifest.json`
-            from the Stirling docs repo via `npm run docs:sync`.
-          labels: |
-            Documentation
-            github-actions
-            Front End
-          add-paths: frontend/src/processor/proprietary/generated/docsManifest.json
-          delete-branch: true
-          sign-commits: true

.github/workflows/sync_files_v2.yml

@@ -5,12 +5,9 @@ on:
   push:
     branches:
       - main
+      - syncLangTest
     paths:
       - "build.gradle"
-      - "app/common/build.gradle"
-      - "app/core/build.gradle"
-      - "app/proprietary/build.gradle"
-      - "gradle/spotless.gradle"
       - "README.md"
       - "frontend/public/locales/*/translation.toml"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
@@ -36,13 +33,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -52,37 +47,27 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
       - name: Install Python dependencies
         run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          enable-cache: true
-          cache-suffix: sync-files
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+          pip install tomli-w
 
       - name: Sync translation TOML files
         run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-US/translation.toml" --branch main
-
-      - name: Sort translation TOML files
-        run: |
-          task pre-commit:toml-sort FIX=1
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
 
       - name: Commit translation files
         run: |
           git add frontend/public/locales/*/translation.toml
           git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
 
+      - name: Install README dependencies
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+
       - name: Sync README.md
         run: |
           python scripts/counter_translation_v3.py
@@ -94,7 +79,7 @@ jobs:
 
       - name: Create Pull Request
         if: always()
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
         with:
           token: ${{ steps.setup-bot.outputs.token }}
           commit-message: Update files
@@ -110,7 +95,7 @@ jobs:
             This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
             - **Format**: TOML
@@ -136,4 +121,4 @@ jobs:
           add-paths: |
             README.md
             frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            scripts/ignore_translation.toml

.github/workflows/test-build-docker.yml

@@ -1,243 +0,0 @@
-name: Build Docker images (PR test)
-
-# Reusable workflow called from build.yml on PRs to verify the three
-# embedded Dockerfiles (default, ultra-lite, fat) still build cleanly,
-# optionally against a freshly-built base image when the PR touches the
-# base Dockerfile.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-      dockerfiles-changed:
-        description: "Whether any Dockerfile changed (forwarded from files-changed). Gates the slow arm64 build leg."
-        required: false
-        type: string
-        default: "false"
-
-permissions:
-  contents: read
-
-jobs:
-  # TODO: extract a pre-matrix `prepare` job that runs once and produces
-  # shared artifacts for the three matrix entries below to consume:
-  #   1. `task backend:build` — currently runs 3× in parallel with
-  #      identical env (DISABLE_ADDITIONAL_FEATURES=true,
-  #      STIRLING_PDF_DESKTOP_UI=false). Build once, upload the JAR as an
-  #      artifact, matrix entries download.
-  #   2. The base-image `docker build` (gated on docker-base-changed) —
-  #      currently runs 3× in parallel against the same Dockerfile and
-  #      context. Build once, `docker save` to an artifact, matrix entries
-  #      `docker load` before the embedded build.
-  # Saves ~2 full backend builds + 2 base-image builds per PR that touches
-  # docker. May also be reusable from backend-build.yml's jdk-25 +
-  # spring-security=true matrix entry if `task backend:build` and
-  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
-  test-build-docker-images:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-            cache-scope: stirling-pdf-latest
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-            cache-scope: stirling-pdf-ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
-            cache-scope: stirling-pdf-fat
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Build application
-        run: task backend:build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Build base image locally (PR base change only)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Set base image and platform for this build
-        id: build-params
-        # Pass workflow inputs through env vars rather than expanding `${{ }}`
-        # directly into the shell — defense-in-depth against template injection
-        # if any upstream provider of these values ever becomes less trusted.
-        # GITHUB_EVENT_NAME is already provided by the runner.
-        env:
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          DOCKERFILES_CHANGED: ${{ inputs.dockerfiles-changed }}
-        run: |
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$DOCKER_BASE_CHANGED" = "true" ]; then
-            # Base Dockerfile changed: build against the locally-built base,
-            # which only exists for amd64.
-            echo "base_image=stirling-pdf-base:pr-test" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
-          elif [ "$DOCKERFILES_CHANGED" = "true" ]; then
-            # A Dockerfile changed: also verify the arm64 build (slow QEMU leg).
-            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
-          else
-            # No Dockerfile change: amd64 only. arm64 is exercised on the base
-            # image publish and on release, not on every code PR.
-            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
-          fi
-
-      # Base-changed PRs build the embedded image with the local docker driver
-      # so the locally-built stirling-pdf-base:pr-test (in the daemon image
-      # store) resolves. A buildx container builder cannot see it and would try
-      # to pull it from a registry, which fails. Single-platform, no gha cache.
-      - name: Build ${{ matrix.docker-rev }} against local base (PR base change)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          DOCKER_BUILDKIT=1 docker build \
-            --build-arg BASE_IMAGE=${{ steps.build-params.outputs.base_image }} \
-            --file ./${{ matrix.docker-rev }} \
-            --tag stirling-pdf-embedded:pr-test \
-            .
-
-      # PRs that did NOT change the base use the buildx container builder
-      # (multi-platform + gha cache) against the published base image.
-      - name: Build ${{ matrix.docker-rev }}
-        if: inputs.docker-base-changed != 'true'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          cache-from: type=gha,scope=${{ matrix.cache-scope }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      - name: Upload Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
-          path: |
-            build/reports/tests/
-            build/test-results/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-  test-build-unoserver-image:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Build docker/unoserver/Dockerfile
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Smoke test the built image
-        run: |
-          set -eu
-          docker run -d --name unoserver-smoke \
-            -e UNOSERVER_RECYCLE_INTERVAL_SECONDS=0 \
-            stirling-unoserver:pr-test
-          deadline=$((SECONDS + 60))
-          while [ $SECONDS -lt $deadline ]; do
-            status=$(docker inspect -f '{{.State.Health.Status}}' unoserver-smoke 2>/dev/null || echo "starting")
-            if [ "$status" = "healthy" ]; then
-              echo "unoserver became healthy"
-              docker logs unoserver-smoke | tail -30
-              docker rm -f unoserver-smoke
-              exit 0
-            fi
-            sleep 3
-          done
-          echo "unoserver did not become healthy in time"
-          docker logs unoserver-smoke || true
-          docker rm -f unoserver-smoke || true
-          exit 1

.github/workflows/testdriver.yml

@@ -25,40 +25,31 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "25"
-          distribution: "temurin"
+          java-version: '17'
+          distribution: 'temurin'
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
         with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+          gradle-version: 8.14
 
       - name: Build with Gradle
-        run: ./gradlew build
+        run: ./gradlew clean build
         env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DISABLE_ADDITIONAL_FEATURES: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Get version number
         id: versionNumber
@@ -67,19 +58,17 @@ jobs:
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push test image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/embedded/Dockerfile
           push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
           platforms: linux/amd64
@@ -87,7 +76,7 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Deploy to VPS
@@ -107,7 +96,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF Test"
                 UI_HOMEDESCRIPTION: "Test Deployment"
                 UI_APPNAMENAVBAR: "Test"
@@ -118,9 +107,9 @@ jobs:
               restart: on-failure:5
           EOF
 
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/docker-compose.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
             mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
             mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
             cd /stirling/test-${{ github.sha }}
@@ -136,15 +125,10 @@ jobs:
     outputs:
       frontend: ${{ steps.changes.outputs.frontend }}
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Check for file changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: changes
         with:
           filters: ".github/config/.files.yaml"
@@ -153,18 +137,19 @@ jobs:
     if: needs.files-changed.outputs.frontend == 'true'
     needs: [deploy, files-changed]
     runs-on: ubuntu-latest
+
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          cache: "npm"
+          cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
 
       - name: Run TestDriver.ai
@@ -172,11 +157,11 @@ jobs:
         with:
           key: ${{secrets.TESTDRIVER_API_KEY}}
           prerun: |
-            choco install go-task -y
-            task frontend:build
             cd frontend
+            npm install
+            npm run build
             npm install dashcam-chrome --save
-            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
+            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.VPS_HOST }}:1337"
             Start-Sleep -Seconds 20
           prompt: |
             1. /run testing/testdriver/test.yml
@@ -191,20 +176,20 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
         with:
           egress-policy: audit
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           sudo chmod 600 ../private.key
 
       - name: Cleanup deployment
         if: always()
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
             cd /stirling/test-${{ github.sha }}
             docker-compose down
             cd /stirling

.gitignore

@@ -22,39 +22,24 @@ pipeline/
 customFiles/
 configs/
 watchedFolders/
-# The rule above targets the app's runtime watched-folders working dir, but it
-# also matches this frontend source component dir; keep the source tracked.
-!frontend/src/editor/proprietary/components/watchedFolders/
 clientWebUI/
-# Scratch dir used by local fixture-regeneration runs (see
-# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
-# Holds downloaded JARs and disposable workdirs. Never committed.
-.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
 exampleYmlFiles/stirling/
 /stirling/
 /testing/file_snapshots
-/testing/cucumber/junit/
-/testing/cucumber/report.html
-/testing/.failed_tests
-/.test-state/
 SwaggerDoc.json
 
-# Runtime storage for uploaded files and user data (not Java source code)
-app/core/storage/
+# Docker bind-mount volumes (local data)
+AI-Document-Generator-main/backend/data/
+AI-Document-Generator-main/backend/output/
+docker/compose/stirling/
 
 # Frontend build artifacts copied to backend static resources
 # These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
 app/core/src/main/resources/static/index.html
-# Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
-app/core/src/main/resources/static/*.html
-!app/core/src/main/resources/static/api-landing.html
-!app/core/src/main/resources/static/mobile-upload.html
-# Prerendered nested-route pages (e.g. settings/people.html)
-app/core/src/main/resources/static/settings/
 app/core/src/main/resources/static/locales/
 app/core/src/main/resources/static/Login/
 app/core/src/main/resources/static/classic-logo/
@@ -62,14 +47,7 @@ app/core/src/main/resources/static/modern-logo/
 app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/sw-folder-retry.js
 app/core/src/main/resources/static/robots.txt
-app/core/src/main/resources/static/pdfium/
-app/core/src/main/resources/static/pdfjs/
-app/core/src/main/resources/static/vendor/
-app/core/src/main/resources/static/**/*.gz
-app/core/src/main/resources/static/**/*.br
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
 # Gradle
@@ -174,7 +152,6 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/src-tauri/provisioner/target
 
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -182,6 +159,7 @@ __pycache__/
 *.pyo
 
 # Virtual environments
+.env*
 .venv*
 env*/
 venv*/
@@ -189,9 +167,6 @@ ENV/
 env.bak/
 venv.bak/
 
-# Env files (secrets / local overrides). Subproject .gitignore files whitelist any committed defaults.
-.env*
-
 # VS Code
 /.vscode/**/*
 !/.vscode/settings.json
@@ -201,7 +176,6 @@ venv.bak/
 .idea/
 *.iml
 out/
-.junie/
 
 # Ignore Mac DS_Store files
 .DS_Store
@@ -224,9 +198,6 @@ out/
 *.jks
 *.asc
 
-# Allow test fixture certificates (synthetic, no real credentials)
-!frontend/src/editor/core/tests/test-fixtures/certs/**
-
 # SSH Keys
 *.pub
 *.priv
@@ -237,21 +208,15 @@ id_ecdsa.pub
 id_ed25519
 id_ed25519.pub
 .ssh/
-
-# Allow the published GPG release signing public key (safe to share)
-!docs/security/signing-key.pub
 *ssh
 
-# Taskfile checksum cache
-.task/
-
 # cache
 .cache
 .ruff_cache
 .mypy_cache
 .pytest_cache
 .ipynb_checkpoints
-.build-cache
+
 
 
 **/jcef-bundle/
@@ -281,15 +246,3 @@ docs/type3/signatures/
 
 # Type3 sample PDFs (development only)
 **/type3/samples/
-
-**/application-dev-local.properties
-
-# Claude
-.claude/
-
-# Playwright MCP screenshots / traces
-.playwright-mcp/
-*.playwright-mcp.png
-
-# Local screenshot artifacts from *-screenshots.spec.ts
-frontend/screenshots/

.gitleaksignore

@@ -1,29 +0,0 @@
-# PostHog project-level key - phc_ prefix keys are public/client-side by design
-# (PostHog client-side tracking embeds them in the browser bundle). Committed
-# intentionally in #6150 so engine/.env has a working default, with real
-# credentials overridden via engine/.env.local.
-engine/.env:generic-api-key:41
-
-# MCP test fixtures / harness - no real secrets:
-# - test-only API key constant in an integration test
-# - JDBC URL + throwaway Keycloak creds in the local test compose
-# - placeholder / shell-variable Bearer headers in curl-based validation scripts
-app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
-testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
-testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
-testing/compose/validate-mcp-test.sh:curl-auth-header:92
-testing/compose/validate-mcp-test.sh:curl-auth-header:116
-
-# Storybook example showing curl with a fake Bearer token placeholder (sk_live_a3f8...).
-frontend/src/editor/proprietary/ui/CodeBlock.stories.tsx:curl-auth-header:5
-
-# Truncated placeholder API key in portal docs example (sk_live_8f2c...e10) - not a real secret.
-frontend/src/processor/proprietary/components/docs/GettingStartedSection.tsx:generic-api-key:30
-
-# False positive: generic-api-key matches the Java type name "X509Certificate"
-# in a method signature (CreateSignatureBase.resolveSignatureAlgorithm) - not a secret.
-app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java:generic-api-key:224
-
-# Supabase publishable key (public by design, RLS-protected) used as a CI fallback
-# default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
-.github/workflows/tauri-build.yml:generic-api-key:402

.imgbotconfig

@@ -1,5 +0,0 @@
-{
-  "ignoredFiles": [
-    "frontend/src-tauri/icons/icon.png"
-  ]
-}

.pre-commit-config.yaml

@@ -1,14 +1,46 @@
-# The actual checks live in .taskfiles/pre-commit.yml (with helper scripts under
-# scripts/pre-commit/) and are driven by Task. This hook just delegates to `task
-# pre-commit` so the git pre-commit hook, CI and a manual `task pre-commit` all
-# run the exact same thing. Requires `task` and `uv` on PATH. To auto-fix instead
-# of only checking, run `task pre-commit:fix`.
 repos:
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.2
     hooks:
-      - id: task-pre-commit
-        name: task pre-commit
-        entry: task pre-commit
-        language: system
-        pass_filenames: false
-        always_run: true
+      - id: ruff
+        args:
+          - --fix
+          - --line-length=127
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+      - id: ruff-format
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.1
+    hooks:
+      - id: codespell
+        args:
+          - --ignore-words-list=thirdParty,tabEl,tabEls
+          - --skip="./.*,*.csv,*.json,*.ambr"
+          - --quiet-level=2
+        files: \.(html|css|js|py|md)$
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.28.0
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+      - id: trailing-whitespace
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
+  #   rev: v16.21.1
+  #   hooks:
+  #     - id: stylelint
+  #       additional_dependencies:
+  #         - stylelint@16.21.1
+  #         - stylelint-config-standard@38.0.0
+  #         - "@stylistic/stylelint-plugin@3.1.3"
+  #       files: \.(css)$
+  #       args: [--fix]

.taskfiles/backend.yml

@@ -1,199 +0,0 @@
-version: '3'
-
-# Gradle invocation strategy:
-#   - Linux/macOS: `./gradlew` runs the POSIX shell wrapper natively.
-#   - Windows:     `cmd /c ".\gradlew.bat ..."` invokes the .bat wrapper through
-#                  cmd.exe so it inherits the user's Windows-side `JAVA_HOME`
-#                  and PATH. Routing through `bash gradlew` on Windows ends up
-#                  under WSL or Git-Bash, neither of which inherits
-#                  Adoptium/Temurin's default Windows-only Java env - gradlew
-#                  then errors with "JAVA_HOME is not set and no 'java' command
-#                  could be found".
-#
-#                  The entire `.\gradlew.bat ...` payload is double-quoted so
-#                  the leading `.\` survives mvdan/sh's POSIX backslash
-#                  stripping; cmd.exe also requires `.\` (not bare `gradlew.bat`)
-#                  because modern Windows excludes cwd from cmd's search path.
-
-tasks:
-  dev:
-    desc: "Start backend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-          SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN}}'
-
-  dev:proprietary:
-    desc: "Start backend dev server in proprietary mode"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`. Local overrides in
-    # .env.proprietary.local win over the committed .env.proprietary defaults.
-    dotenv: ['app/.env.proprietary.local', 'app/.env.proprietary']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-      SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN | default ""}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-    cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
-        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}./gradlew :stirling-pdf:bootRun'
-        platforms: [linux, darwin]
-
-  dev:bundled:
-    desc: "Clean + bootRun with frontend bundled into the backend (single :8080 server)"
-    ignore_error: true
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean bootRun -PbuildWithFrontend=true"
-        platforms: [windows]
-      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
-        platforms: [linux, darwin]
-
-  dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
-      PROFILES: '{{.PROFILES | default "dev"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-      STIRLING_FLAVOR: saas
-      AIENGINE_URL: '{{.AIENGINE_URL}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
-        platforms: [linux, darwin]
-
-  build:
-    desc: "Full backend build"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build"
-        platforms: [windows]
-      - cmd: ./gradlew clean build
-        platforms: [linux, darwin]
-
-  build:fast:
-    desc: "Build without tests"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build -x test"
-        platforms: [windows]
-      - cmd: ./gradlew clean build -x test
-        platforms: [linux, darwin]
-
-  build:ci:
-    desc: "Build for CI (formatting checked separately)"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat build -PnoSpotless"
-        platforms: [windows]
-      - cmd: ./gradlew build -PnoSpotless
-        platforms: [linux, darwin]
-
-  test:
-    desc: "Run backend tests"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat test"
-        platforms: [windows]
-      - cmd: ./gradlew test
-        platforms: [linux, darwin]
-
-  test:force:
-    desc: "Run backend tests, ignoring cached results"
-    aliases: [test:no-cache]
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat cleanTest test --no-build-cache"
-        platforms: [windows]
-      - cmd: ./gradlew cleanTest test --no-build-cache
-        platforms: [linux, darwin]
-
-  format:
-    desc: "Auto-fix code formatting"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessApply"
-        platforms: [windows]
-      - cmd: ./gradlew spotlessApply
-        platforms: [linux, darwin]
-
-  format:check:
-    desc: "Check code formatting"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessCheck"
-        platforms: [windows]
-      - cmd: ./gradlew spotlessCheck
-        platforms: [linux, darwin]
-
-  fix:
-    desc: "Auto-fix backend"
-    cmds:
-      - task: format
-
-  swagger:
-    desc: "Generate OpenAPI docs"
-    run: once
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
-        platforms: [linux, darwin]
-    sources:
-      - app/core/src/main/java/**/*.java
-      - app/proprietary/src/main/java/**/*.java
-      - app/common/src/main/java/**/*.java
-    generates:
-      - SwaggerDoc.json
-
-  check:
-    desc: "Backend quality gate"
-    cmds:
-      - task: format:check
-      - task: test
-
-  version:
-    desc: "Print project version"
-    silent: true
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat printVersion --quiet" | tail -1
-        platforms: [windows]
-      - cmd: ./gradlew printVersion --quiet | tail -1
-        platforms: [linux, darwin]
-
-  licenses:check:
-    desc: "Check dependency licenses"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense --no-parallel"
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense --no-parallel
-        platforms: [linux, darwin]
-
-  licenses:generate:
-    desc: "Check and generate dependency license report"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense generateLicenseReport --no-parallel"
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
-        platforms: [linux, darwin]
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean"
-        platforms: [windows]
-      - cmd: ./gradlew clean
-        platforms: [linux, darwin]

