Merge branch 'main' into processor-restructure

(scripted) Restructure frontend so processor and editor are more distinct in the tree
(scripted) Update paths for new frontend structure
2026-09-03 05:10:16 +03:00 · 2026-08-07 09:36:43 +01:00 · 2026-08-06 17:18:41 +01:00 · 2026-08-06 17:17:54 +01:00 · 2026-08-06 17:17:20 +01:00 · 2026-08-06 17:17:20 +01:00
3608 changed files with 52401 additions and 117605 deletions
@@ -32,7 +32,7 @@ vs `main`. Flags: `--html` (also emit a rendered HTML twin), `--no-screens`.
 - Read the PR description / commit messages for stated intent. Do **not** invent
  history or motivation that isn't evidenced (state current behavior in present tense).
 - Classify touched files by layer:
-  - **Frontend**: tools (`frontend/editor/src/core/components/tools/*` or `.../core/tools/*`),
+  - **Frontend**: tools (`frontend/src/editor/core/components/tools/*` or `.../core/tools/*`),
    hooks (`core/hooks/tools/*`, `useToolOperation`), contexts, routes, i18n
    (`public/locales/en-US`).
  - **Java backend**: controllers (`.../controller/api/...`), services, models, config.
@@ -53,11 +53,11 @@ gh pr diff <pr> --name-only        # or: git diff --name-only <base>...HEAD
 Map changed frontend files to URLs generically:
 - **Tools**: a changed `components/tools/<toolDir>/…` or `hooks/tools/<tool>/…` →
  toolId → URL via the repo's own rule `getToolUrlPath` in
-  [toolsTaxonomy.ts:200](frontend/editor/src/core/data/toolsTaxonomy.ts): `/` + the
+  [toolsTaxonomy.ts:200](frontend/src/editor/core/data/toolsTaxonomy.ts): `/` + the
  id kebab-cased (`addPageNumbers` → `/add-page-numbers`).
 - **Pages/routes**: changed `filesPage/*` → `/files`, etc.
 - `--all`: enumerate every tool in the registry instead of just changed ones.
-Write `frontend/editor/screenshots/ui-diff/targets.json` =
+Write `frontend/screenshots/ui-diff/targets.json` =
 `[{ "id":"compress", "url":"/compress", "name":"Compress" }]`. This is what makes
 it generic - the spec never names a tool.

@@ -69,12 +69,12 @@ the full viewport - or the `--scope` container if given). Ensure the harness is
 (node_modules + icons).
 ```
 # after = current head
-cd frontend/editor && PR_SHOT_SIDE=after PR_SHOT_THEME=light \
+cd frontend && PR_SHOT_SIDE=after PR_SHOT_THEME=light \
  npx playwright test --project=stubbed ui-before-after.spec.ts
 # before = base, in an isolated worktree (copy the spec + targets.json in)
 git worktree add ../ba-base origin/<baseRefName>        # or the merge-base
 #   set up its frontend, copy spec + screenshots/ui-diff/targets.json across, then:
-cd ../ba-base/frontend/editor && PR_SHOT_SIDE=before PR_SHOT_THEME=light \
+cd ../ba-base/frontend && PR_SHOT_SIDE=before PR_SHOT_THEME=light \
  npx playwright test --project=stubbed ui-before-after.spec.ts
 #   copy its screenshots/ui-diff/before/ back next to after/. Repeat with
 #   PR_SHOT_THEME=dark if --theme includes dark. Remove worktree when done.
@@ -82,7 +82,7 @@ cd ../ba-base/frontend/editor && PR_SHOT_SIDE=before PR_SHOT_THEME=light \

 ### 4. Auto-diff (surface what changed)
 ```
-cd frontend/editor && node <skill>/diff-shots.mjs \
+cd frontend && node <skill>/diff-shots.mjs \
  screenshots/ui-diff/before screenshots/ui-diff/after screenshots/ui-diff
 ```
 Produces `diff-report.json` classifying each view `unchanged | changed | added |
@@ -2,7 +2,7 @@
 // unchanged | changed | added | removed, and CROP each changed pair to the
 // affected region (bounding box of differing pixels + padding) - unless the
 // change spans most of the page, in which case the full frame is kept.
-// Run from frontend/editor (so deps resolve):
+// Run from frontend (so deps resolve):
 //   node <skill>/diff-shots.mjs <beforeDir> <afterDir> [outDir]
 // Env:
 //   DIFF_THRESHOLD  min fraction of differing pixels to count as changed (default 0.001)
@@ -1,5 +1,5 @@
 // Render each .tab-section of a montage HTML into its own PNG (the PR-ready image).
-// Run from frontend/editor (so @playwright/test resolves):
+// Run from frontend (so @playwright/test resolves):
 //   node <skill>/shoot-sections.mjs <montage.html> <outDir>
 import path from "node:path";
 import { pathToFileURL } from "node:url";
@@ -28,13 +28,13 @@ current branch diff. Flags: `--fix`, `--theme light|dark|both` (default both),
 ## What this repo gives you (use it, don't reinvent)

 - **Stubbed Playwright project** = backend-free screenshots via `page.route()` mocks.
-  Reference implementation: `frontend/editor/src/core/tests/stubbed/files-page-screenshots.spec.ts`.
+  Reference implementation: `frontend/src/editor/core/tests/stubbed/files-page-screenshots.spec.ts`.
  It already shows the light / **dark** / **RTL** passes, JWT seeding, IndexedDB
  seeding, and dumping PNGs to a `screenshots/<area>/` folder. Copy its shape.
- Helpers: `frontend/editor/src/core/tests/helpers/ui-helpers.ts`
+- Helpers: `frontend/src/editor/core/tests/helpers/ui-helpers.ts`
  (`uploadFiles`, `openSettings`, `waitForModalOpen`, `dismissTourTooltip`, …)
  and the `stub-test-base` fixtures (`autoGoto`, `seedJwt`, `viewport`).
- Config: `frontend/editor/playwright.config.ts` (run from `frontend/editor/`).
+- Config: `frontend/playwright.config.ts` (run from `frontend/`).
 - Report template: [report-template.html](report-template.html) - self-contained,
  one big image at a time, a global light/dark slider that flips every shot,
  thumbnail rail, prev/next + arrow keys, and a Findings tab.
@@ -54,13 +54,13 @@ current branch diff. Flags: `--fix`, `--theme light|dark|both` (default both),
 Worktrees have no `node_modules` and no generated icons. From repo root:
 ```
 cd frontend && npm ci                       # or junction main's node_modules (see memory)
-cd frontend/editor && node scripts/generate-icons.js
+cd frontend && node scripts/generate-icons.js
 ```
 Kill any stale dev server first (it serves old modules):
 `Get-NetTCPConnection -LocalPort 5173 -State Listen | %{ Stop-Process -Id $_.OwningProcess -Force }`

 ### 3. Write the capture spec
-Create `frontend/editor/src/core/tests/stubbed/<feature>-walkthrough.spec.ts`,
+Create `frontend/src/editor/core/tests/stubbed/<feature>-walkthrough.spec.ts`,
 modeled on `files-page-screenshots.spec.ts`. For each enumerated view:
 - stub the APIs it needs, drive the UI to that state, wait on a real locator
  (not a fixed sleep), `await settle(page)` for Mantine portals, then
@@ -71,7 +71,7 @@ modeled on `files-page-screenshots.spec.ts`. For each enumerated view:
 - Name shots `NN_<view>_<theme>.png` so light/dark pair up by suffix.
 - Prefer **stable test-ids** over translated accessible names (RTL/i18n breaks text locators).

-Run it: `cd frontend/editor && npx playwright test --project=stubbed <feature>-walkthrough.spec.ts`.
+Run it: `cd frontend && npx playwright test --project=stubbed <feature>-walkthrough.spec.ts`.
 Add `--project=stubbed-firefox`/`-webkit` only if cross-browser layout matters.

 ### 4. Build the report
@@ -119,6 +119,8 @@
            "extensions": [
                "elagil.pre-commit-helper", // Support for pre-commit hooks to enforce code quality
                "josevseb.google-java-format-for-vs-code", // Google Java code formatter to follow the Google Java Style Guide
+                "ms-python.black-formatter", // Python code formatter using Black
+                "ms-python.flake8", // Flake8 linter for Python to enforce code quality
                "ms-python.python", // Official Microsoft Python extension with IntelliSense, debugging, and Jupyter support
                "ms-vscode-remote.vscode-remote-extensionpack", // Remote Development Pack for SSH, WSL, and Containers
                // "Oracle.oracle-java", // Oracle Java extension with additional features for Java development
@@ -26,16 +26,16 @@ version_builds/
 node_modules/
 **/node_modules/
 frontend/node_modules/
-frontend/editor/dist/
-frontend/editor/playwright-report/
+frontend/dist/
+frontend/playwright-report/
 .npm/
 .yarn/

 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
-frontend/editor/src-tauri/target/
-frontend/editor/src-tauri/dist/
+frontend/src-tauri/target/
+frontend/src-tauri/dist/

 # IDE and editor
 .idea/
@@ -1,28 +1,18 @@
-# Review ownership is assigned to teams where possible.