.taskfiles/desktop.yml

@@ -1,213 +0,0 @@
-version: '3'
-
-vars:
-  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
-  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
-
-  # Minimum Java major the bundled JRE must be. Keep in sync with build.gradle
-  # `modernJavaVersion` - the app JAR is compiled for this, so an older runtime
-  # fails at launch with UnsupportedClassVersionError. Enforced by jlink:verify.
-  REQUIRED_JAVA: "25"
-
-  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
-  JPDFIUM_PLATFORMS:
-    sh: |
-      if [ -n "${JPDFIUM_PLATFORMS:-}" ]; then
-          echo "$JPDFIUM_PLATFORMS"
-      else
-          case "{{OS}}-{{ARCH}}" in
-              darwin-arm64)  echo "darwin-arm64";;
-              darwin-amd64)  echo "darwin-x64";;
-              linux-amd64)   echo "linux-x64";;
-              linux-arm64)   echo "linux-arm64";;
-              windows-amd64) echo "windows-x64";;
-              windows-arm64) echo "none";;  # no JPDFium windows-arm64 natives published yet
-              *)             echo "all";;
-          esac
-      fi
-
-tasks:
-  prepare:
-    desc: "Prepare desktop build dependencies"
-    deps:
-      - jlink
-      - task: ":frontend:prepare"
-        vars: { MODE: desktop }
-      - provisioner
-
-  provisioner:
-    desc: "Build installer provisioner"
-    platforms: [windows]
-    cmds:
-      - node scripts/build-provisioner.mjs
-
-  dev:
-    desc: "Start Tauri desktop dev mode"
-    deps: [prepare]
-    ignore_error: true
-    cmds:
-      - npx tauri dev --no-watch
-
-  build:
-    desc: "Build Tauri desktop app (production)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build
-
-  build:dev:
-    desc: "Build Tauri desktop app (dev, no bundling)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --no-bundle
-
-  build:dev:mac:
-    desc: "Build Tauri desktop .app bundle (macOS)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  build:dev:windows:
-    desc: "Build Tauri desktop NSIS installer (Windows)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  build:dev:linux:
-    desc: "Build Tauri desktop AppImage (Linux)"
-    deps: [prepare]
-    cmds:
-      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  test:
-    desc: "Run Tauri/Cargo tests"
-    deps: [prepare]
-    dir: src-tauri
-    cmds:
-      - cargo test
-
-  clean:
-    desc: "Clean Tauri/Cargo build artifacts"
-    cmds:
-      - task: jlink:clean
-      - cd src-tauri && cargo clean
-      - rm -rf dist build
-
-  # ============================================================
-  # JLink — Build bundled Java runtime for Tauri
-  # ============================================================
-
-  jlink:
-    desc: "Build backend JAR and create JLink runtime for Tauri"
-    deps: [jlink:jar, jlink:runtime]
-    # Runs after the runtime is in place. Lives here (not in jlink:runtime's
-    # cmds) so it still fires when jlink:runtime short-circuits on its `status:`
-    # check and reuses an existing runtime/jre - that reuse path is exactly how
-    # a stale, too-old JRE slips through.
-    cmds:
-      - task: jlink:verify
-
-  jlink:verify:
-    desc: "Fail the build if the bundled JRE is older than the app JAR requires"
-    env:
-      REQUIRED_JAVA: "{{.REQUIRED_JAVA}}"
-    cmds:
-      - node scripts/verify-bundled-jre.mjs src-tauri/runtime/jre/release
-
-  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling (host-OS natives only by default)"
-    run: once
-    dir: ..
-    env:
-      DISABLE_ADDITIONAL_FEATURES: "true"
-    cmds:
-      - echo "Building bootJar with JPDFium natives for {{.JPDFIUM_PLATFORMS}}"
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
-        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
-        platforms: [linux, darwin]
-      - mkdir -p frontend/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
-    status:
-      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar
-
-  jlink:runtime:
-    desc: "Create custom JRE with jlink"
-    deps: [jlink:jar]
-    dir: src-tauri
-    cmds:
-      - rm -rf runtime/jre
-      - mkdir -p runtime
-      # Pin jlink to JAVA_HOME so the bundled JRE matches the JDK the build
-      # uses. Bare `jlink` on PATH can resolve to an older system Java (the
-      # ubuntu runner ships Java 11), producing a runtime jlink:verify rejects.
-      #
-      # jdk.crypto.mscapi (the Windows certificate store / SunMSCAPI provider, used by
-      # hardware-backed cert signing) is a Windows-only module - it only exists in a Windows
-      # JDK's jmods, so it is added on Windows only or jlink fails to resolve it elsewhere.
-      - cmd: |
-          JLINK="${JAVA_HOME:+$JAVA_HOME/bin/}jlink"
-          JLINK_COMPRESS="$("$JLINK" --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-          "$JLINK" \
-            --add-modules {{.JLINK_MODULES}},jdk.crypto.mscapi \
-            --strip-debug \
-            --compress="$JLINK_COMPRESS" \
-            --no-header-files \
-            --no-man-pages \
-            --output runtime/jre
-        platforms: [windows]
-      - cmd: |
-          JLINK="${JAVA_HOME:+$JAVA_HOME/bin/}jlink"
-          JLINK_COMPRESS="$("$JLINK" --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-          "$JLINK" \
-            --add-modules {{.JLINK_MODULES}} \
-            --strip-debug \
-            --compress="$JLINK_COMPRESS" \
-            --no-header-files \
-            --no-man-pages \
-            --output runtime/jre
-        platforms: [linux, darwin]
-      # jlink emits its files mode 444 (read-only). Tauri's build-script
-      # resource copier preserves source permissions when staging
-      # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
-      # staged copies are read-only too. On any subsequent incremental
-      # build the copier tries to overwrite them and fails with a bare
-      # `Permission denied (os error 13)` (Rust's io::Error Display drops
-      # the path, so the failure is opaque). Make the source writable here
-      # so the staged destinations are writable and can be overwritten.
-      #
-      # Trade-off: this task runs for both `task desktop:dev` and
-      # `task desktop:build`, so production bundles also ship mode-644
-      # JRE files instead of 444. Functionally harmless on POSIX (the
-      # `other` bit is `r--` either way, and on macOS code signing is the
-      # real integrity check) and on Windows the DOS read-only attribute
-      # isn't load-bearing for the bundled JDK. If we ever need strict
-      # 444 in production, split the chmod into a dev-only step and have
-      # `desktop:build` run `jlink:clean` first to force a fresh build.
-      - cmd: chmod -R u+w runtime/jre
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
-        platforms: [windows]
-    status:
-      - test -f runtime/jre/release
-
-  jlink:clean:
-    desc: "Remove JLink runtime and bundled JARs"
-    dir: src-tauri
-    cmds:
-      - rm -rf libs runtime
-
-  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
-  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
-  # jlink under Rosetta on Apple Silicon, so it is opt-in and not part of
-  # the default desktop:build flow. Requires AARCH64_JAVA_HOME and
-  # X64_JAVA_HOME to point at matching JDK installations with jmods/.
-  jlink:universal-mac:
-    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
-    deps: [jlink:jar]
-    platforms: [darwin]
-    env:
-      JLINK_MODULES: "{{.JLINK_MODULES}}"
-      OUTPUT_DIR: src-tauri/runtime/jre
-    cmds:
-      - scripts/build-universal-mac-jre.sh

.taskfiles/docker.yml

@@ -1,68 +0,0 @@
-version: '3'
-
-vars:
-  COMPOSE_DIR: docker/compose
-  EMBEDDED_DIR: docker/embedded
-
-tasks:
-  build:
-    desc: "Build standard Docker image"
-    cmds:
-      - docker build -t stirling-pdf -f {{.EMBEDDED_DIR}}/Dockerfile .
-
-  build:fat:
-    desc: "Build fat Docker image (all features)"
-    cmds:
-      - docker build -t stirling-pdf-fat -f {{.EMBEDDED_DIR}}/Dockerfile.fat .
-
-  build:ultra-lite:
-    desc: "Build ultra-lite Docker image"
-    cmds:
-      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
-
-  build:backend:
-    desc: "Build backend-only Docker image (no embedded frontend)"
-    cmds:
-      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
-
-  build:frontend:
-    desc: "Build frontend-only Docker image"
-    cmds:
-      - docker build -t stirling-pdf-frontend -f docker/frontend/Dockerfile .
-
-  build:engine:
-    desc: "Build engine Docker image"
-    dir: engine
-    cmds:
-      - docker build -t stirling-pdf-engine .
-
-  up:
-    desc: "Start standard docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml up -d
-
-  up:fat:
-    desc: "Start fat docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.fat.yml up -d
-
-  up:ultra-lite:
-    desc: "Start ultra-lite docker compose stack"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.ultra-lite.yml up -d
-
-  down:
-    desc: "Stop all running docker compose stacks"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml down
-
-  logs:
-    desc: "Tail docker compose logs"
-    cmds:
-      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
-
-  test:
-    desc: "Run full Docker integration test suite (builds all variants and tests them)"
-    ignore_error: true
-    cmds:
-      - bash testing/test.sh {{.CLI_ARGS}}

.taskfiles/e2e.yml

@@ -1,266 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install Playwright browsers"
-    dir: frontend
-    deps: [ ':frontend:install' ]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
-
-  stubbed:
-    desc: "Run stubbed E2E tests"
-    dir: frontend
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed {{.CLI_ARGS}}
-
-  live:
-    desc: "Run live E2E tests"
-    summary: |
-      Auto-spawns a Spring Boot backend with isolated state under
-      .test-state/playwright/ (purged on every run) so the suite doesn't
-      touch your local DB, settings.yml, backups or customFiles. The
-      backend is stopped automatically when the runner exits.
-
-      Pass extra Playwright flags via -- :
-        task e2e:live -- --headed --grep merge
-    deps:
-      - live:backend
-      - live:runner
-
-  live:backend:
-    internal: true
-    ignore_error: true
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
-    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
-    # Off by default to keep local dev runs uninstrumented; CI flips it.
-    env:
-      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
-      # Suppress the analytics opt-in modal that fires on first admin login.
-      # It renders a Mantine overlay that intercepts pointer events and blocks
-      # FirstLoginSlide from rendering, so the bootstrap spec times out waiting
-      # for the password-change prompt.
-      SYSTEM_ENABLEANALYTICS: "false"
-      # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
-      # The live-setup project's bootstrap spec performs the real first-login
-      # flow against the backend's default admin/stirling user, exercising the
-      # forced-password-change UI and leaving the DB at admin/adminadmin for
-      # the rest of the live suite. This is both real coverage of the first-
-      # login flow and a stronger seed than env-var-driven user creation.
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) doesn't
-      # support `&` + `$!` + `wait` reliably (gradle was never actually
-      # backgrounded, so `$!` recorded a stale PID and the runner saw an
-      # immediate "backend died"). Real bash backgrounds gradle properly and
-      # gives us a stable PID to clean up.
-      - |
-        bash -c '
-          set -e
-          rm -rf "{{.BASE_DIR}}"
-          mkdir -p "{{.BASE_DIR}}"
-          GRADLE_ARGS=":stirling-pdf:bootRun"
-          if [ -n "${COVERAGE:-}" ]; then
-            # copyJacocoAgent is wired as a dependency of bootRun when
-            # -PjacocoAgent=true, so we do not need to invoke it separately.
-            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
-            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
-          fi
-          # Background gradle and record its PID so the runner can clean up
-          # the exact process tree (wrapper + forked Spring Boot JVM) without
-          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
-          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
-          # synchronised.
-          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
-          GRADLE_PID=$!
-          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
-          wait $GRADLE_PID
-        '
-
-  live:runner:
-    internal: true
-    deps: [ ':frontend:prepare' ]
-    dir: frontend
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) only
-      # supports `EXIT`/`ERR` in `trap`, not `INT`/`TERM`. CLI_ARGS are
-      # passed positionally so quoted args like --grep "foo bar" survive.
-      - |
-        bash -c '
-          set +e
-          # bootRun forks a separate Spring Boot JVM as a child of the gradle
-          # wrapper; killing only the wrapper leaves that JVM orphaned holding
-          # :8080. Walk the recorded PID'"'"'s process tree via pgrep so we kill
-          # every descendant, then lsof as a last-resort backstop.
-          kill_tree() {
-            local pid=$1
-            for child in $(pgrep -P "$pid" 2>/dev/null); do
-              kill_tree "$child"
-            done
-            kill "$pid" 2>/dev/null || true
-          }
-          cleanup() {
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              echo "Stopping backend..."
-              kill_tree "$(cat "{{.BASE_DIR}}/backend.pid")"
-              sleep 1
-              lsof -ti:8080 2>/dev/null | xargs kill 2>/dev/null || true
-              echo "Backend stopped"
-            fi
-          }
-          # Trap so cleanup runs on every exit path: tests pass, tests fail,
-          # backend never starts, user Ctrl-Cs. Without this the gradle JVM
-          # is left orphaned holding :8080 whenever the wait loop times out.
-          trap cleanup EXIT INT TERM
-
-          echo "Waiting for backend on :8080 (up to 10min; first compile can be slow)..."
-          WAITED=0
-          while [ $WAITED -lt 600 ]; do
-            if curl -sf http://localhost:8080/api/v1/info/status 2>/dev/null | grep -q UP; then
-              echo "Backend ready, starting Playwright"
-              break
-            fi
-            # Bail early if the backend already died: no point waiting 10min.
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              BACKEND_PID=$(cat "{{.BASE_DIR}}/backend.pid")
-              if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
-                echo "Backend process exited before becoming ready; last 100 log lines:"
-                tail -100 "{{.BASE_DIR}}/backend.log" 2>/dev/null || true
-                exit 1
-              fi
-            fi
-            sleep 2
-            WAITED=$((WAITED + 2))
-          done
-          if [ $WAITED -ge 600 ]; then
-            echo "Backend did not become ready within 10min, aborting"
-            exit 1
-          fi
-
-          npx playwright test --project=live "$@"
-        ' bash {{.CLI_ARGS}}
-
-  enterprise:
-    desc: "Run enterprise E2E tests"
-    summary: |
-      Requires an already-running keycloak compose stack on :8080. Bring one
-      up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    dir: frontend
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=enterprise {{.CLI_ARGS}}
-
-  cross-browser:
-    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
-
-  check:
-    desc: "Run all E2E tests not requiring Docker"
-    cmds:
-      - task: stubbed
-      - task: live
-
-  check:all:
-    desc: "Run all E2E tests"
-    summary: |
-      Includes the enterprise project, which requires a keycloak compose
-      stack on :8080. Bring one up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    cmds:
-      - task: stubbed
-      - task: live
-      - task: enterprise
-
-  oauth:up:
-    desc: "Start the OAuth keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:oauth:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:oauth:up -- --auto --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-oauth-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  oauth:down:
-    desc: "Stop the OAuth keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-oauth.yml down -v
-
-  saml:up:
-    desc: "Start the SAML keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:saml:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:saml:up -- --auto --with-storage --nobuild --language sv-SE
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-saml-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  saml:down:
-    desc: "Stop the SAML keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
-
-  mcp:up:
-    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
-    summary: |
-      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
-      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:mcp:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:mcp:up -- --validate --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:manual:
-    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
-    summary: |
-      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
-      access token so you can drive your own MCP client (Inspector, curl, ...).
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
-      Add --nobuild if the images are already built:
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:apikey:
-    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
-    summary: |
-      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
-      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
-      Add --nobuild if images are already built:
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:validate:
-    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
-    cmds:
-      - bash testing/compose/validate-mcp-test.sh
-
-  mcp:validate-apikey:
-    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
-    cmds:
-      - bash testing/compose/validate-mcp-apikey.sh
-
-  mcp:down:
-    desc: "Stop the MCP keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v

.taskfiles/engine.yml

@@ -1,139 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install engine dependencies"
-    run: once
-    cmds:
-      - uv python install 3.13.8
-      - uv sync
-    sources:
-      - uv.lock
-      - pyproject.toml
-    status:
-      - test -d .venv
-
-  prepare:
-    desc: "Set up engine .env from template"
-    deps: [install]
-    cmds:
-      - uv run scripts/setup_env.py
-    sources:
-      - scripts/setup_env.py
-    generates:
-      - .env.local
-
-  run:
-    desc: "Run engine server"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
-
-  dev:
-    desc: "Start engine dev server with hot reload"
-    deps: [prepare]
-    ignore_error: true
-    dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
-    env:
-      PYTHONUNBUFFERED: "1"
-    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - uv run ruff check .
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - uv run ruff check . --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - uv run ruff format . --diff
-
-  typecheck:
-    desc: "Run type checking"
-    deps: [install]
-    cmds:
-      - uv run pyright . --warnings
-
-  test:
-    desc: "Run tests"
-    deps: [prepare]
-    cmds:
-      - uv run pytest tests
-
-  fix:
-    desc: "Auto-fix lint + format"
-    cmds:
-      - task: format  # Can auto-fix some things that `lint:fix` can't like line length violations
-      - task: lint:fix
-      - task: format  # Ensure that after lint fixing that the code is still formatted correctly
-
-  check:
-    desc: "Full engine quality gate"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  tool-models:
-    desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py
-    sources:
-      - ../SwaggerDoc.json
-      - scripts/generate_tool_models.py
-    generates:
-      - src/stirling/models/tool_models.py
-      - src/stirling/models/tool_io.py
-
-  tool-models:check:
-    desc: "Fail if the committed tool models are out of date"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py --check
-
-  clean:
-    desc: "Clean build artifacts"
-    cmds:
-      - task: '{{if eq .OS "Windows_NT"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    desc: "Clean build artifacts"
-    cmds:
-      - rm -rf .venv data logs output
-
-  # On Windows, use PowerShell as bash failed to delete some dependencies
-  clean-windows:
-    internal: true
-    desc: "Clean build artifacts"
-    ignore_error: true
-    cmds:
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue .venv
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue data
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue logs
-      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue output