-# Teams can only contain org members, so outside collaborators are listed by hand.
-#
-#   @Stirling-Tools/maintainers          - Frooodle, jbrunton96, ConnorYoh
-#   @Stirling-Tools/backend-reviewers    - Frooodle, jbrunton96, ConnorYoh
-#   @Stirling-Tools/frontend-reviewers   - Frooodle, jbrunton96, ConnorYoh, reecebrowne, EthanHealy01
-#   @Stirling-Tools/devops-reviewers     - Frooodle, jbrunton96, ConnorYoh
-#   @Stirling-Tools/all                  - all of the above
-#
-# Outside collaborators (need Write access to count as owners): @Ludy87 @balazs-szucs
-
-# Default owners for everything
-* @Stirling-Tools/maintainers @Ludy87
+# All PRs must be approved by Frooodle or Ludy87
+* @Frooodle @Ludy87 @jbrunton96 @ConnorYoh

 # Backend
-/app/** @Stirling-Tools/backend-reviewers @Ludy87 @balazs-szucs
+/app/** @DarioGii @Frooodle @Ludy87 @jbrunton96 @ConnorYoh @balazs-szucs

-# V2 frontend
-/frontend/** @Stirling-Tools/frontend-reviewers @balazs-szucs
-/app/core/src/main/resources/static/** @Stirling-Tools/frontend-reviewers @Ludy87 @balazs-szucs
+#V2 frontend
+/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @balazs-szucs
+/app/core/src/main/resources/static/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87 @balazs-szucs

-# V2 docker
-/docker/backend/** @Stirling-Tools/devops-reviewers @Ludy87
-/docker/frontend/** @Stirling-Tools/frontend-reviewers @Stirling-Tools/devops-reviewers @Ludy87
-/docker/compose/** @Stirling-Tools/frontend-reviewers @Stirling-Tools/devops-reviewers @Ludy87
+#V2 docker
+/docker/backend/** @Frooodle @Ludy87 @DarioGii
+/docker/frontend/** @reecebrowne @ConnorYoh @EthanHealy01 @jbrunton96 @Frooodle @Ludy87
+/docker/compose/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87

-# GHA (all users)
-/.github/** @Stirling-Tools/all @Ludy87 @balazs-szucs
+
+#GHA (All users)
+/.github/** @reecebrowne @ConnorYoh @EthanHealy01 @DarioGii @jbrunton96 @Frooodle @Ludy87 @balazs-szucs
@@ -92,12 +92,12 @@ frontend: &frontend
 # job on changes to any of these.
 tauri: &tauri
  - *ci
-  - frontend/editor/src-tauri/**
-  - frontend/editor/src/desktop/**
-  - frontend/editor/tsconfig.desktop.vite.json
+  - frontend/src-tauri/**
+  - frontend/src/editor/desktop/**
+  - frontend/tsconfig.desktop.vite.json
  - frontend/package.json
  - frontend/package-lock.json
-  - frontend/editor/vite.config.ts
+  - frontend/vite.config.ts
  - .github/workflows/tauri-build.yml
  - Taskfile.yml
  - .taskfiles/desktop.yml
@@ -121,9 +121,9 @@ engine: &engine
 generated-models: &generated-models
  - *ci
  - *openapi
-  - frontend/editor/scripts/generate-tool-api-types.mts
-  - frontend/editor/src/core/types/toolApiTypes.ts
-  - frontend/editor/src/core/types/toolIO.ts
+  - frontend/scripts/generate-tool-api-types.mts
+  - frontend/src/editor/core/types/toolApiTypes.ts
+  - frontend/src/editor/core/types/toolIO.ts
  - engine/scripts/generate_tool_models.py
  - engine/src/stirling/models/tool_models.py
  - engine/src/stirling/models/tool_io.py
@@ -135,7 +135,7 @@ licenses-frontend: &licenses-frontend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - "frontend/package.json"
  - "frontend/package-lock.json"
-  - "frontend/editor/scripts/generate-licenses.js"
+  - "frontend/scripts/generate-licenses.js"

 licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -146,8 +146,8 @@ licenses-backend: &licenses-backend
 proprietary: &proprietary
  - *ci
  - app/proprietary/**
-  - frontend/editor/src/proprietary/**
-  - frontend/editor/src/core/tests/enterprise/**
+  - frontend/src/editor/proprietary/**
+  - frontend/src/editor/core/tests/enterprise/**
  - testing/compose/docker-compose-keycloak-oauth.yml
  - testing/compose/docker-compose-keycloak-saml.yml
  - testing/compose/keycloak-realm-oauth.json
@@ -11,6 +11,7 @@
    "LaserKaspar",
    "sbplat",
    "reecebrowne",
+    "DarioGii",
    "ConnorYoh",
    "EthanHealy01",
    "jbrunton96",
@@ -16,11 +16,6 @@ updates:
    cooldown:
      default-days: 7
    rebase-strategy: "auto"
-    groups:
-      simple-java-mail:
-        patterns:
-          - "org.simplejavamail:simple-java-mail"
-          - "org.simplejavamail:outlook-module"