.taskfiles/frontend.yml

@@ -1,531 +0,0 @@
-version: '3'
-
-# Tasks operate from the workspace root (frontend/). Editor commands pass
-# `editor` as the vite project root (positional after `build` / before the
-# mode flag) or use `--project editor/...` for tsc — so the editor lives
-# under frontend/ without each task needing a cd.
-
-tasks:
-  install:
-    desc: "Install dependencies"
-    run: once
-    cmds:
-      - '{{ if eq .CI "true" }}npm ci{{ else }}npm install{{ end }}'
-    sources:
-      - package-lock.json
-      - package.json
-    status:
-      - test -d node_modules
-    env:
-      CI: '{{ .CI | default "false" }}'
-
-  prepare:env:
-    internal: true
-    run: when_changed
-    deps: [install]
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    cmds:
-      - npx tsx scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
-    sources:
-      - scripts/setup-env.mts
-    generates:
-      - .env.local
-      - .env{{if .MODE}}.{{.MODE}}{{end}}.local
-
-  prepare:icons:
-    internal: true
-    run: once
-    deps: [install]
-    cmds:
-      - node scripts/generate-icons.js
-
-  prepare:og:
-    internal: true
-    run: when_changed
-    desc: "Regenerate OG/social-preview metadata from the tool registry"
-    cmds:
-      - node scripts/generate-og-metadata.mjs
-    sources:
-      - src/editor/core/types/toolId.ts
-      - src/editor/core/utils/urlMapping.ts
-      - src/editor/core/data/useTranslatedToolRegistry.tsx
-      - public/og_images/*.png
-    generates:
-      - src/editor/core/data/ogImageMap.json
-      - public/og-metadata.json
-
-  prepare:
-    desc: "Set up dev environment"
-    run: when_changed
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    deps:
-      - task: prepare:env
-        vars: { MODE: '{{.MODE}}' }
-      - prepare:icons
-      - prepare:og
-
-  # ============================================================
-  # Development
-  # ============================================================
-
-  dev:_run:
-    internal: true
-    ignore_error: true
-    vars:
-      MODE: '{{.MODE}}'
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      OPEN: '{{.OPEN | default ""}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-      # Dev-only browser-tab label so concurrent worktrees are distinguishable.
-      # Only the worktree folder basename (e.g. "wt1") is exposed — never the
-      # full path, hostname, or user. Consumed at dev-serve time by vite.config
-      # and dropped from production builds.
-      STIRLING_DEV_LABEL:
-        sh: >-
-          {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
-    cmds:
-      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
-
-  dev:
-    desc: "Start frontend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars: { PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:core:
-    desc: "Start frontend dev server in core mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: core, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:proprietary:
-    desc: "Start frontend dev server in proprietary mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:saas:
-    desc: "Start frontend dev server in SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - task: dev:_run
-        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:desktop:
-    desc: "Start frontend dev server in desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - task: dev:_run
-        vars: { MODE: desktop, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  dev:prototypes:
-    desc: "Start frontend dev server in prototypes mode"
-    deps: [prepare]
-    cmds:
-      - task: dev:_run
-        vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
-
-  # ============================================================
-  # Build
-  # ============================================================
-
-  build:
-    desc: "Production build (default mode)"
-    deps: [prepare]
-    cmds:
-      - npx vite build
-
-  build:core:
-    desc: "Build for core mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode core
-
-  build:proprietary:
-    desc: "Build for proprietary mode"
-    deps: [prepare]
-    vars:
-      PREVIEW: '{{.PREVIEW | default ""}}'
-    cmds:
-      - '{{if .PREVIEW}}VITE_BUILD_FOR_PREVIEW=1 {{end}}npx vite build --mode proprietary'
-
-  build:saas:
-    desc: "Build for SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - npx vite build --mode saas
-
-  build:desktop:
-    desc: "Build for desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - npx vite build --mode desktop
-
-  build:prototypes:
-    desc: "Build for prototypes mode"
-    deps: [prepare]
-    cmds:
-      - npx vite build --mode prototypes
-
-
-  storybook:
-    desc: "Start Storybook dev server"
-    deps: [prepare]
-    cmds:
-      - npx storybook dev -p 6006 {{.CLI_ARGS}}
-
-  storybook:build:
-    desc: "Build static Storybook"
-    deps: [prepare]
-    cmds:
-      - npx storybook build {{.CLI_ARGS}}
-
-  storybook:browser:
-    internal: true
-    desc: "Install the Chromium build the story scan runs in"
-    run: once
-    deps: [install]
-    cmds:
-      - npx playwright install chromium
-
-  storybook:test:
-    desc: "Scan every story in real Chromium: it must render and pass axe"
-    deps: [prepare, storybook:browser]
-    cmds:
-      # Runs each story as a browser test. Pass a filter through, e.g.
-      #   task frontend:storybook:test -- Button
-      - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}
-
-  storybook:a11y:
-    desc: "a11y regression gate over every story: fail only on NEW axe violations"
-    deps: [prepare, storybook:browser]
-    cmds:
-      - node .storybook/a11y-scan.mjs
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-
-  storybook:a11y:changed:
-    desc: "a11y gate over the stories this branch affects (default base origin/main)"
-    summary: |
-      Scans the stories a branch affects, which is what pull requests run — a
-      full scan takes ~30 minutes, far too long to sit in front of every merge.
-      A story is affected if its file changed, or if a same-named sibling
-      source file changed (editing Button.tsx or Button.css re-scans
-      Button.stories.tsx — the story renders the live component, so a component
-      edit changes what the story shows without touching the story file).
-      Changes that ripple further than a component's own stories are covered by
-      the nightly full sweep.
-
-      Pass a base ref through CLI_ARGS, e.g.
-        task frontend:storybook:a11y:changed -- origin/release
-    deps: [prepare, storybook:browser]
-    vars:
-      BASE: '{{.CLI_ARGS | default "origin/main"}}'
-      CHANGED:
-        sh: node .storybook/a11y-changed.mjs {{.CLI_ARGS | default "origin/main"}}
-    cmds:
-      - cmd: |
-          if [ -z '{{.CHANGED}}' ]; then
-            echo "a11y: no story files affected vs {{.BASE}} — nothing to check"
-            exit 0
-          fi
-          node .storybook/a11y-scan.mjs {{.CHANGED}}
-          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-
-  storybook:a11y:record:
-    desc: "Re-record the a11y baseline (run after intentionally fixing/adding violations)"
-    deps: [prepare, storybook:browser]
-    cmds:
-      - node .storybook/a11y-scan.mjs
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record
-
-  # ============================================================
-  # Code quality
-  # ============================================================
-
-  lint:
-    desc: "Run linting"
-    deps: [install]
-    cmds:
-      - task: lint:eslint
-      - task: lint:dpdm
-      - task: lint:colors
-      - task: lint:css
-
-  lint:css:
-    desc: "Lint stylesheets for duplicate selectors"
-    deps: [install]
-    cmds:
-      # Covers the whole editor tree, including the portal/processor layer and
-      # public/css. Vendored CSS and build output are excluded via ignoreFiles
-      # in stylelint.config.mjs.
-      - npx stylelint "src/**/*.css"
-
-  lint:colors:
-    desc: "Enforce theme tokens — no hardcoded colours or raw primitives in components"
-    aliases: [lint:colours]
-    deps: [install]
-    cmds:
-      - node scripts/lint/theme-lint.mjs
-      - node scripts/lint/theme-lint.mjs css-colors
-      - node scripts/lint/theme-lint.mjs code-colors
-      - node scripts/lint/theme-lint.mjs no-primitives
-
-  contrast:
-    desc: "Report low-contrast theme token pairs (warning only, never blocks)"
-    deps: [install]
-    cmds:
-      - node scripts/lint/theme-lint.mjs contrast
-
-  lint:eslint:
-    desc: "Run ESLint linting"
-    deps: [install]
-    cmds:
-      - npx eslint --max-warnings=0
-
-  lint:dpdm:
-    desc: "Run circular import linting"
-    deps: [install]
-    cmds:
-      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
-      # shell-agnostic. Covers the whole editor tree, including the portal layer.
-      - npx dpdm "src/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
-
-  lint:fix:
-    desc: "Auto-fix lint issues"
-    deps: [install]
-    cmds:
-      - npx eslint --fix
-
-  format:
-    desc: "Auto-fix code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --write .
-
-  format:check:
-    desc: "Check code formatting"
-    deps: [install]
-    cmds:
-      - npx prettier --check .
-
-  fix:
-    desc: "Auto-fix lint and format"
-    cmds:
-      - task: format
-      - task: lint:fix
-
-  typecheck:
-    desc: "Typecheck default build of the app"
-    cmds:
-      - task: typecheck:proprietary
-
-  typecheck:_run:
-    internal: true
-    cmds:
-      - 'npx tsc --noEmit --project {{.PROJECT}}'
-
-  typecheck:core:
-    desc: "Typecheck core build variant"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/editor/core/tsconfig.json }
-
-  typecheck:proprietary:
-    desc: "Typecheck proprietary build variant"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/editor/proprietary/tsconfig.json }
-
-  typecheck:saas:
-    desc: "Typecheck SaaS build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/editor/saas/tsconfig.json }
-
-  typecheck:desktop:
-    desc: "Typecheck desktop build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/editor/desktop/tsconfig.json }
-
-  typecheck:cloud:
-    desc: "Typecheck cloud shared layer (standalone)"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/editor/cloud/tsconfig.json }
-
-  typecheck:scripts:
-    desc: "Typecheck scripts"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: scripts/tsconfig.json }
-
-  typecheck:prototypes:
-    desc: "Typecheck prototypes build variant"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/editor/prototypes/tsconfig.json }
-
-  typecheck:portal:
-    desc: "Typecheck developer portal build variant"
-    deps: [install]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: src/processor/proprietary/tsconfig.json }
-
-  typecheck:storybook:
-    desc: "Typecheck Storybook config and stories"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: .storybook/tsconfig.json }
-
-  typecheck:all:
-    desc: "Typecheck all build variants"
-    cmds:
-      - task: typecheck:core
-      - task: typecheck:proprietary
-      - task: typecheck:saas
-      - task: typecheck:desktop
-      - task: typecheck:cloud
-      - task: typecheck:scripts
-      - task: typecheck:prototypes
-      - task: typecheck:portal
-      - task: typecheck:storybook
-
-  # ============================================================
-  # Quality Gate
-  # ============================================================
-
-  check:
-    desc: "Quick quality gate for local development"
-    cmds:
-      - task: typecheck
-      - task: lint
-      - task: format:check
-      - task: test
-
-  og:check:
-    desc: "Fail if committed OG/social-preview metadata is out of date"
-    cmds:
-      - node scripts/generate-og-metadata.mjs --check
-
-  check:all:
-    desc: "Full CI quality gate"
-    cmds:
-      # Runs first, before prepare regenerates: guards the committed og-metadata.json /
-      # ogImageMap.json that the Cloudflare Pages (plain `vite build`) deploy relies on.
-      - task: og:check
-      - task: typecheck:all
-      - task: lint
-      - task: format:check
-      - task: build
-      - task: test
-      - task: storybook:build
-
-  # ============================================================
-  # Test
-  # ============================================================
-
-  test:
-    desc: "Run tests"
-    cmds:
-      - task: test:editor
-
-  test:editor:
-    desc: "Run editor tests"
-    deps: [prepare]
-    cmds:
-      - npx vitest run --root .
-
-  test:watch:
-    desc: "Run tests in watch mode"
-    deps: [prepare]
-    cmds:
-      - npx vitest --watch --root .
-
-  test:coverage:
-    desc: "Run tests with coverage (one-shot; CI-friendly)."
-    deps: [prepare]
-    cmds:
-      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
-      # mode). Explicit reporter list because v8 + json-summary is what the
-      # coverage-summary.py helper consumes; html/text are kept for humans.
-      #
-      # reportsDirectory is pinned to ./coverage relative to vitest's root
-      # (--root .), so output lands at frontend/coverage/. The
-      # CI upload step reads from that path. An earlier attempt with
-      # `./editor/coverage` double-nested into frontend/coverage;
-      # pinning future-proofs against vitest changing the default.
-      - >
-        npx vitest run --root . --coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage
-
-  # ============================================================
-  # Code Generation
-  # ============================================================
-
-  tool-models:
-    desc: "Generate tool API types from the Java OpenAPI spec"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - npx tsx scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output src/editor/core/types/toolApiTypes.ts --io-output src/editor/core/types/toolIO.ts
-    sources:
-      - scripts/generate-tool-api-types.mts
-      - ../SwaggerDoc.json
-    generates:
-      - src/editor/core/types/toolApiTypes.ts
-      - src/editor/core/types/toolIO.ts
-
-  tool-models:check:
-    desc: "Fail if committed tool API types are out of date"
-    deps: [install, ":backend:swagger"]
-    cmds:
-      - npx tsx scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output src/editor/core/types/toolApiTypes.ts --io-output src/editor/core/types/toolIO.ts --check
-
-  licenses:generate:
-    desc: "Generate frontend license report"
-    deps: [install]
-    cmds:
-      - node scripts/generate-licenses.js
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean build artifacts and caches"
-    cmds:
-      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, dist, dist
-        platforms: [windows]
-      - cmd: rm -rf node_modules/.vite dist dist
-        platforms: [linux, darwin]

.taskfiles/pre-commit.yml

@@ -1,133 +0,0 @@
-version: '3'
-
-# Repo-wide lint/format/secret checks - the single source of truth that the git
-# pre-commit hook (.pre-commit-config.yaml) and CI (pre_commit.yml) both call.
-
-vars:
-  # File selections as git pathspecs: git does the include/exclude matching, so
-  # there is no grep/xargs and it behaves identically on every platform.
-  PY_FILES: >-
-    'scripts/*.py'
-    '.github/scripts/*.py'
-    'app/core/src/main/resources/static/python/*.py'
-    ':(exclude)*split_photos.py'
-  SPELL_FILES: >-
-    '*.html'
-    '*.css'
-    '*.js'
-    '*.py'
-    '*.md'
-    ':(exclude).vscode/*'
-    ':(exclude).devcontainer/*'
-    ':(exclude)app/core/src/main/resources/*'
-    ':(exclude)app/proprietary/src/main/resources/*'
-    ':(exclude)frontend/public/vendor/*'
-    ':(exclude)*Dockerfile*'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-  WS_FILES: >-
-    '*.js'
-    '*.java'
-    '*.py'
-    '*.yml'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-    ':(exclude).github/workflows/*'
-  LOCALE_TOML: 'frontend/public/locales/*/translation.toml'
-
-  # gitleaks is pinned + checksum-verified by scripts/pre-commit/install_gitleaks.py,
-  # which owns the version and caches the binary here.
-  GITLEAKS_BIN: '.task/bin/gitleaks{{if eq OS "windows"}}.exe{{end}}'
-
-tasks:
-  default:
-    desc: "Check formatting, spelling, and secrets across the repo"
-    cmds:
-      - task: ruff
-      - task: ruff-format
-      - task: codespell
-      - task: gitleaks
-      - task: whitespace
-      - task: toml-sort
-
-  fix:
-    desc: "Auto-fix formatting, spelling, and secrets issues across the repo"
-    cmds:
-      # Auto-fixers first, then the report-only tools (codespell, gitleaks) so a
-      # finding there does not stop the fixers from running.
-      - task: ruff
-        vars: { FIX: '1' }
-      - task: ruff-format
-        vars: { FIX: '1' }
-      - task: whitespace
-        vars: { FIX: '1' }
-      - task: toml-sort
-        vars: { FIX: '1' }
-      - task: codespell
-      - task: gitleaks
-
-  install:
-    desc: "Install the pinned pre-commit Python tools"
-    run: once
-    cmds:
-      - uv sync --project scripts/pre-commit --locked
-    sources:
-      - scripts/pre-commit/uv.lock
-      - scripts/pre-commit/pyproject.toml
-    status:
-      - test -d scripts/pre-commit/.venv
-
-  clean:
-    desc: "Remove the cached gitleaks binary and the tool virtualenv"
-    cmds:
-      - cmd: rm -rf scripts/pre-commit/.venv .task/bin/gitleaks
-        platforms: [linux, darwin]
-      - cmd: cmd /c "rmdir /s /q scripts\pre-commit\.venv & del /q .task\bin\gitleaks.exe"
-        platforms: [windows]
-        ignore_error: true
-
-  # Individual checks (hidden from `task --list`, but callable, e.g.
-  # `task pre-commit:toml-sort FIX=1`). Pass FIX=1 to auto-fix where supported.
-  ruff:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
-
-  ruff-format:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
-
-  codespell:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
-
-  toml-sort:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync python scripts/pre-commit/sort_locale_toml.py {{if .FIX}}--fix {{end}}{{.LOCALE_TOML}}
-
-  whitespace:
-    cmds:
-      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
-
-  gitleaks:
-    deps: [gitleaks-bin]
-    # Scan staged changes only, matching the old hook: the git-mode fingerprints
-    # in .gitleaksignore (file:rule:line) still apply, and with nothing staged
-    # this is a no-op. Secrets are never auto-fixed, so FIX has no effect.
-    cmds:
-      - "{{.GITLEAKS_BIN}} git --pre-commit --redact --staged --verbose"
-
-  gitleaks-bin:
-    internal: true
-    desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
-    cmds:
-      - uv run --no-project python scripts/pre-commit/install_gitleaks.py

.vscode/extensions.json

@@ -13,7 +13,7 @@
     "vscjava.vscode-spring-boot-dashboard", // Spring Boot dashboard for managing and visualizing Spring Boot applications
     "EditorConfig.EditorConfig", // EditorConfig support for maintaining consistent coding styles
     "ms-azuretools.vscode-docker", // Docker extension for Visual Studio Code
-    "GitHub.copilot-chat", // GitHub Copilot AI pair programmer for Visual Studio Code
+    "GitHub.copilot", // GitHub Copilot AI pair programmer for Visual Studio Code
     "GitHub.vscode-pull-request-github", // GitHub Pull Requests extension for Visual Studio Code
     "charliermarsh.ruff", // Ruff code formatter for Python to follow the Ruff Style Guide
     "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing

ADDING_TOOLS.md

@@ -1,6 +1,6 @@
 # Adding New React Tools to Stirling PDF
 
-This guide covers how to add new PDF tools to the React frontend.
+This guide covers how to add new PDF tools to the React frontend, either by migrating existing Thymeleaf templates or creating entirely new tools.
 
 ## Overview
 
@@ -188,7 +188,7 @@ import { use[ToolName]Tips } from "../components/tooltips/use[ToolName]Tips";
 
 const [ToolName] = (props: BaseToolProps) => {
   const tips = use[ToolName]Tips();
-
+  
   // In your steps array:
   steps: [
     {
@@ -200,9 +200,9 @@ const [ToolName] = (props: BaseToolProps) => {
 ```
 
 ## 5. Add Translations
-Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.
+Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-US/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.toml`
 
 **Required Translation Keys**:
 ```toml
@@ -251,20 +251,28 @@ Update translation files. **Important: Only update `en-US` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-US/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions
 
 **Tooltip Writing Guidelines:**
-- **Use simple, everyday language** - avoid technical terms like "converts interactive elements"
+- **Use simple, everyday language** - avoid technical terms like "converts interactive elements" 
 - **Focus on benefits** - explain what the user gains, not how it works internally
 - **Use concrete examples** - "text boxes become regular text" vs "form fields are flattened"
 - **Answer user questions** - "What does this do?", "When should I use this?", "What's this option for?"
 - **Keep descriptions concise** - 1-2 sentences maximum per section
 - **Use bullet points** for multiple benefits or features
 
-## 6. Testing Your Tool
+## 6. Migration from Thymeleaf
+When migrating existing Thymeleaf templates:
+
+1. **Identify Form Parameters**: Look at the original `<form>` inputs to determine parameter structure
+2. **Extract Translation Keys**: Find `#{key.name}` references and add them to JSON translations (For many tools these translations will already exist but some parts will be missing)
+3. **Map API Endpoint**: Note the `th:action` URL for the operation hook
+4. **Preserve Functionality**: Ensure all original form behaviour is replicated which is applicable to V2 react UI
+
+## 7. Testing Your Tool
 - Verify tool appears in UI with correct icon and description
 - Test with various file sizes and types
 - Confirm translations work

AGENTS.md

@@ -1,511 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to AI Agents when working with code in this repository.
-
-## Taskfile (Recommended)
-
-This project uses [Task](https://taskfile.dev/) as a unified command runner. All build, dev, test, lint, and docker commands can be run from the repo root via `task <command>`. Run `task --list` to see all available commands.
-
-Task `desc:` fields should describe **what** the task does, not **how** it does it. Keep them generic and stable: don't reference implementation details like aliases, internal helpers, mode flags, or which other task delegates to which. The description is for users picking a command from `task --list`, not a changelog of refactors.
-
-### Quick Reference
-- `task install` — install all dependencies
-- `task dev` — start backend + frontend concurrently
-- `task dev:all` — start backend + frontend + engine concurrently
-- `task build` — build all components
-- `task test` — run all tests (backend + frontend + engine)
-- `task lint` — run all linters
-- `task format` — auto-fix formatting across all components
-- `task check` — full quality gate (lint + typecheck + test)
-- `task clean` — clean all build artifacts
-- `task docker:build` — build standard Docker image
-- `task docker:up` — start Docker compose stack
-
-## Common Development Commands
-
-### Build and Test
-- **Build project**: `task build`
-- **Run backend locally**: `task backend:dev`
-- **Run all tests**: `task test` (or individually: `task backend:test`, `task frontend:test`, `task engine:test`)
-- **Docker integration tests**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
-- **Code formatting**: `task format` (or `task backend:format` for Java only)
-- **Full quality gate**: `task check` (runs lint + typecheck + test across all components)
-
-After modifying any files in the project, you must run the relevant `task check` command that covers that area of the code. For example, when editing frontend files run `task frontend:check`; for Python engine files run `task engine:check`; for Java backend files run `task backend:check`.
-
-### Docker Development
-- **Build standard**: `task docker:build` (or `docker build -t stirling-pdf -f docker/embedded/Dockerfile .`)
-- **Build fat version**: `task docker:build:fat`
-- **Build ultra-lite**: `task docker:build:ultra-lite`
-- **Start compose stack**: `task docker:up` (or `task docker:up:fat`, `task docker:up:ultra-lite`)
-- **Stop compose stack**: `task docker:down`
-- **View logs**: `task docker:logs`
-- **Example compose files**: Located in `exampleYmlFiles/` directory
-
-### Security Mode Development
-Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
-
-### Python Development (AI Engine)
-
-The engine is a Python reasoning service for Stirling: it plans and interprets work, but it does not own durable state, and it does not execute Stirling PDF operations directly. Keep the service narrow: typed contracts in, typed contracts out, with AI only where it adds reasoning value. The frontend calls the Python engine via Java as a proxy.
-
-#### Python Commands
-All engine commands run from the repo root using Task:
-- `task engine:check` — run all checks (typecheck + lint + format-check + test)
-- `task engine:fix` — auto-fix lint + formatting
-- `task engine:install` — install Python dependencies via uv
-- `task engine:dev` — start FastAPI with hot reload (localhost:5001)
-- `task engine:test` — run pytest
-- `task engine:lint` — run ruff linting
-- `task engine:typecheck` — run pyright
-- `task engine:format` — format code with ruff
-- `task engine:tool-models` — generate `tool_models.py` from the Java OpenAPI spec
-
-The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
-
-#### Python Code Style
-- Keep `task engine:check` passing.
-- Use modern Python when it improves clarity.
-- Prefer explicit names to cleverness.
-- Avoid nested functions and nested classes unless the language construct requires them.
-- Prefer composition to inheritance when combining concepts.
-- Avoid speculative abstractions. Add a layer only when it removes real duplication or clarifies lifecycle.
-- Add comments sparingly and only when they explain non-obvious intent.
-
-#### Python Typing and Models
-- Deserialize into Pydantic models as early as possible.
-- Serialize from Pydantic models as late as possible.
-- Do not pass raw `dict[str, Any]` or `dict[str, object]` across important boundaries when a typed model can exist instead.
-- Avoid `Any` wherever possible.
-- Avoid `cast()` wherever possible (reconsider the structure first).
-- All shared models should subclass `stirling.models.ApiModel` so the service behaves consistently.
-- Do not use string literals for any type annotations, including `cast()`.
-
-#### Python Configuration
-- Keep application-owned configuration in `stirling.config`.
-- Only add `STIRLING_*` environment variables that the engine itself truly owns.
-- Do not mirror third-party provider environment variables unless the engine is actually interpreting them.
-- Let `pydantic-ai` own provider authentication configuration when possible.
-
-#### Python Architecture
-
-**Package roles:**
-- `stirling.contracts`: request/response models and shared typed workflow contracts. If a shape crosses a module or service boundary, it probably belongs here.
-- `stirling.models`: shared model primitives and generated tool models.
-- `stirling.agents`: reasoning modules for individual capabilities.
-- `stirling.api`: HTTP layer, dependency access, and app startup wiring.
-- `stirling.services`: shared runtime and non-AI infrastructure.
-- `stirling.config`: application-owned settings.
-
-**Source of truth:**
-- `stirling.models.tool_models` is the source of truth for operation IDs and parameter models.
-- Do not duplicate operation lists if they can be derived from `tool_models.OPERATIONS`.
-- Do not hand-maintain parallel parameter schemas when the generated tool models already define them.
-- If a tool ID must match a parameter model, validate that relationship explicitly in code.
-
-**Boundaries:**
-- Keep the API layer thin. Route modules should bind requests, resolve dependencies, and call agents or services. They should not contain business logic.
-- Keep agents focused on one reasoning domain. They should not own FastAPI routing, persistence, or execution of Stirling operations.
-- Build long-lived runtime objects centrally at startup when possible rather than reconstructing heavy AI objects per request.
-- If an agent delegates to another agent, the delegated agent should remain the source of truth for its own domain output.
-
-#### Python AI Usage
-- The system must work with any AI, including self-hosted models. We require that the models support structured outputs, but should minimise model-specific code beyond that.
-- Use AI for reasoning-heavy outputs, not deterministic glue.
-- Do not ask the model to invent data that Python can derive safely.
-- Do not fabricate fallback user-facing copy in code to hide incomplete model output.
-- AI output schemas should be impossible to instantiate incorrectly.
-  - Do not require the model to keep separate structures in sync. For example, instead of generating two lists which must be the same length, generate one list of a model containing the same data.
-  - Prefer Python to derive deterministic follow-up structure from a valid AI result.
-- Use `NativeOutput(...)` for structured model outputs.
-- Use `ToolOutput(...)` when the model should select and call delegate functions.
-
-#### Python Testing
-- Test contracts directly.
-- Test agents directly where behaviour matters.
-- Test API routes as thin integration points.
-- Prefer dependency overrides or startup-state seams to monkeypatching random globals.
-
-### Frontend Development
-- **Frontend dev server**: `task frontend:dev` — requires backend on localhost:8080
-- **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
-- **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
-- **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
-- **Package Installation**: `task frontend:install`
-- **Deployment Options**:
-  - **Desktop App**: `task desktop:build`
-  - **Web Server**: `task frontend:build` then serve dist/ folder
-  - **Development**: `task desktop:dev` for desktop dev mode
-
-#### Environment Variables
-- All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/.env` — core and shared vars (base, loaded in every mode)
-  - `frontend/.env.proprietary` — proprietary-only vars, e.g. the admin portal's SaaS/account-link keys (layered on top of `.env` in proprietary mode)
-  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
-- These files are committed to Git and must not contain private keys
-- Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
-- Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
-- `task frontend:prepare` creates empty `.local` override files on first run; pass `MODE=saas` or `MODE=desktop` to also create the mode-specific `.local` file
-- Prepare runs automatically as a dependency of all `dev*`, `build*`, and `desktop*` tasks
-- See `frontend/README.md#environment-variables` for full documentation
-
-#### Import Paths - CRITICAL
-**ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
-
-For a broader explanation of the frontend layering and override architecture, read @frontend/DeveloperGuide.md
-
-Before touching colours or theming (tokens, dark mode, accent colours), read @frontend/src/editor/core/theme/README.md — it explains the palette/`--c-*` token system and the rule that literal colours live only in `primitives.css`.
-
-```typescript
-// ✅ CORRECT - Use @app/* for all imports
-import { AppLayout } from "@app/components/AppLayout";
-import { useFileContext } from "@app/contexts/FileContext";
-import { FileContext } from "@app/contexts/FileContext";
-
-// ❌ WRONG - Do not use @core/* or @proprietary/* in normal code
-import { AppLayout } from "@core/components/AppLayout";
-import { useFileContext } from "@proprietary/contexts/FileContext";
-```
-
-**Only use explicit aliases when:**
-- Building layer-specific override that wraps a lower layer's component
-- Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
-
-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/saas/desktop/cloud) and handles the fallback cascade — see "Frontend `cloud/` Layer" below for the full per-flavor order.
-
-#### Frontend `cloud/` Layer
-
-`@app/*` resolves through a per-flavor cascade — first existing file wins (shadow/override):
-
-- **core** → core
-- **proprietary** → proprietary → core
-- **saas** → saas → cloud → proprietary → core
-- **desktop** → desktop → cloud → proprietary → core
-- **cloud** → cloud → proprietary → core
-
-What goes where:
-
-- **core** — OSS base.
-- **proprietary** — licensed / offline features.
-- **cloud** — the SHARED hosted/SaaS experience used by BOTH saas + desktop: PAYG, wallet, plan, billing, usage meters, cloud config/team/onboarding.
-- **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
-- **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.
-
-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
-
-Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).
-
-**Cloud feature flags on desktop.** The local `AppConfigContext` reads `/api/v1/config/app-config` from the LOCAL bundled backend, so cloud-only flags (`aiEngineEnabled`, `premiumEnabled`, …) are never seen on desktop. To read the cloud's view, use `useSaasAppConfig()` (`desktop/hooks/useSaasAppConfig.ts`, backed by the general `saasAppConfigService` — SaaS-mode-only, public endpoint, native HTTP, 5-min cache). It returns `null` outside SaaS mode, so cloud features stay off in local/self-hosted and the server keeps the on/off switch (no desktop release needed to flip a flag). Gate a feature behind a per-platform seam — e.g. `useAiEngineEnabled()` (core reads `useAppConfig()`, desktop reads `useSaasAppConfig()`) — rather than hardcoding the flag on.
-
-#### Component Override Pattern (Stub/Shadow)
-Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
-
-**How it works:**
-1. Core defines stub component (returns null or no-op)
-2. Desktop/proprietary overrides with same path/name
-3. Core imports via `@app/*` - higher layer "shadows" core in those builds
-4. No `@ts-ignore`, no `isTauri()` checks, no runtime conditionals!
-
-**Example - Desktop-specific footer:**
-
-```typescript
-// core/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (stub)
-interface WorkbenchBarFooterExtensionsProps {
-  className?: string;
-}
-
-export function WorkbenchBarFooterExtensions(_props: WorkbenchBarFooterExtensionsProps) {
-  return null; // Stub - does nothing in web builds
-}
-```
-
-```tsx
-// desktop/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (real implementation)
-import { Box } from '@mantine/core';
-import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
-
-interface WorkbenchBarFooterExtensionsProps {
-  className?: string;
-}
-
-export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterExtensionsProps) {
-  return (
-    <Box className={className}>
-      <BackendHealthIndicator />
-    </Box>
-  );
-}
-```
-
-```tsx
-// core/components/shared/WorkbenchBar.tsx (usage - works in ALL builds)
-import { WorkbenchBarFooterExtensions } from '@app/components/workbenchBar/WorkbenchBarFooterExtensions';
-
-export function WorkbenchBar() {
-  return (
-    <div>
-      {/* In web builds: renders nothing (stub returns null) */}
-      {/* In desktop builds: renders BackendHealthIndicator */}
-      <WorkbenchBarFooterExtensions className="workbench-bar-footer" />
-    </div>
-  );
-}
-```
-
-**Build resolution:**
-- **Core build**: `@app/*` → `core/*` → Gets stub (returns null)
-- **Desktop build**: `@app/*` → `desktop/*` → Gets real implementation (shadows core)
-
-**Benefits:**
-- No runtime checks or feature flags
-- Type-safe across all builds
-- Clean, readable code
-- Build-time optimization (dead code elimination)
-
-#### Multi-Tool Workflow Architecture
-Frontend designed for **stateful document processing**:
-- Users upload PDFs once, then chain tools (split → merge → compress → view)
-- File state and processing results persist across tool switches
-- No file reloading between tools - performance critical for large PDFs (up to 100GB+)
-
-#### FileContext - Central State Management
-**Location**: `frontend/src/editor/core/contexts/FileContext.tsx`
-- **Active files**: Currently loaded PDFs and their variants
-- **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
-- **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
-- **IndexedDB persistence**: File storage with thumbnail caching
-- **Preview system**: Tools can preview results (e.g., Split → Viewer → back to Split) without context pollution
-
-**Critical**: All file operations go through FileContext. Don't bypass with direct file handling.
-
-#### Processing Services
-- **enhancedPDFProcessingService**: Background PDF parsing and manipulation
-- **thumbnailGenerationService**: Web Worker-based with main-thread fallback
-- **fileStorage**: IndexedDB with LRU cache management
-
-#### Memory Management Strategy
-**Why manual cleanup exists**: Large PDFs (up to 100GB+) through multiple tools accumulate:
-- PDF.js documents that need explicit .destroy() calls
-- Blob URLs from tool outputs that need revocation
-- Web Workers that need termination
-Without cleanup: browser crashes with memory leaks.
-
-#### Tool Development
-
-**Architecture**: Modular hook-based system with clear separation of concerns:
-
-- **useToolOperation** (`frontend/src/editor/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
-  - Coordinates all tool operations with consistent interface
-  - Integrates with FileContext for operation tracking
-  - Handles validation, error handling, and UI state management
-
-- **Supporting Hooks**:
-  - **useToolState**: UI state management (loading, progress, error, files)
-  - **useToolApiCalls**: HTTP requests and file processing
-  - **useToolResources**: Blob URLs, thumbnails, ZIP downloads
-
-- **Utilities**:
-  - **toolErrorHandler**: Standardized error extraction and i18n support
-  - **toolResponseProcessor**: API response handling (single/zip/custom)
-  - **toolOperationTracker**: FileContext integration utilities
-
-**Three Tool Patterns**:
-
-**Pattern 1: Single-File Tools** (Individual processing)
-- Backend processes one file per API call
-- Set `multiFileEndpoint: false`
-- Examples: Compress, Rotate
-```typescript
-return useToolOperation({
-  operationType: 'compress',
-  endpoint: '/api/v1/misc/compress-pdf',
-  buildFormData: (params, file: File) => { /* single file */ },
-  multiFileEndpoint: false,
-});
-```
-
-**Pattern 2: Multi-File Tools** (Batch processing)
-- Backend accepts `MultipartFile[]` arrays in single API call
-- Set `multiFileEndpoint: true`
-- Examples: Split, Merge, Overlay
-```typescript
-return useToolOperation({
-  operationType: 'split',
-  endpoint: '/api/v1/general/split-pages',
-  buildFormData: (params, files: File[]) => { /* all files */ },
-  multiFileEndpoint: true,
-  filePrefix: 'split_',
-});
-```
-
-**Pattern 3: Complex Tools** (Custom processing)
-- Tools with complex routing logic or non-standard processing
-- Provide `customProcessor` for full control
-- Examples: Convert, OCR
-```typescript
-return useToolOperation({
-  operationType: 'convert',
-  customProcessor: async (params, files) => { /* custom logic */ },
-});
-```
-
-**Benefits**:
-- **No Timeouts**: Operations run until completion (supports 100GB+ files)
-- **Consistent**: All tools follow same pattern and interface
-- **Maintainable**: Single responsibility hooks, easy to test and modify
-- **i18n Ready**: Built-in internationalization support
-- **Type Safe**: Full TypeScript support with generic interfaces
-- **Memory Safe**: Automatic resource cleanup and blob URL management
-
-## Architecture Overview
-
-### Project Structure
-- **Backend**: Spring Boot application
-- **Frontend**: React-based SPA in `/frontend` directory
-  - **File Storage**: IndexedDB for client-side file persistence and thumbnails
-  - **Internationalization**: JSON-based translations (converted from backend .properties)
-- **PDF Processing**: PDFBox for core PDF operations, LibreOffice for conversions, PDF.js for client-side rendering
-- **Security**: Spring Security with optional authentication (controlled by `DOCKER_ENABLE_SECURITY`)
-- **Configuration**: YAML-based configuration with environment variable overrides
-
-### Controller Architecture
-- **API Controllers** (`src/main/java/.../controller/api/`): REST endpoints for PDF operations
-  - Organized by function: converters, security, misc, pipeline
-  - Follow pattern: `@RestController` + `@RequestMapping("/api/v1/...")`
-
-### Key Components
-- **SPDFApplication.java**: Main application class with desktop UI and browser launching logic
-- **ConfigInitializer**: Handles runtime configuration and settings files
-- **Pipeline System**: Automated PDF processing workflows via `PipelineController`
-- **Security Layer**: Authentication, authorization, and user management (when enabled)
-
-### Frontend Directory Structure
-The frontend is organized with a clear separation of concerns:
-
-- **`frontend/src/editor/core/`**: Main application code (shared, production-ready components)
-  - **`core/components/`**: React components organized by feature
-    - `core/components/tools/`: Individual PDF tool implementations
-    - `core/components/viewer/`: PDF viewer components
-    - `core/components/pageEditor/`: Page manipulation UI
-    - `core/components/tooltips/`: Help tooltips for tools
-    - `core/components/shared/`: Reusable UI components
-  - **`core/contexts/`**: React Context providers
-    - `FileContext.tsx`: Central file state management
-    - `file/`: File reducer and selectors
-    - `toolWorkflow/`: Tool workflow state
-  - **`core/hooks/`**: Custom React hooks
-    - `hooks/tools/`: Tool-specific operation hooks (one directory per tool)
-    - `hooks/tools/shared/`: Shared hook utilities (useToolOperation, etc.)
-  - **`core/constants/`**: Application constants and configuration
-  - **`core/data/`**: Static data (tool taxonomy, etc.)
-  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)
-
-- **`frontend/src/editor/desktop/`**: Desktop-specific (Tauri) code
-- **`frontend/src/editor/proprietary/`**: Proprietary/licensed features
-- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
-- **`frontend/public/`**: Static assets served directly
-  - `public/locales/`: Translation JSON files
-
-### Component Architecture
-- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
-- **Internationalization**:
-  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
-  - Conversion Script: `scripts/convert_properties_to_json.py`
-
-### Configuration Modes
-- **Ultra-lite**: Basic PDF operations only
-- **Standard**: Full feature set
-- **Fat**: Pre-downloaded dependencies for air-gapped environments
-- **Security Mode**: Adds authentication, user management, and enterprise features
-
-### Testing Strategy
-- **Integration Tests**: Cucumber tests in `testing/cucumber/`
-- **Docker Testing**: `test.sh` validates all Docker variants
-- **Manual Testing**: No unit tests currently - relies on UI and API testing
-
-## Development Workflow
-
-1. **Local Development** (using Taskfile):
-   - Backend + frontend: `task dev`
-   - All services (including AI engine): `task dev:all`
-   - Or individually: `task backend:dev` (localhost:8080), `task frontend:dev` (localhost:5173), `task engine:dev` (localhost:5001)
-2. **Quality Gate**: Run `task check` before submitting PRs
-3. **Docker Testing**: Use `./test.sh` for full Docker integration tests
-4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
-5. **Translations**:
-   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
-6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
-
-## Frontend Architecture Status
-
-- **Core Status**: React SPA architecture complete with multi-tool workflow support
-- **State Management**: FileContext handles all file operations and tool navigation
-- **File Processing**: Production-ready with memory management for large PDF workflows (up to 100GB+)
-- **Tool Integration**: Modular hook architecture with `useToolOperation` orchestrator
-  - Individual hooks: `useToolState`, `useToolApiCalls`, `useToolResources`
-  - Utilities: `toolErrorHandler`, `toolResponseProcessor`, `toolOperationTracker`
-  - Pattern: Each tool creates focused operation hook, UI consumes state/actions
-- **Preview System**: Tool results can be previewed without polluting file context (Split tool example)
-- **Performance**: Web Worker thumbnails, IndexedDB persistence, background processing
-
-## Translation Rules
-
-- **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
-- Translation files are located in `frontend/public/locales/`
-- After changing any translation file, run `task pre-commit:fix`
-
-## Important Notes
-
-- **Java Version**: Requires JDK 25.
-- **Lombok**: Used extensively - ensure IDE plugin is installed
-- **File Persistence**:
-  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
-  - **Frontend**: Uses IndexedDB for client-side file storage and caching (with thumbnails)
-- **Security**: When `DOCKER_ENABLE_SECURITY=false`, security-related classes are excluded from compilation
-- **Import Paths**: ALWAYS use `@app/*` for imports - never use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer
-- **FileContext**: All file operations MUST go through FileContext - never bypass with direct File handling
-- **Memory Management**: Manual cleanup required for PDF.js documents and blob URLs - don't remove cleanup code
-- **Tool Development**: New tools should follow `useToolOperation` hook pattern (see `useCompressOperation.ts`)
-- **Performance Target**: Must handle PDFs up to 100GB+ without browser crashes
-- **Preview System**: Tools can preview results without polluting main file context (see Split tool implementation)
-- **Adding Tools**: See `ADDING_TOOLS.md` for complete guide to creating new PDF tools
-
-## Communication Style
-- Be direct and to the point
-- No apologies or conversational filler
-- Answer questions directly without preamble
-- Explain reasoning concisely when asked
-- Avoid unnecessary elaboration
-
-## Decision Making
-- Ask clarifying questions before making assumptions
-- Stop and ask when uncertain about project-specific details
-- Confirm approach before making structural changes
-- Request guidance on preferences (cross-platform vs specific tools, etc.)
-- Verify understanding of requirements before proceeding
-
-
-## Stack reality check (don't trust LLM training data) <!-- bleeding-edge-stack-note -->
-
-This codebase is on bleeding-edge versions of its core JVM stack: **Spring Boot 4.0.6**,
-**Jackson 3 (`tools.jackson`)**, **JDK 21/25 source/target with JDK 25 toolchain**.
-All three are *post*-2024 releases and your training corpus is overwhelmingly Spring Boot 2/3 and
-Jackson 2 patterns — those patterns will compile, run differently, or hallucinate APIs that no
-longer exist.
-
-Before writing or editing Spring / Jackson / JDK code:
-
-1. Open an existing module in `app/core/` or `app/common/` and grep for the actual imports being
-   used — `import tools.jackson...` not `import com.fasterxml.jackson...`, and the new
-   `org.springframework.boot` 4.x package layout.
-2. If you're not sure whether an API exists in this stack version, **check the source on disk
-   first** (the dependency JARs are downloaded under `~/.gradle/caches/modules-2/`).
-3. Do not silently downgrade a Spring Boot 4 pattern to a Spring Boot 3 equivalent. If something
-   doesn't work, surface it to the human — don't guess.
-
-Same goes for Jackson 3's API surface (renamed `ObjectMapper` builder methods, new
-`tools.jackson.databind` namespace) and JDK 25 preview features. Ground your code in this repo's
-actual imports, not what worked three years ago.

AI-Document-Generator-main/.gitignore

@@ -0,0 +1,45 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+env/
+venv/
+ENV/
+build/
+dist/
+*.egg-info/
+
+# Node
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+dist/
+.vite/
+
+# Environment
+.env
+.env.local
+
+# LaTeX outputs
+*.aux
+*.log
+*.out
+*.toc
+*.pdf
+*.tex
+backend/output/
+backend/data/user_styles.json
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db

AI-Document-Generator-main/Dockerfile

@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1.5
+FROM python:3.11-slim
+
+# Install full TeXLive so LLM outputs (siunitx, paracol, tikz, etc.) compile reliably.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+      texlive-full \
+      latexmk \
+      ghostscript \
+      poppler-utils \
+      ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Set working directory
+WORKDIR /app
+
+# Copy backend files
+COPY backend/requirements.txt .
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install -r requirements.txt
+
+COPY backend/ .
+
+# Create output directories
+RUN mkdir -p /app/output /app/data
+
+# Expose port
+EXPOSE 5000
+
+# Run the Flask app
+CMD ["python", "app.py"]

AI-Document-Generator-main/README.md

@@ -0,0 +1,173 @@
+# LaTeX PDF Generator
+
+AI-powered document generator using LaTeX. Creates professional documents (invoices, resumes, contracts, etc.) from natural language prompts with conversational editing.
+
+## Features
+
+- 🎨 ChatGPT-like interface with split-screen PDF preview (main window only)
+- 📝 Generates LaTeX documents from natural language and compiles to PDF in Docker
+- 🔄 Conversational editing with PDF regeneration on every turn
+- 💾 Style memory + template reuse per user/team and document type
+- 🗂️ Version history with per-iteration PDFs you can reopen
+- 📄 Supports: Invoices, Resumes, Contracts, Letters, Reports, poems, proposals, and more
+
+## Quick Start
+
+### Option 1: Docker (Recommended)
+
+```bash
+# Build the Docker image
+docker build -t latex-generator .
+
+# Run the backend
+docker run -p 5000:5000 latex-generator
+```
+
+### Option 2: Local Development
+
+#### Backend Setup
+
+```bash
+cd backend
+
+# Install Python dependencies
+pip install -r requirements.txt
+
+# Install LaTeX (if not already installed)
+# On Ubuntu/Debian:
+sudo apt-get install texlive-latex-base texlive-latex-extra
+
+# On Mac:
+brew install --cask mactex
+
+# On Windows:
+# Download and install MiKTeX from https://miktex.org/download
+
+# Run the backend
+python app.py
+```
+
+Backend will run on `http://localhost:5000`
+
+#### Frontend Setup
+
+```bash
+cd frontend
+
+# Install dependencies
+npm install
+
+# Run the dev server
+npm run dev
+```
+
+Frontend will run on `http://localhost:3000`
+
+## Usage
+
+1. Open `http://localhost:3000` in your browser
+2. Type a prompt like "Create an invoice for web development services"
+3. The AI generates LaTeX code and compiles it to PDF
+4. Continue chatting to refine the document
+5. Download the final PDF
+
+## Example Prompts
+
+- "Create a professional invoice for $1,500 in consulting services"
+- "Generate a resume for a senior software engineer with 5 years experience"
+- "Make a business letter to a client about project completion"
+- "Create a contract for freelance web development"
+
+## Configuration
+
+### OpenAI API (Optional)
+
+To use real AI generation instead of mock templates:
+
+1. Copy `.env.example` to `.env`
+2. Add your OpenAI API key: `OPENAI_API_KEY=sk-...`
+3. (Optional) Choose models:
+   - Smart (full generation): `SMART_MODEL=gpt-5.1` (default)
+   - Fast (intent/pre checks): `FAST_MODEL=gpt-4.1-nano` (default)
+3. (Legacy SDK) We pin `openai==0.28.1` in Docker to avoid client init issues. No code changes needed.
+
+## Project Structure
+
+```
+latex-pdf-generator/
+├── frontend/          # React + TypeScript + Tailwind
+│   ├── src/
+│   │   ├── components/
+│   │   │   ├── landing/         # Landing hero + CTA
+│   │   │   ├── modals/          # Reusable modal(s)
+│   │   │   ├── workspace/       # Chat panel, preview, history
+│   │   │   └── ui/              # Buttons, button groups, etc.
+│   │   ├── hooks/               # Workflow + speech capture hooks
+│   │   ├── types/               # Shared TypeScript interfaces
+│   │   ├── App.tsx              # Thin orchestrator
+│   │   └── main.tsx
+│   ├── .eslintrc.cjs            # ESLint config (React + TS)
+│   ├── package.json
+│   └── vite.config.ts
+├── backend/           # Flask + LaTeX
+│   ├── app.py                   # Routes + Flask app factory
+│   ├── ai_generation.py         # OpenAI + mock generation helpers
+│   ├── briefs.py                # Guided brief collection utilities
+│   ├── config.py                # Logging + environment setup
+│   ├── document_types.py        # Doc-type heuristics
+│   ├── latex_utils.py           # LaTeX sanitizers + layout helpers
+│   ├── pdf_utils.py             # PDF compilation + render helpers
+│   ├── storage.py               # JSON persistence for users/templates
+│   ├── styles.py                # Style preference heuristics
+│   ├── vision.py                # Layout extraction via multimodal GPT
+│   ├── requirements.txt
+│   └── data/          # User style storage
+├── Dockerfile
+└── README.md
+```
+
+### Linting
+
+The frontend now ships with ESLint + TypeScript rules that keep the new modular structure tidy:
+
+```bash
+cd frontend
+npm run lint
+```
+
+Backend linting can be added with your preferred tool (e.g., ruff or flake8) by pointing it at the new small modules in `backend/`.
+
+## Troubleshooting
+
+### LaTeX compilation fails
+
+- Ensure `pdflatex` is in your PATH
+- Check logs in the backend console
+- Verify LaTeX packages are installed
+
+### CORS errors
+
+- Make sure both frontend and backend are running
+- Frontend proxy is configured in `vite.config.ts`
+
+### PDF not displaying
+
+- Check browser console for errors
+- Ensure the backend `/output` endpoint is accessible
+- Try opening the PDF URL directly
+
+## Development
+
+### Mock Mode (Current)
+
+The app currently uses mock LaTeX templates for quick testing. To enable real AI:
+
+1. Get an OpenAI API key
+2. Set `OPENAI_API_KEY` and optionally override:
+   - `SMART_MODEL` (default `gpt-5.1`)
+   - `FAST_MODEL` (default `gpt-4.1-nano`)
+3. Restart the backend; it auto-detects whether to call the live model or the bundled mock templates
+
+## License
+
+MIT