  - package-ecosystem: "docker"
    directories:
@@ -78,6 +73,14 @@ updates:
          - "react-dom"
          - "@types/react"
          - "@types/react-dom"
+      typescript-eslint:
+        patterns:
+          - "@typescript-eslint/*"
+          - "typescript-eslint"
+      eslint:
+        patterns:
+          - "eslint"
+          - "@eslint/*"
      vite:
        patterns:
          - "vite"
@@ -125,9 +128,9 @@ updates:

  - package-ecosystem: cargo
    directories:
-      - /frontend/editor/src-tauri
-      - /frontend/editor/src-tauri/thumbnail-handler
-      - /frontend/editor/src-tauri/provisioner
+      - /frontend/src-tauri
+      - /frontend/src-tauri/thumbnail-handler
+      - /frontend/src-tauri/provisioner
    schedule:
      interval: "weekly"
    cooldown:
@@ -51,7 +51,7 @@ labels:

  - label: 'Translation'
    files:
-      - 'frontend/editor/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
      - 'scripts/ignore_translation.toml'
      - 'scripts/remove_translation_keys.sh'
      - 'scripts/replace_translation_line.sh'
@@ -70,8 +70,8 @@ labels:

  - label: 'Tauri'
    files:
-      - 'frontend/editor/src-tauri/**'
-      - 'frontend/editor/src-tauri/.*'
+      - 'frontend/src-tauri/**'
+      - 'frontend/src-tauri/.*'

  - label: 'engine'
    files:
@@ -13,15 +13,15 @@ Usage:
 """

 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-US/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-US/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml

 import argparse
 import glob
 import os
 import re
-import tomllib  # Python 3.11+ (stdlib)
 from pathlib import Path

+import tomllib  # Python 3.11+ (stdlib)
 import tomli_w  # For writing TOML files


@@ -133,7 +133,11 @@ def update_missing_keys(reference_file, file_list, branch=""):
        file_path = Path(file_path)
        language_dir = file_path.parent.name
        reference_lang_dir = reference_file.parent.name
-        if language_dir == reference_lang_dir or file_path.suffix != ".toml" or file_path.parents[1].name != "locales":
+        if (
+            language_dir == reference_lang_dir
+            or file_path.suffix != ".toml"
+            or file_path.parents[1].name != "locales"
+        ):
            print(f"Skipping file: {file_path}")
            continue

@@ -194,7 +198,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
        # Verify that file is within the expected directory
        if not absolute_path.is_relative_to(base_dir):
            has_differences = True
-            report.append(f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n")
+            report.append(
+                f"\n⚠️ Unsafe file found: `{locale_dir}/{basename_current_file}`\n\n---\n"
+            )
            continue

        # Verify file size before processing
@@ -208,7 +214,10 @@ def check_for_differences(reference_file, file_list, branch, actor):
        if basename_current_file == basename_reference_file and locale_dir == "en-US":
            continue

-        if file_normpath.suffix != ".toml" or basename_current_file != "translation.toml":
+        if (
+            file_normpath.suffix != ".toml"
+            or basename_current_file != "translation.toml"
+        ):
            continue

        only_reference_file = False
@@ -252,7 +261,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
                )
                report.append("")
                report.append("    Use the following command to remove them:")
-                report.append(f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} remove-unused`"
+                )
                report.append("")
            if extra_keys_list:
                report.append(
@@ -260,7 +271,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
                )
                report.append("")
                report.append("    Use the following command to add them:")
-                report.append(f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`")
+                report.append(
+                    f"    `python scripts/translations/translation_merger.py {locale_dir} add-missing`"
+                )
                report.append("")