AI-Document-Generator-main/backend/ai_generation.py

@@ -0,0 +1,659 @@
+from __future__ import annotations
+
+import json
+import re
+from typing import Any, Dict, List, Optional
+import time
+
+from config import CLIENT_MODE, SMART_MODEL, STREAMING_ENABLED, get_chat_model, logger
+from langchain_utils import to_lc_messages
+from storage import save_user_style
+from prompts import latex_system_prompt, latex_context_messages
+
+
+def generate_outline_with_llm(
+    prompt: str,
+    document_type: str,
+    constraints: Optional[Dict[str, Any]] = None,
+) -> str:
+    if CLIENT_MODE == "langchain":
+        constraint_text = ""
+        if constraints:
+            tone = constraints.get("tone")
+            audience = constraints.get("audience")
+            pages = constraints.get("pageCount")
+            constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
+        system_prompt = (
+            "You are an outline generator for document creation.\n"
+            f"Document type: {document_type}\n"
+            f"{constraint_text}\n"
+            "Return a concise outline with section titles and short descriptions.\n"
+            "Keep each description to roughly 6-12 words.\n"
+            "Ensure the outline scope fits the target page count.\n"
+            "Output plain text only, using a numbered list with 5-9 sections."
+        )
+        messages: List[Dict[str, Any]] = [
+            {"role": "system", "content": system_prompt},
+            {"role": "user", "content": prompt},
+        ]
+        try:
+            llm = get_chat_model(SMART_MODEL)
+            if llm:
+                start = time.perf_counter()
+                response = llm.invoke(to_lc_messages(messages))
+                elapsed = time.perf_counter() - start
+                content = response.content or ""
+                usage = getattr(response, "usage_metadata", None)
+                logger.info(
+                    "[AI] outline model=%s elapsed=%.2fs chars=%s usage=%s",
+                    SMART_MODEL,
+                    elapsed,
+                    len(str(content)),
+                    usage,
+                )
+                if content:
+                    return str(content).strip()
+        except Exception as exc:
+            logger.error("[AI] Outline generation failed, falling back: %s", exc)
+
+    safe_prompt = prompt.strip() or "Document"
+    return (
+        "1) Introduction - Summary of the document goals.\n"
+        "2) Background - Context and key assumptions.\n"
+        "3) Main Content - Core points and supporting details.\n"
+        "4) Evidence - Data, examples, or references.\n"
+        "5) Conclusion - Wrap-up and next steps.\n"
+        f"Notes: Tailor details to '{safe_prompt}'."
+    )
+
+
+def _parse_outline_to_sections(outline_text: str) -> List[Dict[str, str]]:
+    lines = [
+        line.strip()
+        for line in outline_text.split("\n")
+        if line.strip() and not re.match(r"^(section|details)$", line.strip(), re.IGNORECASE)
+    ]
+    sections: List[Dict[str, str]] = []
+    i = 0
+    while i < len(lines):
+        cleaned = re.sub(r"^\d+[\).\s-]+", "", lines[i]).strip()
+        if not cleaned:
+            i += 1
+            continue
+
+        split = re.split(r"[-–:]+", cleaned, maxsplit=1)
+        if len(split) > 1:
+            sections.append({"label": split[0].strip() or "Section", "value": split[1].strip()})
+            i += 1
+            continue
+
+        next_line = lines[i + 1].strip() if i + 1 < len(lines) else ""
+        if next_line and not re.match(r"^\d+[\).\s-]+", next_line):
+            sections.append({"label": cleaned, "value": next_line})
+            i += 2
+            continue
+
+        sections.append({"label": cleaned, "value": ""})
+        i += 1
+
+    return sections
+
+
+def _extract_fields_from_prompt(prompt: str, fields: List[Dict[str, Any]]) -> List[Dict[str, str]]:
+    lines = [line.strip() for line in prompt.split("\n") if line.strip()]
+    kv_pairs: Dict[str, str] = {}
+    for line in lines:
+        match = re.match(r"^([^:]{2,40}):\s*(.+)$", line)
+        if match:
+            kv_pairs[match.group(1).strip().lower()] = match.group(2).strip()
+
+    email_match = re.search(r"[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}", prompt, re.IGNORECASE)
+    phone_match = re.search(r"(\+?\d[\d\s().-]{7,})", prompt)
+    date_match = re.search(r"\b\d{1,2}[\/.-]\d{1,2}[\/.-]\d{2,4}\b", prompt)
+    money_match = re.search(r"\$\s?\d[\d,]*(?:\.\d{2})?", prompt)
+
+    filled: List[Dict[str, str]] = []
+    for field in fields:
+        label = str(field.get("label", "Field"))
+        value = str(field.get("value", "") or "")
+        if value.strip():
+            filled.append({"label": label, "value": value})
+            continue
+        label_lower = label.lower()
+        for key, val in kv_pairs.items():
+            if key in label_lower:
+                value = val
+                break
+        if not value and email_match and "email" in label_lower:
+            value = email_match.group(0)
+        if not value and phone_match and "phone" in label_lower:
+            value = phone_match.group(0)
+        if not value and date_match and ("date" in label_lower or "due" in label_lower):
+            value = date_match.group(0)
+        if not value and money_match and ("total" in label_lower or "amount" in label_lower):
+            value = money_match.group(0)
+        filled.append({"label": label, "value": value})
+    return filled
+
+
+def generate_field_values(
+    prompt: str,
+    document_type: str,
+    fields: List[Dict[str, Any]],
+    constraints: Optional[Dict[str, Any]] = None,
+) -> List[Dict[str, str]]:
+    if CLIENT_MODE == "langchain":
+        constraint_text = ""
+        if constraints:
+            tone = constraints.get("tone")
+            audience = constraints.get("audience")
+            pages = constraints.get("pageCount")
+            constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
+        system_prompt = (
+            "You are extracting field values from a user prompt.\n"
+            "Return a JSON array of objects with keys: label, value.\n"
+            "Only fill values that are explicitly stated or strongly implied.\n"
+            "If unknown, return an empty string.\n"
+            f"{constraint_text}\n"
+            "Output JSON only."
+        )
+        messages: List[Dict[str, Any]] = [
+            {"role": "system", "content": system_prompt},
+            {"role": "user", "content": f"Document type: {document_type}"},
+            {"role": "user", "content": f"Prompt:\n{prompt}"},
+            {"role": "user", "content": f"Fields:\n{json.dumps(fields, ensure_ascii=True)}"},
+        ]
+        try:
+            llm = get_chat_model(SMART_MODEL)
+            if llm:
+                start = time.perf_counter()
+                response = llm.invoke(to_lc_messages(messages))
+                elapsed = time.perf_counter() - start
+                content = response.content or ""
+                usage = getattr(response, "usage_metadata", None)
+                logger.info(
+                    "[AI] field-extract model=%s elapsed=%.2fs chars=%s usage=%s",
+                    SMART_MODEL,
+                    elapsed,
+                    len(str(content)),
+                    usage,
+                )
+                if content:
+                    parsed = _extract_json_array(str(content))
+                    if parsed:
+                        return [
+                            {
+                                "label": str(item.get("label", "Field")),
+                                "value": str(item.get("value", "")),
+                            }
+                            for item in parsed
+                            if isinstance(item, dict)
+                        ]
+        except Exception as exc:
+            logger.error("[AI] Field extraction failed, falling back: %s", exc)
+
+    return _extract_fields_from_prompt(prompt, fields)
+
+def _extract_json_array(payload: str) -> Optional[List[Dict[str, Any]]]:
+    try:
+        return json.loads(payload)
+    except json.JSONDecodeError:
+        match = re.search(r"\[[\s\S]*\]", payload)
+        if not match:
+            return None
+        try:
+            return json.loads(match.group(0))
+        except json.JSONDecodeError:
+            return None
+
+
+def generate_section_draft(
+    prompt: str,
+    document_type: str,
+    outline_text: str,
+    constraints: Optional[Dict[str, Any]] = None,
+) -> List[Dict[str, str]]:
+    if CLIENT_MODE == "langchain":
+        constraint_text = ""
+        if constraints:
+            tone = constraints.get("tone")
+            audience = constraints.get("audience")
+            pages = constraints.get("pageCount")
+            constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
+        system_prompt = (
+            "You are generating section content for a document.\n"
+            "Return a JSON array of objects with keys: label, value.\n"
+            "Use the provided outline sections as labels; values should be polished draft text.\n"
+            f"{constraint_text}\n"
+            "Keep the total length appropriate to the target pages.\n"
+            "Output JSON only."
+        )
+        messages: List[Dict[str, Any]] = [
+            {"role": "system", "content": system_prompt},
+            {"role": "user", "content": f"Document type: {document_type}"},
+            {"role": "user", "content": f"Outline:\n{outline_text}"},
+            {"role": "user", "content": f"Prompt:\n{prompt}"},
+        ]
+        try:
+            llm = get_chat_model(SMART_MODEL)
+            if llm:
+                start = time.perf_counter()
+                response = llm.invoke(to_lc_messages(messages))
+                elapsed = time.perf_counter() - start
+                content = response.content or ""
+                usage = getattr(response, "usage_metadata", None)
+                logger.info(
+                    "[AI] section-draft model=%s elapsed=%.2fs chars=%s usage=%s",
+                    SMART_MODEL,
+                    elapsed,
+                    len(str(content)),
+                    usage,
+                )
+                if content:
+                    parsed = _extract_json_array(str(content))
+                    if parsed:
+                        return [
+                            {
+                                "label": str(item.get("label", "Section")),
+                                "value": str(item.get("value", "")),
+                            }
+                            for item in parsed
+                            if isinstance(item, dict)
+                        ]
+        except Exception as exc:
+            logger.error("[AI] Section draft generation failed, falling back: %s", exc)
+
+    if outline_text.strip():
+        return _parse_outline_to_sections(outline_text)
+
+    fallback_label = "Main Content"
+    return [{"label": fallback_label, "value": prompt.strip() or "Draft content"}]
+
+
+def _fallback_template_fill(template_latex: str, outline_text: str, draft_text: Optional[str] = None) -> str:
+    default_text = draft_text or outline_text or "Details pending."
+    replacements = {
+        "TITLE": "Project Overview",
+        "SUBTITLE": "Executive Summary",
+        "AUTHOR": "Jane Doe",
+        "AUTHOR_LIST": "Jane Doe, John Smith",
+        "AFFILIATIONS": "John Smith Consulting",
+        "ABSTRACT": default_text,
+        "KEYWORDS": "keyword1, keyword2, keyword3",
+        "INTRODUCTION": default_text,
+        "RELATED_WORK": default_text,
+        "METHODOLOGY": default_text,
+        "RESULTS": default_text,
+        "DISCUSSION": default_text,
+        "CONCLUSION": default_text,
+        "REFERENCES": default_text,
+        "MAIN_TEXT": default_text,
+        "FIGURES_TABLES": default_text,
+        "REPORT_TITLE": "Business Report",
+        "DATE": "2025-01-01",
+        "EXEC_SUMMARY": default_text,
+        "BACKGROUND": default_text,
+        "FINDINGS": default_text,
+        "RECOMMENDATIONS": default_text,
+        "APPENDIX": default_text,
+        "NEWSLETTER_TITLE": "Doe Consulting Monthly",
+        "TOP_STORY": default_text,
+        "UPDATES": default_text,
+        "SPOTLIGHT": default_text,
+        "FOOTER": "Contact: info@example.com",
+        "RECIPE_TITLE": "Recipe Title",
+        "SERVINGS": "Serves 4",
+        "TIME": "30 minutes",
+        "INGREDIENTS": "\\\\begin{itemize}\\\\item Ingredient A\\\\item Ingredient B\\\\end{itemize}",
+        "INSTRUCTIONS": default_text,
+        "NOTES": "Notes and tips.",
+        "BUSINESS_NAME": "John Smith Consulting",
+        "BUSINESS_ADDRESS": "123 Example Street, Example City",
+        "BUSINESS_CONTACT": "billing@example.com | (555) 000-0000",
+        "INVOICE_NUMBER": "INV-1001",
+        "ISSUE_DATE": "2025-01-01",
+        "DUE_DATE": "2025-01-15",
+        "CLIENT_NAME": "Doe Corporation",
+        "CLIENT_ADDRESS": "456 Sample Avenue, Example City",
+        "CLIENT_CONTACT": "ap@example.com",
+        "LINE_ITEMS": "Service & 1 & $1000 & $1000 \\\\\\\\",
+        "SUBTOTAL": "$1000",
+        "TAXES": "$0",
+        "TOTAL": "$1000",
+        "PAYMENT_TERMS": "Net 15",
+        "PAYMENT_METHODS": "Bank transfer, credit card",
+        "STUDENT_NAME": "Jane Doe",
+        "COURSE_NAME": "Business Communications",
+        "INSTRUCTOR_NAME": "Dr. Rivera",
+        "ASSIGNMENT_TITLE": "Market Analysis",
+        "PROMPT": default_text,
+        "RESPONSE": default_text,
+        "CHAPTER_ONE_TITLE": "Chapter One",
+        "CHAPTER_ONE": default_text,
+        "CHAPTER_TWO_TITLE": "Chapter Two",
+        "CHAPTER_TWO": default_text,
+        "PREFACE": default_text,
+        "PUBLISHER": "Doe Press",
+        "NAME": "Jane Doe",
+        "TITLE_PAGE": "Project Overview",
+        "EMAIL": "jane.doe@example.com",
+        "PHONE": "(555) 000-0000",
+        "LOCATION": "Example City, USA",
+        "SUMMARY": default_text,
+        "EXPERIENCE": default_text,
+        "EDUCATION": default_text,
+        "SKILLS": default_text,
+        "PROJECTS": default_text,
+        "SUBJECT": "Subject",
+        "BODY": default_text,
+        "RECIPIENT_NAME": "John Smith",
+        "RECIPIENT_TITLE": "Hiring Manager",
+        "RECIPIENT_COMPANY": "Doe Corporation",
+        "RECIPIENT_ADDRESS": "456 Sample Avenue, Example City",
+        "SENDER_NAME": "Jane Doe",
+        "SENDER_ADDRESS": "123 Example Street, Example City",
+        "SENDER_EMAIL": "jane.doe@example.com",
+        "MONTH_YEAR": "January 2025",
+        "THEME": "Theme",
+        "WEEK_ROWS": "1 & 2 & 3 & 4 & 5 & 6 & 7 \\\\\\\\ \\\\hline",
+        "HEADLINE": "Launch Announcement",
+        "SUBTEXT": "Introducing our latest release.",
+        "CALL_TO_ACTION": "Visit example.com to learn more.",
+        "CONTACT": "contact@example.com",
+        "EXPERIMENT_TITLE": "Experiment",
+        "OBJECTIVE": default_text,
+        "MATERIALS": default_text,
+        "PROCEDURE": default_text,
+        "OBSERVATIONS": default_text,
+        "INSTITUTION": "Doe Institute",
+        "PRESENTER": "Jane Doe",
+        "AGENDA": default_text,
+        "KEY_POINTS": default_text,
+        "DATA_VISUALS": default_text,
+    }
+
+    def replace(match: re.Match[str]) -> str:
+        key = match.group(1).strip()
+        return replacements.get(key, default_text)
+
+    return re.sub(r"<<([A-Z0-9_]+)>>", replace, template_latex)
+
+
+def generate_template_fill_stream(
+    template_latex: str,
+    document_type: str,
+    outline_text: str,
+    draft_sections: Optional[List[Dict[str, str]]] = None,
+    constraints: Optional[Dict[str, Any]] = None,
+    style_profile: Optional[Dict[str, Any]] = None,
+):
+    """Fill a LaTeX template by replacing placeholders."""
+    if CLIENT_MODE == "langchain":
+        constraints_text = ""
+        if constraints:
+            tone = constraints.get("tone")
+            audience = constraints.get("audience")
+            pages = constraints.get("pageCount")
+            constraints_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
+        style_text = ""
+        if style_profile:
+            font = style_profile.get("font_preference")
+            layout = style_profile.get("layout_preference")
+            accent = style_profile.get("color_accent")
+            style_text = f"Style preferences: font={font}, layout={layout}, accent={accent}."
+        if draft_sections:
+            constraints_text = f"{constraints_text}\nUse the section content to inform placeholder values."
+        system_prompt = (
+            "You are a LaTeX template filler.\n"
+            "Return the full LaTeX document with placeholders filled.\n"
+            "Rules:\n"
+            "1) Only replace placeholders like <<PLACEHOLDER>>.\n"
+            "2) Do not change any other LaTeX layout/commands.\n"
+            "3) Output ONLY LaTeX (no markdown).\n"
+            "4) If you add color, use the accent token name 'accent'.\n"
+            f"{constraints_text}\n"
+            f"{style_text}\n"
+            "Keep the final output within the target page count.\n"
+        )
+        messages: List[Dict[str, Any]] = [
+            {"role": "system", "content": system_prompt},
+            {"role": "user", "content": f"Document type: {document_type}"},
+            {"role": "user", "content": f"Outline/context:\n{outline_text}"},
+            {"role": "user", "content": f"Template:\n{template_latex}"},
+        ]
+        if draft_sections:
+            messages.append(
+                {
+                    "role": "user",
+                    "content": f"Section content (JSON):\n{json.dumps(draft_sections, ensure_ascii=True)}",
+                }
+            )
+
+        try:
+            llm = get_chat_model(SMART_MODEL, streaming=True)
+            if llm:
+                start = time.perf_counter()
+                total_chars = 0
+                chunk_count = 0
+                first_chunk = None
+                for chunk in llm.stream(to_lc_messages(messages)):
+                    if chunk.content:
+                        if first_chunk is None:
+                            first_chunk = time.perf_counter()
+                        chunk_count += 1
+                        total_chars += len(str(chunk.content))
+                        yield chunk.content
+                elapsed = time.perf_counter() - start
+                logger.info(
+                    "[AI] template-fill-stream model=%s elapsed=%.2fs first_chunk=%.2fs chunks=%s chars=%s",
+                    SMART_MODEL,
+                    elapsed,
+                    (first_chunk - start) if first_chunk else -1.0,
+                    chunk_count,
+                    total_chars,
+                )
+                return
+        except Exception as exc:
+            logger.error("[AI] Template fill failed, falling back: %s", exc)
+
+    draft_text = None
+    if draft_sections:
+        draft_text = "\n".join(
+            f"{section.get('label', 'Section')}: {section.get('value', '')}"
+            for section in draft_sections
+        )
+    filled = _fallback_template_fill(template_latex, outline_text, draft_text)
+    chunk_size = 200
+    for i in range(0, len(filled), chunk_size):
+        yield filled[i : i + chunk_size]
+
+
+def generate_latex_with_llm(
+    prompt: str,
+    history: List[Dict[str, str]],
+    style_profile: Dict[str, Any],
+    document_type: str,
+    template_hint: Optional[str] = None,
+    current_latex: Optional[str] = None,
+    structured_brief: Optional[str] = None,
+    edit_mode: bool = False,
+) -> str:
+    """Call the LLM (when available) or fall back to deterministic templates."""
+    if CLIENT_MODE == "langchain":
+        messages: List[Dict[str, Any]] = [{"role": "system", "content": latex_system_prompt(style_profile, document_type, template_hint)}]
+        messages.extend(history)
+        messages.extend(latex_context_messages(template_hint, current_latex, structured_brief))
+        messages.append({"role": "user", "content": prompt})
+
+        try:
+            logger.info(
+                "[AI] Using live model=%s doc_type=%s template_hint=%s",
+                SMART_MODEL,
+                document_type,
+                "yes" if template_hint else "no",
+            )
+            llm = get_chat_model(SMART_MODEL)
+            if llm:
+                start = time.perf_counter()
+                response = llm.invoke(to_lc_messages(messages))
+                elapsed = time.perf_counter() - start
+                content = response.content or ""
+                usage = getattr(response, "usage_metadata", None)
+                logger.info(
+                    "[AI] latex-generate model=%s elapsed=%.2fs chars=%s usage=%s",
+                    SMART_MODEL,
+                    elapsed,
+                    len(str(content)),
+                    usage,
+                )
+                return content
+        except Exception as exc:
+            logger.error("[AI] LangChain generation failed, falling back to mock: %s", exc)
+
+    lower_prompt = prompt.lower()
+
+    if "invoice" in lower_prompt:
+        save_user_style("default_user", {"last_doc_type": "invoice"})
+        details = structured_brief or prompt or "Invoice details provided by user."
+        return r"""\documentclass{article}
+\usepackage[utf8]{inputenc}
+\usepackage{geometry}
+\geometry{a4paper, margin=1in}
+
+\begin{document}
+
+\begin{center}
+    {\LARGE \textbf{INVOICE}}\\[0.5cm]
+    \#1023\\
+    \today
+\end{center}
+
+\section*{Bill To:}
+Client Name \\
+123 Business Rd.
+
+\section*{Items}
+\begin{tabular}{lr}
+    \textbf{Service} & \textbf{Amount} \\
+    \hline
+    % Replace with your line items
+    Description & \$0.00 \\
+    Description & \$0.00 \\
+    \hline
+    \textbf{Total Due} & \textbf{\$0.00} \\
+\end{tabular}
+
+\section*{Notes}
+""" + details + r"""
+
+\end{document}"""
+
+    if "resume" in lower_prompt or "cv" in lower_prompt:
+        save_user_style("default_user", {"last_doc_type": "resume"})
+        details = structured_brief or prompt or "Resume details provided by user."
+        return r"""\documentclass{article}
+\usepackage[utf8]{inputenc}
+\usepackage{geometry}
+\geometry{a4paper, margin=0.75in}
+
+\begin{document}
+
+\section*{Details}
+""" + details + r"""
+
+\end{document}"""
+
+    base_doc = r"""\documentclass{article}
+\usepackage[utf8]{inputenc}
+\usepackage{geometry}
+\geometry{a4paper, margin=1in}
+
+\begin{document}
+
+"""
+    content = structured_brief or prompt or ""
+    base_doc += r"""\section*{Document}
+
+""" + content + r"""
+
+\end{document}"""
+
+    return base_doc
+
+
+def generate_latex_with_llm_stream(
+    prompt: str,
+    history: List[Dict[str, str]],
+    style_profile: Dict[str, Any],
+    document_type: str,
+    template_hint: Optional[str] = None,
+    current_latex: Optional[str] = None,
+    structured_brief: Optional[str] = None,
+    edit_mode: bool = False,
+):
+    """Stream LaTeX generation from LLM, yielding chunks as they arrive."""
+    if not STREAMING_ENABLED:
+        full_latex = generate_latex_with_llm(
+            prompt, history, style_profile, document_type, template_hint, current_latex, structured_brief, edit_mode=edit_mode
+        )
+        chunk_size = 100
+        for i in range(0, len(full_latex), chunk_size):
+            yield full_latex[i:i + chunk_size]
+        return
+    if CLIENT_MODE == "langchain":
+        messages: List[Dict[str, Any]] = [{"role": "system", "content": latex_system_prompt(style_profile, document_type, template_hint)}]
+        messages.extend(history)
+        messages.extend(latex_context_messages(template_hint, current_latex, structured_brief))
+        messages.append({"role": "user", "content": prompt})
+
+        try:
+            logger.info(
+                "[AI] Streaming from model=%s doc_type=%s template_hint=%s",
+                SMART_MODEL,
+                document_type,
+                "yes" if template_hint else "no",
+            )
+            llm = get_chat_model(SMART_MODEL, streaming=True)
+            if llm:
+                start = time.perf_counter()
+                total_chars = 0
+                chunk_count = 0
+                first_chunk = None
+                for chunk in llm.stream(to_lc_messages(messages)):
+                    if chunk.content:
+                        if first_chunk is None:
+                            first_chunk = time.perf_counter()
+                        chunk_count += 1
+                        total_chars += len(str(chunk.content))
+                        yield chunk.content
+                elapsed = time.perf_counter() - start
+                logger.info(
+                    "[AI] latex-stream model=%s elapsed=%.2fs first_chunk=%.2fs chunks=%s chars=%s",
+                    SMART_MODEL,
+                    elapsed,
+                    (first_chunk - start) if first_chunk else -1.0,
+                    chunk_count,
+                    total_chars,
+                )
+                return
+        except Exception as exc:
+            logger.error("[AI] LangChain streaming failed, falling back to mock: %s", exc)
+    
+    # Fallback to non-streaming for mock mode
+    full_latex = generate_latex_with_llm(
+        prompt, history, style_profile, document_type, template_hint, current_latex, structured_brief, edit_mode=edit_mode
+    )
+    # Simulate streaming by yielding chunks
+    chunk_size = 100
+    for i in range(0, len(full_latex), chunk_size):
+        yield full_latex[i:i + chunk_size]
+
+
+__all__ = [
+    "generate_outline_with_llm",
+    "generate_section_draft",
+    "generate_field_values",
+    "generate_latex_with_llm",
+    "generate_latex_with_llm_stream",
+    "generate_template_fill_stream",
+]

AI-Document-Generator-main/backend/app.py

@@ -0,0 +1,964 @@
+import os
+import mimetypes
+import subprocess
+import uuid
+from pathlib import Path
+from datetime import datetime
+from typing import Any, Dict, List, Optional, Tuple
+import re
+import time
+import threading
+import queue
+import urllib.error
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+
+from flask import Flask, jsonify, request, send_file, Response, stream_with_context
+from flask_cors import CORS
+import json
+
+from ai_generation import (
+    generate_latex_with_llm,
+    generate_latex_with_llm_stream,
+    generate_outline_with_llm,
+    generate_section_draft,
+    generate_field_values,
+    generate_template_fill_stream,
+)
+from briefs import gather_brief, _preprocess_intent
+from config import (
+    CLIENT_MODE,
+    SMART_MODEL,
+    OUTPUT_DIR,
+    ASSETS_DIR,
+    TEMPLATE_DIR,
+    JAVA_BACKEND_URL,
+    PREVIEW_MAX_INFLIGHT,
+    get_chat_model,
+    logger,
+)
+from langchain_utils import to_lc_messages
+from document_types import detect_document_type
+from latex_utils import apply_style_overrides, clean_generated_latex
+from pdf_utils import compile_latex_to_pdf, render_pdf_to_images
+from pdf_text_editor import convert_pdf_to_text_editor_document
+from storage import (
+    load_user_style,
+    load_user_templates,
+    load_versions,
+    save_user_style,
+    save_user_template,
+    save_version,
+)
+from styles import update_style_profile_from_prompt
+from vision import vision_layout_from_images
+from prompts import pdf_qa_system_prompt
+
+
+app = Flask(__name__)
+CORS(app)
+
+
+@app.before_request
+def log_job_request_sequence() -> None:
+    job_id = request.headers.get("X-Job-Id")
+    if not job_id:
+        return
+    seq = request.headers.get("X-Job-Seq", "?")
+    total = request.headers.get("X-Job-Total", "?")
+    logger.info("[HTTP] job_id=%s req=%s/%s %s %s", job_id, seq, total, request.method, request.path)
+
+
+def _json_body() -> Dict[str, Any]:
+    return request.get_json(silent=True) or {}
+
+def _require_ai_enabled() -> Optional[Any]:
+    if CLIENT_MODE != "langchain":
+        return jsonify({"error": "AI is disabled. Set OPENAI_API_KEY to enable AI features."}), 503
+    return None
+
+
+def _java_url(path: str) -> str:
+    base = JAVA_BACKEND_URL.rstrip("/")
+    if not path.startswith("/"):
+        path = "/" + path
+    return f"{base}{path}"
+
+
+def _java_request_json(method: str, path: str, payload: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+    url = _java_url(path)
+    data = None
+    headers = {"Content-Type": "application/json"}
+    if payload is not None:
+        data = json.dumps(payload).encode("utf-8")
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            body = resp.read().decode("utf-8")
+            return json.loads(body) if body else {}
+    except urllib.error.HTTPError as exc:
+        detail = exc.read().decode("utf-8") if exc.fp else ""
+        logger.error("[JAVA] %s %s failed status=%s detail=%s", method, path, exc.code, detail)
+        raise
+
+
+def _fetch_ai_session(session_id: str) -> Dict[str, Any]:
+    return _java_request_json("GET", f"/api/v1/ai/create/internal/sessions/{session_id}")
+
+
+def _update_ai_session(session_id: str, payload: Dict[str, Any]) -> None:
+    _java_request_json("POST", f"/api/v1/ai/create/internal/sessions/{session_id}/update", payload)
+
+
+def _sanitize_doc_type(value: str) -> str:
+    cleaned = re.sub(r"[^a-zA-Z0-9_]+", "", (value or "").lower())
+    return cleaned or "miscellaneous"
+
+
+def _select_template(doc_type: str, template_id: Optional[str]) -> Optional[str]:
+    safe_doc_type = _sanitize_doc_type(doc_type)
+    base_dir = Path(TEMPLATE_DIR) / safe_doc_type
+    if not base_dir.exists() or not base_dir.is_dir():
+        return None
+
+    if template_id:
+        safe_template = re.sub(r"[^a-zA-Z0-9_-]+", "", template_id)
+        if safe_template:
+            candidate = base_dir / f"{safe_template}.tex"
+            if candidate.exists():
+                return candidate.read_text(encoding="utf-8", errors="replace")
+
+    default_path = base_dir / "default.tex"
+    if default_path.exists():
+        return default_path.read_text(encoding="utf-8", errors="replace")
+
+    for tex_file in sorted(base_dir.glob("*.tex")):
+        return tex_file.read_text(encoding="utf-8", errors="replace")
+    return None
+
+
+@app.route("/api/intent/check", methods=["POST"])
+def intent_check() -> Any:
+    try:
+        data = _json_body()
+        prompt: str = data.get("prompt", "")
+        history: List[Dict[str, str]] = data.get("conversationHistory") or []
+        current_latex: Optional[str] = data.get("currentLatex")
+        current_pdf_url: Optional[str] = data.get("currentPdfUrl")
+        doc_type = detect_document_type(prompt, current_latex)
+        intent = _preprocess_intent(prompt, history, bool(current_pdf_url), current_latex)
+        intent["documentType"] = doc_type
+        intent["hasPdf"] = bool(current_pdf_url)
+        return jsonify(intent)
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[INTENT] intent_check failed: %s", exc, exc_info=True)
+        return jsonify({"wants_pdf": True, "has_enough_info": True, "allow_makeup": False, "reason": str(exc)}), 500
+
+
+@app.route("/api/pdf/answer", methods=["POST"])
+def pdf_answer() -> Any:
+    data = _json_body()
+    pdf_url = data.get("pdfUrl")
+    question = data.get("question")
+    if not pdf_url or not question:
+        return jsonify({"error": "Missing pdfUrl or question"}), 400
+
+    filename = os.path.basename(pdf_url.split("?")[0])
+    if not filename.lower().endswith(".pdf"):
+        return jsonify({"error": "Invalid pdf file"}), 400
+
+    pdf_path = os.path.join(OUTPUT_DIR, filename)
+    if not os.path.exists(pdf_path):
+        return jsonify({"error": "PDF not found"}), 404
+
+    try:
+        doc = convert_pdf_to_text_editor_document(pdf_path)
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[PDF-ANSWER] failed to parse pdf: %s", exc, exc_info=True)
+        return jsonify({"error": "Failed to read PDF content"}), 500
+
+    pages = doc.get("document", {}).get("pages", []) if doc else []
+    snippets: List[str] = []
+    for page in pages:
+        for elem in page.get("textElements", []) or []:
+            text = elem.get("text")
+            if text:
+                snippets.append(str(text))
+    if not snippets:
+        return jsonify({"error": "No readable text in PDF"}), 400
+
+    # Normalize and limit context
+    context = " ".join(snippets)
+    context = " ".join(context.split())  # normalize whitespace
+    max_context = 10000
+    if len(context) > max_context:
+        context = context[:max_context]
+
+    # Heuristic helpers
+    def _sentences(text: str) -> List[str]:
+        return [s.strip() for s in re.split(r"(?<=[.!?])\s+", text) if s.strip()]
+
+    def _heuristic_summary(text: str, limit: int = 480) -> str:
+        sentences = _sentences(text)
+        hits = [s for s in sentences if re.search(r"\b(difficult|challenge|problem|issue|hard)\b", s, re.IGNORECASE)]
+        chosen = hits[:3] if hits else sentences[:3]
+        summary = " ".join(chosen).strip()
+        return summary[:limit] + ("…" if len(summary) > limit else "")
+
+    def _heuristic_first_difficulty(text: str) -> str:
+        sentences = _sentences(text)
+        for s in sentences:
+            if re.search(r"\b(difficult|challenge|problem|issue|hard)\b", s, re.IGNORECASE):
+                return s
+        return sentences[0] if sentences else "No difficulty found in PDF text."
+
+    if CLIENT_MODE != "langchain":
+        return jsonify({"error": "PDF Q&A unavailable (no AI client configured)."}), 503
+
+    model_name = SMART_MODEL
+    system_prompt = pdf_qa_system_prompt()
+    user_prompt = f"Question: {question}\n\nPDF text:\n{context}"
+    try:
+        llm = get_chat_model(model_name, max_tokens=220)
+        if not llm:
+            return jsonify({"error": "PDF Q&A unavailable (no AI client configured)."}), 503
+        start = time.perf_counter()
+        response = llm.invoke(
+            to_lc_messages(
+                [
+                    {"role": "system", "content": system_prompt},
+                    {"role": "user", "content": user_prompt},
+                ]
+            )
+        )
+        elapsed = time.perf_counter() - start
+        content = response.content or ""
+        usage = getattr(response, "usage_metadata", None)
+        logger.info(
+            "[PDF-ANSWER] model=%s elapsed=%.2fs chars=%s usage=%s",
+            model_name,
+            elapsed,
+            len(str(content)),
+            usage,
+        )
+        answer = response.content
+        if not answer or not str(answer).strip():
+            answer = _heuristic_summary(context)
+        # If model parrots title/metadata, replace with heuristic
+        title_like = re.match(r"^why pdfs|^minimalist|^author:", answer.strip(), re.IGNORECASE) if answer else None
+        normalized_answer = re.sub(r"\s+", " ", answer or "").strip().lower()
+        normalized_context = re.sub(r"\s+", " ", context).strip().lower()
+        copied_context = bool(normalized_answer) and normalized_answer in normalized_context
+        if title_like or copied_context:
+            answer = _heuristic_summary(context)
+        return jsonify({"answer": answer, "mode": "model"})
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[PDF-ANSWER] model failed: %s", exc, exc_info=True)
+        answer = _heuristic_first_difficulty(context)
+        return jsonify({"answer": answer, "mode": "heuristic"})
+
+
+@app.route("/api/generate", methods=["POST"])
+def generate() -> Any:
+    """Generate LaTeX + PDF in a single call."""
+    data = _json_body()
+    user_id = data.get("userId", "default_user")
+    prompt: str = data.get("prompt", "")
+    history: List[Dict[str, str]] = data.get("conversationHistory") or []
+    current_latex: str | None = data.get("currentLatex")
+    skip_template = bool(data.get("skipTemplate"))
+    force_new_document: Optional[bool] = data.get("forceNewDocument")
+    edit_mode = bool(current_latex) and not bool(force_new_document)
+    latex_source = current_latex if edit_mode else None
+
+    style_profile = update_style_profile_from_prompt(user_id, prompt)
+
+    doc_type = detect_document_type(prompt, latex_source or current_latex)
+    brief = gather_brief(doc_type, prompt, history)
+    if brief.get("needsInfo"):
+        logger.info("[REQ] brief incomplete doc_type=%s missing=%s", doc_type, brief.get("missing"))
+        return jsonify(
+            {
+                "needsInfo": True,
+                "message": brief.get("message"),
+                "missing": brief.get("missing", []),
+                "collected": brief.get("collected", {}),
+                "documentType": doc_type,
+            }
+        )
+
+    templates = load_user_templates(user_id)
+    template_hint = None if (skip_template or edit_mode) else templates.get(doc_type)
+
+    logger.info(
+        "[REQ] user=%s doc_type=%s template=%s history_len=%s current_latex=%s skip_template=%s edit_mode=%s",
+        user_id,
+        doc_type,
+        "yes" if template_hint else "no",
+        len(history),
+        bool(current_latex),
+        skip_template,
+        edit_mode,
+    )
+
+    mode = "live" if CLIENT_MODE == "langchain" else "mock"
+    latex_code_raw = generate_latex_with_llm(
+        prompt,
+        history,
+        style_profile,
+        doc_type,
+        template_hint,
+        latex_source,
+        brief.get("structured_brief"),
+        edit_mode=edit_mode,
+    )
+    latex_code = apply_style_overrides(clean_generated_latex(latex_code_raw), style_profile)
+
+    doc_type = detect_document_type(prompt, latex_code)
+    save_user_style(user_id, {"last_doc_type": doc_type})
+    if not skip_template and not edit_mode:
+        save_user_template(user_id, doc_type, latex_code)
+    elif skip_template:
+        logger.info("[TEMPLATE] skip flag set; not persisting template for %s", doc_type)
+    else:
+        logger.info("[TEMPLATE] edit mode active; not updating template for %s", doc_type)
+    template_used = bool(template_hint)
+
+    job_id = str(uuid.uuid4())
+    pdf_path = compile_latex_to_pdf(latex_code, job_id)
+    if pdf_path and os.path.exists(pdf_path):
+        pdf_url = f"/output/{job_id}.pdf"
+        version_entry = {
+            "id": job_id,
+            "prompt": prompt,
+            "documentType": doc_type,
+            "pdfUrl": pdf_url,
+            "latex": latex_code,
+            "createdAt": datetime.utcnow().isoformat() + "Z",
+            "styleProfile": style_profile,
+            "templateUsed": template_used,
+            "editMode": edit_mode,
+        }
+        save_version(user_id, version_entry)
+
+        logger.info("[OK] job_id=%s doc_type=%s pdf_url=%s", job_id, doc_type, pdf_url)
+        return jsonify(
+            {
+                "latex": latex_code,
+                "pdfUrl": pdf_url,
+                "documentType": doc_type,
+                "message": f"Generated {doc_type} successfully! mode={mode}",
+                "version": version_entry,
+                "styleProfile": style_profile,
+                "mode": mode,
+                "templateUsed": template_used,
+                "editingExisting": edit_mode,
+            }
+        )
+
+    logger.error("[FAIL] job_id=%s doc_type=%s compile_failed", job_id, doc_type)
+    return jsonify(
+        {
+            "error": "LaTeX compilation failed. Check logs.",
+            "latex": latex_code,
+            "mode": mode,
+            "editingExisting": edit_mode,
+        }
+    ), 500
+
+
+@app.route("/api/generate_stream", methods=["POST"])
+def generate_stream() -> Any:
+    """Stream LaTeX generation and compile PDFs incrementally."""
+    try:
+        data = _json_body()
+        user_id = data.get("userId", "default_user")
+        prompt: str = data.get("prompt", "")
+        history: List[Dict[str, str]] = data.get("conversationHistory") or []
+        current_latex: str | None = data.get("currentLatex")
+        skip_template = bool(data.get("skipTemplate"))
+        force_new_document: Optional[bool] = data.get("forceNewDocument")
+        edit_mode = bool(current_latex) and not bool(force_new_document)
+        latex_source = current_latex if edit_mode else None
+        style_profile = update_style_profile_from_prompt(user_id, prompt)
+        doc_type = detect_document_type(prompt, latex_source or current_latex)
+        brief = gather_brief(doc_type, prompt, history, current_latex, bool(current_latex))
+        logger.info(
+            "[STREAM] brief gate doc_type=%s needsInfo=%s missing=%s allowFabrication=%s",
+            doc_type,
+            brief.get("needsInfo"),
+            brief.get("missing"),
+            brief.get("allowFabrication"),
+        )
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[STREAM] Failed to prepare generation request: %s", exc, exc_info=True)
+        return jsonify({"error": "Failed to start generation", "detail": str(exc)}), 500
+    
+    if brief.get("needsInfo"):
+        # Return a normal 200 with guidance so the assistant can ask follow-up questions
+        return jsonify(
+            {
+                "needsInfo": True,
+                "message": brief.get("message"),
+                "missing": brief.get("missing", []),
+                "collected": brief.get("collected", {}),
+                "documentType": doc_type,
+                "allowFabrication": brief.get("allowFabrication", False),
+            }
+        )
+
+    templates = load_user_templates(user_id)
+    template_hint = None if (skip_template or edit_mode) else templates.get(doc_type)
+
+    job_id = str(uuid.uuid4())
+    accumulated_latex = ""
+    last_compile_idx = 0
+    compile_interval = 250  # Compile every ~250 characters for faster previews
+    compile_time_budget = 2.0  # Or every ~2 seconds, whichever comes first
+    last_compile_time = time.perf_counter()
+    last_heartbeat_time = time.perf_counter()
+    stream_start = time.perf_counter()
+    first_chunk_time: Optional[float] = None
+    last_chunk_time: Optional[float] = None
+    total_chunk_chars = 0
+    total_chunks = 0
+
+    preview_executor = ThreadPoolExecutor(max_workers=2)
+    preview_tasks: Dict[str, Tuple[Any, int]] = {}
+    chunk_queue: "queue.Queue[Tuple[str, Optional[str]]]" = queue.Queue()
+
+    def stream_latex():
+        try:
+            for chunk in generate_latex_with_llm_stream(
+                prompt,
+                history,
+                style_profile,
+                doc_type,
+                template_hint,
+                latex_source,
+                brief.get("structured_brief"),
+                edit_mode=edit_mode,
+            ):
+                chunk_queue.put(("chunk", chunk))
+        except Exception as exc:
+            logger.error("[STREAM] LLM streaming failed: %s", exc, exc_info=True)
+            chunk_queue.put(("error", str(exc)))
+        finally:
+            chunk_queue.put(("done", None))
+
+    def submit_preview(latex: str, progress: int) -> None:
+        if len(preview_tasks) >= PREVIEW_MAX_INFLIGHT:
+            return
+        preview_job_id = f"{job_id}-preview-{progress}"
+
+        def _run_compile() -> Optional[str]:
+            return compile_latex_to_pdf(latex, preview_job_id, log_errors=False)
+
+        fut = preview_executor.submit(_run_compile)
+        preview_tasks[preview_job_id] = (fut, progress)
+
+    def drain_previews():
+        nonlocal last_compile_idx, last_compile_time
+        completed = []
+        for pid, (fut, progress) in list(preview_tasks.items()):
+            if fut.done():
+                completed.append(pid)
+                try:
+                    pdf_path = fut.result()
+                    if pdf_path and os.path.exists(pdf_path):
+                        pdf_url = f"/output/{pid}.pdf"
+                        yield f"data: {json.dumps({'type': 'pdf_update', 'pdfUrl': pdf_url, 'progress': progress})}\n\n"
+                        last_compile_idx = progress
+                        last_compile_time = time.perf_counter()
+                except Exception as e:  # noqa: BLE001
+                    logger.error("[STREAM] Preview compile failed (async): %s", e, exc_info=True)
+        for pid in completed:
+            preview_tasks.pop(pid, None)
+
+    def generate():
+        nonlocal accumulated_latex, last_compile_time, last_heartbeat_time
+        nonlocal total_chunk_chars, total_chunks, first_chunk_time, last_chunk_time
+
+        # Send initial metadata
+        yield f"data: {json.dumps({'type': 'start', 'jobId': job_id, 'documentType': doc_type, 'editingExisting': edit_mode})}\n\n"
+
+        streamer = threading.Thread(target=stream_latex, daemon=True)
+        streamer.start()
+
+        try:
+            while True:
+                try:
+                    item_type, payload = chunk_queue.get(timeout=0.5)
+                except queue.Empty:
+                    now = time.perf_counter()
+                    if now - last_heartbeat_time >= 1.0:
+                        yield f"data: {json.dumps({'type': 'heartbeat', 'ts': now})}\n\n"
+                        last_heartbeat_time = now
+                    yield from drain_previews()
+                    continue
+
+                if item_type == "chunk":
+                    chunk = payload or ""
+                    accumulated_latex += chunk
+                    total_chunks += 1
+                    total_chunk_chars += len(chunk)
+                    last_chunk_time = time.perf_counter()
+                    if first_chunk_time is None:
+                        first_chunk_time = last_chunk_time
+                    yield f"data: {json.dumps({'type': 'latex_chunk', 'chunk': chunk, 'accumulated': accumulated_latex})}\n\n"
+
+                    elapsed = time.perf_counter() - last_compile_time
+                    if (len(accumulated_latex) - last_compile_idx >= compile_interval) or elapsed >= compile_time_budget:
+                        compile_latex = accumulated_latex
+                        if "\\begin{document}" in compile_latex and "\\end{document}" not in compile_latex:
+                            if compile_latex.count("\\begin{") > compile_latex.count("\\end{"):
+                                temp_latex = compile_latex
+                                last_begin = compile_latex.rfind("\\begin{")
+                                if last_begin != -1:
+                                    env_start = last_begin + len("\\begin{")
+                                    env_end = compile_latex.find("}", env_start)
+                                    if env_end != -1:
+                                        env_name = compile_latex[env_start:env_end]
+                                        temp_latex += f"\\end{{{env_name}}}\n"
+                                temp_latex += "\\end{document}\n"
+                                compile_latex = temp_latex
+                            else:
+                                compile_latex += "\\end{document}\n"
+
+                        if "\\begin{document}" in compile_latex and "\\end{document}" in compile_latex:
+                            submit_preview(compile_latex, len(accumulated_latex))
+
+                    now = time.perf_counter()
+                    if now - last_heartbeat_time >= 1.0:
+                        yield f"data: {json.dumps({'type': 'heartbeat', 'ts': now})}\n\n"
+                        last_heartbeat_time = now
+                    yield from drain_previews()
+
+                elif item_type == "error":
+                    message = payload or "Streaming failed"
+                    yield f"data: {json.dumps({'type': 'error', 'message': message})}\n\n"
+                    break
+                elif item_type == "done":
+                    break
+
+            stream_end = time.perf_counter()
+            if first_chunk_time is None:
+                logger.info(
+                    "[STREAM] LLM finished with no chunks job_id=%s elapsed=%.2fs",
+                    job_id,
+                    stream_end - stream_start,
+                )
+            else:
+                logger.info(
+                    "[STREAM] LLM stats job_id=%s chunks=%s chars=%s first_chunk=%.2fs last_chunk=%.2fs elapsed=%.2fs",
+                    job_id,
+                    total_chunks,
+                    total_chunk_chars,
+                    first_chunk_time - stream_start,
+                    (last_chunk_time or stream_end) - stream_start,
+                    stream_end - stream_start,
+                )
+
+            # Final compilation with complete LaTeX
+            latex_code = apply_style_overrides(clean_generated_latex(accumulated_latex), style_profile)
+            final_doc_type = detect_document_type(prompt, latex_code)
+            save_user_style(user_id, {"last_doc_type": final_doc_type})
+            if not skip_template and not edit_mode:
+                save_user_template(user_id, final_doc_type, latex_code)
+            elif skip_template:
+                logger.info("[TEMPLATE] skip flag set; not persisting template for %s", final_doc_type)
+            else:
+                logger.info("[TEMPLATE] edit mode active; not updating template for %s", final_doc_type)
+            template_used = bool(template_hint)
+
+            pdf_path = compile_latex_to_pdf(latex_code, job_id)
+            if pdf_path and os.path.exists(pdf_path):
+                pdf_url = f"/output/{job_id}.pdf"
+                version_entry = {
+                    "id": job_id,
+                    "prompt": prompt,
+                    "documentType": final_doc_type,
+                    "pdfUrl": pdf_url,
+                    "latex": latex_code,
+                    "createdAt": datetime.utcnow().isoformat() + "Z",
+                    "styleProfile": style_profile,
+                    "templateUsed": template_used,
+                    "editMode": edit_mode,
+                }
+                save_version(user_id, version_entry)
+
+                yield f"data: {json.dumps({'type': 'complete', 'pdfUrl': pdf_url, 'latex': latex_code, 'version': version_entry, 'documentType': final_doc_type, 'templateUsed': template_used, 'styleProfile': style_profile, 'editingExisting': edit_mode})}\n\n"
+            else:
+                logger.error("[STREAM] Final PDF compilation failed for job_id=%s", job_id)
+                yield f"data: {json.dumps({'type': 'error', 'message': 'Final PDF compilation failed'})}\n\n"
+
+        except Exception as e:  # noqa: BLE001
+            logger.error("[STREAM] Generation error job_id=%s: %s", job_id, e, exc_info=True)
+            yield f"data: {json.dumps({'type': 'error', 'message': str(e)})}\n\n"
+        finally:
+            try:
+                preview_executor.shutdown(wait=False, cancel_futures=True)
+            except Exception:
+                pass
+
+    try:
+        return Response(
+            stream_with_context(generate()),
+            mimetype="text/event-stream",
+            headers={
+                "Cache-Control": "no-cache",
+                "X-Accel-Buffering": "no",
+            },
+        )
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[STREAM] Failed to start response: %s", exc, exc_info=True)
+        return jsonify({"error": "Unable to start streaming response", "detail": str(exc)}), 500
+
+
+@app.route("/api/create/sessions/<session_id>/stream", methods=["GET"])
+def create_stream(session_id: str) -> Any:
+    disabled = _require_ai_enabled()
+    if disabled:
+        return disabled
+    phase = (request.args.get("phase") or "outline").strip().lower()
+    try:
+        session = _fetch_ai_session(session_id)
+    except Exception:  # noqa: BLE001
+        return jsonify({"error": "Session not found"}), 404
+
+    user_id = session.get("userId", "default_user")
+    prompt = session.get("promptLatest") or session.get("promptInitial") or ""
+    doc_type = session.get("docType") or detect_document_type(prompt, None)
+    template_id = session.get("templateId")
+    outline_text = session.get("outlineText") or ""
+    constraints = session.get("outlineConstraints")
+    if isinstance(constraints, str) and constraints.strip():
+        try:
+            constraints = json.loads(constraints)
+        except json.JSONDecodeError:
+            constraints = None
+    draft_sections_raw = session.get("draftSections")
+    draft_sections = None
+    if isinstance(draft_sections_raw, list):
+        draft_sections = draft_sections_raw
+    elif isinstance(draft_sections_raw, str) and draft_sections_raw.strip():
+        try:
+            draft_sections = json.loads(draft_sections_raw)
+        except json.JSONDecodeError:
+            draft_sections = None
+    style_profile = load_user_style(user_id)
+
+    def sse(data: Dict[str, Any]) -> str:
+        return f"data: {json.dumps(data)}\n\n"
+
+    def generate():
+        yield sse({"type": "phase_changed", "phase": phase})
+
+        if phase == "outline":
+            outline = generate_outline_with_llm(prompt, doc_type, constraints)
+            _update_ai_session(
+                session_id,
+                {
+                    "outlineText": outline,
+                    "outlineConstraints": json.dumps(constraints, ensure_ascii=True) if constraints else None,
+                    "docType": doc_type,
+                    "status": "OUTLINE_PENDING",
+                },
+            )
+            yield sse({"type": "outline_ready", "outlineText": outline})
+            yield sse({"type": "phase_complete", "phase": "outline"})
+            return
+
+        if phase == "draft":
+            base_outline = outline_text or prompt
+            sections = generate_section_draft(prompt, doc_type, base_outline, constraints)
+            _update_ai_session(
+                session_id,
+                {
+                    "draftSections": json.dumps(sections, ensure_ascii=True),
+                    "outlineConstraints": json.dumps(constraints, ensure_ascii=True) if constraints else None,
+                    "docType": doc_type,
+                    "status": "DRAFT_READY",
+                },
+            )
+            yield sse({"type": "draft_sections", "sections": sections})
+            yield sse({"type": "phase_complete", "phase": "draft", "sections": sections})
+            return
+
+        if phase == "polish":
+            accumulated = ""
+            template_latex = _select_template(doc_type, template_id)
+            if template_latex:
+                for chunk in generate_template_fill_stream(
+                    template_latex,
+                    doc_type,
+                    outline_text or prompt,
+                    draft_sections=draft_sections,
+                    constraints=constraints,
+                    style_profile=style_profile,
+                ):
+                    accumulated += chunk
+                    yield sse({"type": "latex_delta", "phase": "polish", "delta": chunk})
+            else:
+                section_text = ""
+                if draft_sections:
+                    section_text = "\n".join(
+                        f"{section.get('label', 'Section')}: {section.get('value', '')}"
+                        for section in draft_sections
+                    )
+                constraint_text = ""
+                if constraints:
+                    tone = constraints.get("tone")
+                    audience = constraints.get("audience")
+                    pages = constraints.get("pageCount")
+                    constraint_text = f"Tone: {tone}. Audience: {audience}. Target pages: {pages}."
+                polish_prompt = (
+                    f"Create a polished LaTeX document for a {doc_type}.\n"
+                    "Use the provided section content and keep the substance consistent.\n"
+                    f"{constraint_text}\n"
+                    "Keep the final document within the target page count.\n"
+                )
+                for chunk in generate_latex_with_llm_stream(
+                    polish_prompt,
+                    [],
+                    style_profile,
+                    doc_type,
+                    None,
+                    None,
+                    section_text or outline_text or prompt,
+                    edit_mode=True,
+                ):
+                    accumulated += chunk
+                    yield sse({"type": "latex_delta", "phase": "polish", "delta": chunk})
+
+            accumulated = apply_style_overrides(accumulated, style_profile)
+            _update_ai_session(
+                session_id,
+                {"polishedLatex": accumulated, "docType": doc_type, "status": "POLISHED_READY"},
+            )
+
+            pdf_job_id = f"{session_id}-polished"
+            pdf_path = compile_latex_to_pdf(accumulated, pdf_job_id, log_errors=False)
+            if pdf_path and os.path.exists(pdf_path):
+                pdf_url = f"/output/{pdf_job_id}.pdf"
+                yield sse({"type": "save_complete", "docId": session_id, "pdfUrl": pdf_url})
+
+            yield sse({"type": "phase_complete", "phase": "polish", "latex": accumulated})
+            return
+
+        yield sse({"type": "error", "message": f"Unknown phase: {phase}"})
+
+    return Response(
+        stream_with_context(generate()),
+        mimetype="text/event-stream",
+        headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+    )
+
+
+@app.route("/api/create/sessions/<session_id>/fields", methods=["POST"])
+def fill_fields(session_id: str) -> Any:
+    disabled = _require_ai_enabled()
+    if disabled:
+        return disabled
+    try:
+        logger.info("[AI create] fill_fields session_id=%s", session_id)
+        session = _fetch_ai_session(session_id)
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("[AI create] fill_fields session lookup failed session_id=%s error=%s", session_id, exc)
+        return jsonify({"error": "Session not found"}), 404
+
+    data = _json_body()
+    fields = data.get("fields") or []
+    extra_prompt = data.get("extraPrompt") or ""
+    if not isinstance(fields, list):
+        return jsonify({"error": "Fields must be a list"}), 400
+
+    prompt = session.get("promptLatest") or session.get("promptInitial") or ""
+    if extra_prompt:
+        prompt = f"{prompt}\n{extra_prompt}"
+    doc_type = session.get("docType") or detect_document_type(prompt, None)
+    constraints = session.get("outlineConstraints")
+    if isinstance(constraints, str) and constraints.strip():
+        try:
+            constraints = json.loads(constraints)
+        except json.JSONDecodeError:
+            constraints = None
+
+    filled = generate_field_values(prompt, doc_type, fields, constraints)
+    return jsonify({"fields": filled})
+
+
+
+
+@app.route("/api/progressive_render", methods=["POST"])
+def progressive_render() -> Any:
+    """Compile arbitrary LaTeX (partial or masked) for progressive previews."""
+    data = _json_body()
+    latex = data.get("latex")
+    if not latex or not isinstance(latex, str):
+        return jsonify({"error": "Missing LaTeX payload"}), 400
+
+    job_id = data.get("jobId") or str(uuid.uuid4())
+    pdf_path = compile_latex_to_pdf(latex, job_id)
+    if pdf_path and os.path.exists(pdf_path):
+        return jsonify({"pdfUrl": f"/output/{job_id}.pdf"})
+
+    return jsonify({"error": "Progressive compilation failed"}), 500
+
+
+@app.route("/output/<path:filename>", methods=["GET"])
+def serve_output_file(filename: str) -> Any:
+    """Serve generated PDF files and stored assets."""
+    file_path = os.path.join(OUTPUT_DIR, filename)
+    if os.path.exists(file_path):
+        mime_type, _ = mimetypes.guess_type(file_path)
+        return send_file(file_path, mimetype=mime_type or "application/octet-stream")
+    return jsonify({"error": "File not found"}), 404
+
+
+@app.route("/api/versions/<user_id>", methods=["GET"])
+def list_versions(user_id: str) -> Any:
+    return jsonify({"versions": load_versions(user_id)})
+
+
+@app.route("/api/style/<user_id>", methods=["GET"])
+def get_style(user_id: str) -> Any:
+    return jsonify({"style": load_user_style(user_id)})
+
+
+@app.route("/api/style/<user_id>", methods=["POST"])
+def update_style(user_id: str) -> Any:
+    data = _json_body()
+    if not isinstance(data, dict):
+        return jsonify({"error": "Style payload must be an object"}), 400
+    current = load_user_style(user_id) or {}
+    merged = {**current, **data}
+    save_user_style(user_id, merged)
+    return jsonify({"style": merged})
+
+
+@app.route("/api/style/apply", methods=["POST"])
+def apply_style() -> Any:
+    data = _json_body()
+    latex = data.get("latex")
+    style = data.get("style") or {}
+    if not latex or not isinstance(latex, str):
+        return jsonify({"error": "Missing LaTeX payload"}), 400
+    if not isinstance(style, dict):
+        return jsonify({"error": "Style payload must be an object"}), 400
+    updated = apply_style_overrides(latex, style)
+    return jsonify({"latex": updated})
+
+
+@app.route("/api/import_template", methods=["POST"])
+def import_template() -> Any:
+    """Accept a PDF upload, extract layout via vision model, and save as a template."""
+    user_id = request.form.get("userId", "default_user")
+    doc_type = request.form.get("docType", "document")
+    file = request.files.get("file")
+
+    if not file:
+        return jsonify({"error": "No file uploaded"}), 400
+
+    pdf_bytes = file.read()
+    images = render_pdf_to_images(pdf_bytes, max_pages=2, dpi=170)
+    if not images:
+        return jsonify({"error": "Failed to render PDF"}), 400
+
+    layout_latex = vision_layout_from_images(images, doc_type) or ""
+    if not layout_latex:
+        layout_latex = f"""\\documentclass{{article}}
+\\usepackage[margin=1in]{{geometry}}
+\\usepackage{{tabularx}}
+\\usepackage{{multicol}}
+\\begin{{document}}
+% Fallback template for {doc_type}
+\\section*{{Title placeholder}}
+Body text goes here.
+\\end{{document}}
+"""
+
+    sanitized = clean_generated_latex(layout_latex)
+    save_user_template(user_id, doc_type, sanitized)
+    return jsonify({"message": "Template imported", "docType": doc_type, "pages": len(images)})
+
+
+@app.route("/api/assets/upload", methods=["POST"])
+def upload_asset() -> Any:
+    file = request.files.get("file")
+    if not file:
+        return jsonify({"error": "Missing file"}), 400
+
+    _, ext = os.path.splitext(file.filename or "")
+    ext = ext.lower()
+    if ext not in {".png", ".jpg", ".jpeg", ".gif"}:
+        return jsonify({"error": "Unsupported file type"}), 400
+
+    asset_id = f"{uuid.uuid4().hex}{ext}"
+    output_path = os.path.join(ASSETS_DIR, asset_id)
+    os.makedirs(ASSETS_DIR, exist_ok=True)
+    file.save(output_path)
+
+    return jsonify(
+        {
+            "assetId": asset_id,
+            "assetUrl": f"/output/assets/{asset_id}",
+            "latexPath": f"assets/{asset_id}",
+        }
+    )
+
+
+@app.route("/api/pdf-editor/document", methods=["GET"])
+def pdf_editor_document() -> Any:
+    """Expose a JSON snapshot of the PDF for rich text editing."""
+    pdf_url = request.args.get("pdfUrl")
+    if not pdf_url:
+        return jsonify({"error": "Missing pdfUrl"}), 400
+
+    filename = os.path.basename(pdf_url.split("?")[0])
+    if not filename:
+        return jsonify({"error": "Invalid pdf file"}), 400
+    if not filename.lower().endswith(".pdf"):
+        return jsonify({"error": "Invalid pdf file"}), 400
+
+    pdf_path = os.path.join(OUTPUT_DIR, filename)
+    if not os.path.exists(pdf_path):
+        return jsonify({"error": "PDF not found"}), 404
+
+    try:
+        document = convert_pdf_to_text_editor_document(pdf_path)
+        return jsonify(document)
+    except FileNotFoundError:
+        return jsonify({"error": "Conversion failed"}), 500
+    except subprocess.CalledProcessError as exc:
+        logger.error("[PDF-EDITOR] Conversion failed: %s", exc)
+        return jsonify({"error": "Conversion failed"}), 500
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[PDF-EDITOR] Unexpected conversion failure: %s", exc)
+        return jsonify({"error": "Conversion failed"}), 500
+
+
+@app.route("/api/pdf-editor/upload", methods=["POST"])
+def pdf_editor_upload() -> Any:
+    """Accept an edited PDF and save it so the preview can refresh."""
+    file = request.files.get("file")
+    if not file:
+        return jsonify({"error": "Missing file"}), 400
+
+    job_id = str(uuid.uuid4())
+    filename = f"{job_id}-edited.pdf"
+    output_path = os.path.join(OUTPUT_DIR, filename)
+    os.makedirs(OUTPUT_DIR, exist_ok=True)
+    file.save(output_path)
+
+    logger.info("[PDF-EDITOR] uploaded edited PDF job_id=%s -> %s", job_id, filename)
+    return jsonify({"pdfUrl": f"/output/{filename}"})
+
+
+@app.route("/health", methods=["GET"])
+def health() -> Any:
+    return jsonify({"status": "ok", "engine": "pdflatex"})
+
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=5000, debug=True)

AI-Document-Generator-main/backend/briefs.py

@@ -0,0 +1,525 @@
+from __future__ import annotations
+
+import re
+import json
+from typing import Any, Dict, List, Optional
+import time
+
+from config import CLIENT_MODE, FAST_MODEL, SMART_MODEL, get_chat_model, logger
+from langchain_utils import to_lc_messages
+from prompts import brief_missing_info_system_prompt
+
+
+BRIEF_SCHEMAS: Dict[str, Dict[str, Any]] = {
+    "resume": {
+        "field_order": [
+            "name",
+            "contact",
+            "location",
+            "target_role",
+            "summary",
+            "work_history",
+            "education",
+            "skills",
+            "achievements",
+            "links",
+            "constraints",
+        ],
+        "labels": {
+            "name": ["name", "full name"],
+            "contact": ["contact", "contact info", "contact information", "email/phone"],
+            "location": ["location", "city/country"],
+            "target_role": ["target role", "role", "title", "headline"],
+            "summary": ["summary", "objective", "about"],
+            "work_history": ["experience", "work history", "roles"],
+            "education": ["education", "studies"],
+            "skills": ["skills", "stack"],
+            "achievements": ["achievements", "certifications", "awards"],
+            "links": ["links", "profiles", "linkedin/github"],
+            "constraints": ["constraints", "tone/length/style"],
+        },
+        "questions": {
+            "name": "What's your name as you'd like it on the page?",
+            "contact": "How can someone reach you (email/phone)?",
+            "location": "Where are you based (or remote)?",
+            "target_role": "What role/title and industry are you aiming for?",
+            "summary": "Give me a 1–2 sentence summary about you.",
+            "work_history": "Recent roles: company, title, dates, location, and a few bullets with impact.",
+            "education": "Degree(s), school, and graduation year?",
+            "skills": "Key skills/stack (tech + relevant soft skills)?",
+            "achievements": "Awards/certifications/major achievements?",
+            "links": "Any LinkedIn/GitHub/portfolio links?",
+            "constraints": "Any tone/length constraints (ATS, one-page, etc.)?",
+        },
+        "intro": "Hey! To build a strong resume, you can paste your old resume or just dump everything you remember—name, how to reach you, where you're based, what you're aiming for, your roles, education, skills, links. Share whatever you have and I'll work with it.",
+    },
+    "invoice": {
+        "field_order": [
+            "your_business",
+            "client",
+            "issue_date",
+            "due_date",
+            "line_items",
+            "currency",
+            "payment_terms",
+            "notes",
+            "constraints",
+        ],
+        "labels": {
+            "your_business": ["your business", "seller", "from"],
+            "client": ["client", "bill to"],
+            "issue_date": ["issue date", "invoice date"],
+            "due_date": ["due date"],
+            "line_items": ["line items", "services/items"],
+            "currency": ["currency"],
+            "payment_terms": ["payment terms"],
+            "notes": ["notes"],
+            "constraints": ["constraints", "layout/style"],
+        },
+        "questions": {
+            "your_business": "Who is issuing the invoice (business name + contact)?",
+            "client": "Who is being billed (name + contact)?",
+            "issue_date": "Invoice issue date?",
+            "due_date": "Due date?",
+            "line_items": "Line items with description, qty, rate, tax (if any)?",
+            "currency": "Currency?",
+            "payment_terms": "Payment terms and payment methods?",
+            "notes": "Notes to include (late fees, thank you, PO #)?",
+            "constraints": "Branding/layout preferences?",
+        },
+        "intro": "I'll draft an accurate invoice if I know who is billing, who is paying, and the line items. Paste an old invoice or list the details.",
+    },
+}
+
+
+def classify_intent_with_llm(prompt: str, history: List[Dict[str, str]], current_latex: Optional[str], has_pdf: bool) -> Optional[Dict[str, Any]]:
+    """
+    Use a small model to classify intent instead of brittle regex.
+
+    Returns a dict like:
+    {
+      "documentType": "invoice|resume|contract|letter|report|form|document",
+      "action": "new|edit|question",
+      "allowFabrication": bool,
+      "wantsPdf": bool,
+      "hasEnoughInfo": bool,
+      "missingFields": [str],
+      "notes": str
+    }
+    """
+    if CLIENT_MODE != "langchain":
+        logger.info("[INTENT] skip llm classify: client_mode=%s", CLIENT_MODE)
+        return None
+
+    system = (
+        "You classify user requests about documents. "
+        "Output strict JSON. "
+        "documentType must be one of: academic, agenda, brochure, business_card, case_study, checklist, "
+        "contract, creative, datasheet, document, flyer, invoice, letter, manual, menu, minutes, newsletter, "
+        "one_pager, poster, presentation, press_release, proposal, recipe, report, resume, timeline, whitepaper. "
+        "action: 'new' (make/generate), 'edit' (modify existing), 'question' (asking about it). "
+        "allowFabrication: true if the user invites making up/placeholder/dummy/random details "
+        "OR asks you to use your knowledge about a fictional/real character (e.g., 'use what you know about James Bond', "
+        "'make it for agent 007', 'create resume for Sherlock Holmes', etc.). "
+        "Basically, if they're NOT providing their own personal details and expect you to fill in from common knowledge or imagination, set this to true. "
+        "wantsPdf: true if they expect/gave permission to generate a PDF. "
+        "hasEnoughInfo: true if there is enough info to proceed without asking questions (or if allowFabrication is true). "
+        "missingFields: key details still needed (e.g., for invoice: seller, client, line items; resume: name, contact, work). "
+        "notes: short free-form note."
+    )
+
+    conversation = [{"role": "system", "content": system}]
+    # Trim history to keep request small
+    trimmed_history = history[-6:] if len(history) > 6 else history
+    for msg in trimmed_history:
+        if msg.get("content") and msg.get("role") in {"user", "assistant", "system"}:
+            conversation.append({"role": msg["role"], "content": msg["content"]})
+    conversation.append({"role": "user", "content": prompt})
+
+    try:
+        llm = get_chat_model(
+            FAST_MODEL or SMART_MODEL,
+            max_tokens=800,
+            model_kwargs={"response_format": {"type": "json_object"}},
+        )
+        if not llm:
+            logger.info("[INTENT] skip llm classify: no LangChain client")
+            return None
+        start = time.perf_counter()
+        response = llm.invoke(to_lc_messages(conversation))
+        elapsed = time.perf_counter() - start
+        content = response.content or ""
+        usage = getattr(response, "usage_metadata", None)
+        logger.info(
+            "[INTENT] llm_classify model=%s elapsed=%.2fs chars=%s usage=%s",
+            FAST_MODEL or SMART_MODEL,
+            elapsed,
+            len(str(content)),
+            usage,
+        )
+        content = response.content
+        if not content:
+            logger.info("[INTENT] llm_classify empty content")
+            return None
+        data = json.loads(content)
+        # Normalize
+        doc_type = str(data.get("documentType") or "document").lower()
+        allowed_types = {
+            "academic", "agenda", "brochure", "business_card", "case_study", "checklist",
+            "contract", "creative", "datasheet", "document", "flyer", "invoice", "letter",
+            "manual", "menu", "minutes", "newsletter", "one_pager", "poster", "presentation",
+            "press_release", "proposal", "recipe", "report", "resume", "timeline", "whitepaper"
+        }
+        if doc_type not in allowed_types:
+            doc_type = "document"
+        action = str(data.get("action") or "new").lower()
+        if action not in {"new", "edit", "question"}:
+            action = "new"
+        result = {
+          "documentType": doc_type,
+          "action": action,
+          "allowFabrication": bool(data.get("allowFabrication")),
+          "wantsPdf": bool(data.get("wantsPdf", True)),
+          "hasEnoughInfo": bool(data.get("hasEnoughInfo", True)),
+          "missingFields": data.get("missingFields") or [],
+          "notes": data.get("notes") or "",
+        }
+        logger.info(
+            "[INTENT] llm_classify doc_type=%s action=%s allowFabrication=%s wantsPdf=%s hasEnoughInfo=%s missing=%s notes=%s",
+            result["documentType"],
+            result["action"],
+            result["allowFabrication"],
+            result["wantsPdf"],
+            result["hasEnoughInfo"],
+            result["missingFields"],
+            (result["notes"] or "")[:120],
+        )
+        return result
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[INTENT] LLM classify failed: %s", exc, exc_info=True)
+        return None
+
+
+def detect_fabrication_opt_in(prompt: str, history: List[Dict[str, str]]) -> bool:
+    """
+    Ask a small model to decide if the user has permitted invention of missing details.
+
+    Returns True when the user says to make things up / whatever is fine /
+    no preference, even if they haven't provided concrete fields.
+    """
+    if CLIENT_MODE != "langchain":
+        return False
+
+    system = (
+        "Decide if the user has explicitly permitted you to invent or make up missing details. "
+        "Reply with strict JSON: {\"allowFabrication\": true|false}. "
+        "Consider any user instruction like 'make it up', 'whatever you want', 'use dummy info', "
+        "'fabricate the rest', 'fill in anything' as permission. "
+        "Do not require specific keywords; infer intent from the conversation. "
+        "If unclear, set allowFabrication to false."
+    )
+
+    conversation = [{"role": "system", "content": system}]
+    trimmed_history = history[-8:] if len(history) > 8 else history
+    for msg in trimmed_history:
+        if msg.get("content") and msg.get("role") in {"user", "assistant", "system"}:
+            conversation.append({"role": msg["role"], "content": msg["content"]})
+    conversation.append({"role": "user", "content": prompt})
+
+    try:
+        llm = get_chat_model(
+            FAST_MODEL or SMART_MODEL,
+            max_tokens=100,
+            model_kwargs={"response_format": {"type": "json_object"}},
+        )
+        if not llm:
+            return False
+        start = time.perf_counter()
+        response = llm.invoke(to_lc_messages(conversation))
+        elapsed = time.perf_counter() - start
+        content = response.content or ""
+        usage = getattr(response, "usage_metadata", None)
+        logger.info(
+            "[INTENT] fabrication-check model=%s elapsed=%.2fs chars=%s usage=%s",
+            FAST_MODEL or SMART_MODEL,
+            elapsed,
+            len(str(content)),
+            usage,
+        )
+        content = response.content
+        if not content:
+            return False
+        data = json.loads(content)
+        return bool(data.get("allowFabrication"))
+    except Exception as exc:  # noqa: BLE001
+        logger.error("[INTENT] fabrication opt-in check failed: %s", exc)
+        return False
+
+
+def _preprocess_intent(
+    prompt: str,
+    history: List[Dict[str, str]],
+    has_pdf: bool,
+    current_latex: Optional[str],
+) -> Dict[str, Any]:
+    """
+    Lightweight intent classifier used by /api/intent/check.
+
+    It is intentionally heuristic-only to avoid extra model calls. The goal is to
+    decide whether we should proceed with PDF generation and whether it's OK to
+    fabricate placeholder content when the user explicitly asks for it.
+    """
+    user_texts = [entry.get("content", "") for entry in history if entry.get("role") == "user"]
+    user_texts.append(prompt or "")
+    combined_text = " ".join([t for t in user_texts if t]).strip().lower()
+
+    llm = classify_intent_with_llm(prompt, history, current_latex, has_pdf)
+    if llm:
+        return {
+            "wants_pdf": llm.get("wantsPdf", True),
+            "has_enough_info": llm.get("hasEnoughInfo", True),
+            "allow_makeup": llm.get("allowFabrication", False),
+            "document_type": llm.get("documentType"),
+            "missing_fields": llm.get("missingFields", []),
+        }
+
+    # Fallback heuristics (only if no LLM)
+    avoid_pdf = bool(re.search(r"\b(no pdf|text only|markdown only|dont (make|generate) pdf)\b", combined_text))
+    wants_pdf = not avoid_pdf or bool(current_latex) or has_pdf
+    has_meaningful_text = len(combined_text) > 20
+    return {
+        "wants_pdf": wants_pdf,
+        "has_enough_info": bool(current_latex or has_pdf or has_meaningful_text),
+        "allow_makeup": False,
+        "document_type": None,
+        "missing_fields": [],
+    }
+
+def _extract_structured_fields(text: str, schema: Dict[str, Any]) -> Dict[str, str]:
+    """Naively parse user text to pull schema fields."""
+    found: Dict[str, str] = {}
+    lower = text.lower()
+
+    if schema.get("field_order") == BRIEF_SCHEMAS["resume"]["field_order"]:
+        work_matches = re.findall(
+            r"(?:experience|work history|role|company|position)\s*[:\-]\s*(.+?)(?=\n\n|\Z)",
+            text,
+            flags=re.IGNORECASE | re.DOTALL,
+        )
+        if work_matches:
+            found["work_history"] = "\n".join(work_matches[:3])
+        education_matches = re.findall(
+            r"(?:education|degree)\s*[:\-]\s*(.+?)(?=\n\n|\Z)",
+            text,
+            flags=re.IGNORECASE | re.DOTALL,
+        )
+        if education_matches:
+            found["education"] = "\n".join(education_matches[:2])
+        skills_match = re.search(r"(?:skills|stack)\s*[:\-]\s*(.+)", text, flags=re.IGNORECASE)
+        if skills_match:
+            found["skills"] = skills_match.group(1).strip()
+
+    for field, labels in schema.get("labels", {}).items():
+        for label in labels:
+            pattern = rf"{label}\s*[:\-]\s*(.+?)(?=\n[A-Z][a-zA-Z ]+[:\-]|\Z)"
+            match = re.search(pattern, text, flags=re.IGNORECASE | re.DOTALL)
+            if match:
+                found[field] = match.group(1).strip()
+                break
+    if not found.get("summary") and len(lower) < 200:
+        found["summary"] = text.strip()
+    return {k: v for k, v in found.items() if v}
+
+
+def _format_missing_message(
+    doc_type: str,
+    schema: Dict[str, Any],
+    collected: Dict[str, str],
+    missing: List[str],
+    preface: Optional[str] = None,
+) -> str:
+    """Fallback text asking the user for missing fields."""
+    intro = schema.get("intro") or f"Need a few details to finish your {doc_type}."
+    lines = [intro]
+    if preface:
+        lines.append(preface)
+    if collected:
+        lines.append("Already have:")
+        for field, value in collected.items():
+            label = schema.get("labels", {}).get(field, [field])[0]
+            lines.append(f"- {label}: {value}")
+    if missing:
+        lines.append("Still need:")
+        questions = schema.get("questions", {})
+        for field in missing[:4]:
+            ask = questions.get(field) or f"{field}?"
+            lines.append(f"- {ask}")
+    lines.append("Partial info is fine—share whatever you remember.")
+    return "\n".join(lines)
+
+
+def _ai_missing_message(
+    doc_type: str,
+    schema: Dict[str, Any],
+    collected: Dict[str, str],
+    missing: List[str],
+) -> Optional[str]:
+    """Let the model craft clarifying questions when available."""
+    if CLIENT_MODE != "langchain" or not missing:
+        return None
+
+    collected_lines = [f"- {schema.get('labels', {}).get(field, [field])[0]}: {value}" for field, value in collected.items()]
+    missing_labels = [schema.get("labels", {}).get(field, [field])[0] for field in missing]
+    user_text = "We already have:\n" + "\n".join(collected_lines) if collected_lines else "We have nothing yet."
+    user_text += "\nNeed to ask for: " + ", ".join(missing_labels)
+    if not collected_lines:
+        user_text += "\nInvite them to paste an old resume or dump all details if they have them."
+
+    system_prompt = brief_missing_info_system_prompt(doc_type)
+    try:
+        llm = get_chat_model(SMART_MODEL, max_tokens=400)
+        if not llm:
+            return None
+        start = time.perf_counter()
+        response = llm.invoke(
+            to_lc_messages(
+                [
+                    {"role": "system", "content": system_prompt},
+                    {"role": "user", "content": user_text},
+                ]
+            )
+        )
+        elapsed = time.perf_counter() - start
+        content = response.content or ""
+        usage = getattr(response, "usage_metadata", None)
+        logger.info(
+            "[AI] missing-questions model=%s elapsed=%.2fs chars=%s usage=%s",
+            SMART_MODEL,
+            elapsed,
+            len(str(content)),
+            usage,
+        )
+        return response.content
+    except Exception as exc:
+        logger.error("[AI] missing-questions failed: %s", exc)
+        return None
+
+
+def gather_brief(doc_type: str, prompt: str, history: List[Dict[str, str]], current_latex: Optional[str] = None, has_pdf: bool = False) -> Dict[str, Any]:
+    """
+    Determine whether we have enough structured details to generate without fabricating.
+    Returns needsInfo + a formatted message when details are missing, or a structured brief.
+    """
+    classifier = classify_intent_with_llm(prompt, history, current_latex, has_pdf)
+    if classifier:
+        doc_type = classifier.get("documentType", doc_type)
+        logger.info(
+            "[BRIEF] using llm doc_type=%s allowFabrication=%s missing=%s hasEnoughInfo=%s wantsPdf=%s",
+            doc_type,
+            classifier.get("allowFabrication"),
+            classifier.get("missingFields"),
+            classifier.get("hasEnoughInfo"),
+            classifier.get("wantsPdf"),
+        )
+    else:
+        logger.info("[BRIEF] llm classifier unavailable, using fallback schema doc_type=%s", doc_type)
+
+    schema = BRIEF_SCHEMAS.get(doc_type)
+    if not schema:
+        return {"needsInfo": False, "structured_brief": None, "collected": {}, "missing": []}
+
+    user_texts = [entry.get("content", "") for entry in history if entry.get("role") == "user"]
+    user_texts.append(prompt or "")
+    combined_text = "\n".join(user_texts)
+    collected = _extract_structured_fields(combined_text, schema)
+    missing = [field for field in schema.get("field_order", []) if field not in collected]
+    classifier_has_enough = bool(classifier.get("hasEnoughInfo")) if classifier else True
+    allow_makeup = bool(classifier.get("allowFabrication")) if classifier else False
+    if not allow_makeup:
+        allow_makeup = detect_fabrication_opt_in(prompt, history)
+    if classifier and classifier.get("missingFields"):
+        # If the model provided missing fields, respect that list.
+        missing = classifier.get("missingFields") or missing
+
+    # If the user gave no usable content, do not allow fabrication shortcuts.
+    # Force the flow to ask for the required fields instead of silently proceeding.
+    missing_all_fields = len(missing) == len(schema.get("field_order", []))
+    low_signal_request = not collected and len(combined_text.strip()) < 12
+    if missing_all_fields and low_signal_request:
+        allow_makeup = False
+
+    def has_minimum_resume(data: Dict[str, str]) -> bool:
+        has_name = bool(data.get("name"))
+        has_core = any(data.get(key) for key in ["work_history", "education", "skills", "contact", "target_role"])
+        return has_name and has_core
+
+    def has_minimum_invoice(data: Dict[str, str]) -> bool:
+        has_parties = data.get("your_business") and data.get("client")
+        has_items = bool(data.get("line_items"))
+        return bool(has_parties and has_items)
+
+    has_minimum = True
+    if doc_type == "resume":
+        has_minimum = has_minimum_resume(collected)
+    elif doc_type == "invoice":
+        has_minimum = has_minimum_invoice(collected)
+
+    # Decide if we must pause to ask for details. Avoid regex "ready" guesses;
+    # rely on the classifier's allowFabrication flag and collected data.
+    must_ask_first = bool(missing) and ((not allow_makeup and not has_minimum) or not classifier_has_enough)
+    if must_ask_first:
+        preface = None
+        if doc_type == "resume" and not has_minimum:
+            preface = (
+                "I only have a tiny bit so far. I need at least your name plus one of: contact, "
+                "a role snippet, education, skills, or target role."
+            )
+        if doc_type == "invoice" and not has_minimum:
+            preface = "Need who is billing, who is paying, and the line items so I don't invent details."
+        logger.info(
+            "[BRIEF] gating doc_type=%s missing=%s has_minimum=%s allowFabrication=%s",
+            doc_type,
+            missing,
+            has_minimum,
+            allow_makeup,
+        )
+        message = _ai_missing_message(doc_type, schema, collected, missing) or _format_missing_message(
+            doc_type, schema, collected, missing, preface=preface
+        )
+        message += "\nIf you'd like me to invent anything you didn't share, just say so."
+        return {
+            "needsInfo": True,
+            "message": message,
+            "collected": collected,
+            "missing": missing,
+            "allowFabrication": allow_makeup,
+        }
+
+    # If fabrication is allowed but fields are missing, let downstream generation
+    # know which areas to fill in plausibly.
+    fabrication_hint = ""
+    if allow_makeup and missing:
+        fabrication_hint = "\n\nIf details are absent, invent plausible, clearly fictional details for: " + ", ".join(missing) + "."
+
+    structured_lines = []
+    for field in schema.get("field_order", []):
+        value = collected.get(field)
+        if value:
+            label = schema.get("labels", {}).get(field, [field])[0]
+            structured_lines.append(f"{label}: {value}")
+    structured_brief = "\n".join(structured_lines)
+    if fabrication_hint:
+        structured_brief = (structured_brief + fabrication_hint).strip()
+    if combined_text.strip():
+        structured_brief = (structured_brief + "\n\nRaw user notes:\n" + combined_text).strip()
+
+    return {
+        "needsInfo": False,
+        "structured_brief": structured_brief or None,
+        "collected": collected,
+        "missing": missing,
+        "allowFabrication": allow_makeup,
+    }
+
+
+__all__ = ["gather_brief", "BRIEF_SCHEMAS", "_preprocess_intent"]

AI-Document-Generator-main/backend/config.py

@@ -0,0 +1,94 @@
+import logging
+import os
+from typing import Optional
+
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+OUTPUT_DIR = os.path.join(BASE_DIR, "output")
+ASSETS_DIR = os.path.join(OUTPUT_DIR, "assets")
+DATA_DIR = os.path.join(BASE_DIR, "data")
+TEMPLATE_DIR = os.path.join(BASE_DIR, "templates")
+STYLE_DB_PATH = os.path.join(DATA_DIR, "user_styles.json")
+TEMPLATE_DB_PATH = os.path.join(DATA_DIR, "user_templates.json")
+VERSIONS_DB_PATH = os.path.join(DATA_DIR, "versions.json")
+
+os.makedirs(OUTPUT_DIR, exist_ok=True)
+os.makedirs(ASSETS_DIR, exist_ok=True)
+os.makedirs(DATA_DIR, exist_ok=True)
+os.makedirs(TEMPLATE_DIR, exist_ok=True)
+
+OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")
+OPENAI_BASE_URL = os.environ.get("OPENAI_BASE_URL")
+JAVA_BACKEND_URL = os.environ.get("JAVA_BACKEND_URL", "http://localhost:8080")
+
+if not OPENAI_API_KEY:
+    raise RuntimeError("OPENAI_API_KEY is required to start the AI backend.")
+# Default to GPT-5.1 for full document generation (smart model).
+# Allow override via SMART_MODEL or legacy OPENAI_MODEL.
+SMART_MODEL = os.environ.get("SMART_MODEL") or os.environ.get("OPENAI_MODEL") or "gpt-5.1"
+# Default to the nano/ultra-fast tier for intent/pre checks (fast model).
+# Allow override via FAST_MODEL or legacy FAST_INTENT_MODEL.
+FAST_MODEL = os.environ.get("FAST_MODEL") or os.environ.get("FAST_INTENT_MODEL") or "gpt-4.1-nano"
+
+CLIENT_MODE: Optional[str] = None
+LANGCHAIN_AVAILABLE = False
+_ChatOpenAI = None
+STREAMING_ENABLED = os.environ.get("AI_STREAMING", "true").lower() not in {"0", "false", "no"}
+if OPENAI_BASE_URL and "ollama" in OPENAI_BASE_URL and "AI_STREAMING" not in os.environ:
+    STREAMING_ENABLED = False
+PREVIEW_MAX_INFLIGHT = int(os.environ.get("AI_PREVIEW_MAX_INFLIGHT", "3"))
+
+if OPENAI_API_KEY:
+    try:
+        from langchain_openai import ChatOpenAI  # type: ignore
+
+        _ChatOpenAI = ChatOpenAI
+        LANGCHAIN_AVAILABLE = True
+        CLIENT_MODE = "langchain"
+    except Exception as client_exc:  # pragma: no cover - import guard
+        logger.warning("LangChain OpenAI init failed: %s", client_exc)
+
+if CLIENT_MODE == "langchain":
+    logger.info("AI mode: LIVE (fast_model=%s smart_model=%s)", FAST_MODEL, SMART_MODEL)
+else:
+    logger.info("AI mode: MOCK (no OpenAI key or LangChain init failure)")
+
+
+def get_chat_model(
+    model_name: str,
+    streaming: bool = False,
+    max_tokens: Optional[int] = None,
+    model_kwargs: Optional[dict] = None,
+):
+    if not LANGCHAIN_AVAILABLE or not _ChatOpenAI:
+        return None
+    kwargs = {"model": model_name, "api_key": OPENAI_API_KEY, "streaming": streaming}
+    if max_tokens is not None:
+        kwargs["max_tokens"] = max_tokens
+    if model_kwargs:
+        kwargs["model_kwargs"] = model_kwargs
+    return _ChatOpenAI(**kwargs)
+
+__all__ = [
+    "logger",
+    "OUTPUT_DIR",
+    "ASSETS_DIR",
+    "DATA_DIR",
+    "TEMPLATE_DIR",
+    "STYLE_DB_PATH",
+    "TEMPLATE_DB_PATH",
+    "VERSIONS_DB_PATH",
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "JAVA_BACKEND_URL",
+    "SMART_MODEL",
+    "CLIENT_MODE",
+    "LANGCHAIN_AVAILABLE",
+    "get_chat_model",
+    "FAST_MODEL",
+    "STREAMING_ENABLED",
+    "PREVIEW_MAX_INFLIGHT",
+]