            if missing_keys_list or extra_keys_list:
@@ -275,7 +288,9 @@ def check_for_differences(reference_file, file_list, branch, actor):
            output = "\n".join(
                [
                    f"      - `{key}`: first at {first}, duplicate at `{duplicate}`"
-                    for key, first, duplicate in find_duplicate_keys(branch_path / file_normpath)
+                    for key, first, duplicate in find_duplicate_keys(
+                        branch_path / file_normpath
+                    )
                ]
            )
            report.append("3. **Test Status:** ❌ **_Failed_**")
@@ -293,19 +308,23 @@ def check_for_differences(reference_file, file_list, branch, actor):
        report.append("## ❌ Overall Check Status: **_Failed_**")
        report.append("")
        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-US/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-US/translation.toml)"
        )
    else:
        report.append("## ✅ Overall Check Status: **_Success_**")
        report.append("")
-        report.append(f"Thanks @{actor} for your help in keeping the translations up to date.")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )

    if not only_reference_file:
        print("\n".join(report))


 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
+    parser = argparse.ArgumentParser(
+        description="Find missing keys in TOML translation files"
+    )
    parser.add_argument(
        "--actor",
        required=False,
@@ -0,0 +1,9 @@
+pip
+setuptools
+WeasyPrint
+pdf2image
+pillow
+unoserver
+opencv-python-headless
+pre-commit
+brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
@@ -0,0 +1,528 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --allow-unsafe --generate-hashes --output-file='.github\scripts\requirements_dev.txt' --strip-extras '.github\scripts\requirements_dev.in'
+#
+# WARNING: pip install will require the following package to be hashed.
+# Consider using a hashable URL like https://github.com/jazzband/pip-tools/archive/SOMECOMMIT.zip
+brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
+    # via
+    #   -r .github/scripts/requirements_dev.in
+    #   fonttools
+cffi==2.1.0 \
+    --hash=sha256:02cb7ff33ded4f1532476731f89ede53e2e488a8e6205515a82144246ffa7dcc \
+    --hash=sha256:03e9810d18c646077e501f661b682fbf5dee4676048527ca3cffe66faa9960dd \
+    --hash=sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d \
+    --hash=sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5 \
+    --hash=sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f \
+    --hash=sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6 \
+    --hash=sha256:0a96b74cda968eebbad56d973efe5098974f0a9fb323865bf99ea1fd24e3e64c \
+    --hash=sha256:10537b1df4967ca26d21e5072d7d54188354483b91dc75058968d3f0cf13fbda \
+    --hash=sha256:11b3fb55f4f8ad92274ed26705f65d8f91457de71f5380061eb6d125a768fecd \
+    --hash=sha256:15faec4adfff450819f3aee0e2e02c812de6edb88203aa58807955db2003472a \
+    --hash=sha256:164bff1657b2a74f0b6d54e11c9b375bc97b931f2ca9c43fcf875838da1570dd \
+    --hash=sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd \
+    --hash=sha256:19c54ac121cad98450b4896fa9a43ee0180d57bc4bc911a33db6cab1efab6cd3 \
+    --hash=sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb \
+    --hash=sha256:1e9f50d192a3e525b15a75ab5114e442d83d657b7ec29182a991bc9a88fd3a66 \
+    --hash=sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d \
+    --hash=sha256:2282cd5e38aa8accd03e99d1256af8411c84cdbee6a89d841b563fdbd1f3e50f \
+    --hash=sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6 \
+    --hash=sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0 \
+    --hash=sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c \
+    --hash=sha256:30b65779d598c370374fefabf138d456fd6f3216bfa7bedfab1ba82025b0cd93 \
+    --hash=sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d \
+    --hash=sha256:35aaea0c7ee0e58a5cd8c2fd1a48fdf7ece0d2699b7ecdda08194e9ce5dd9b3d \
+    --hash=sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8 \
+    --hash=sha256:379de10ce1ba048b1448599d1b37b24caee16309d1ac98d3982fc997f768700b \
+    --hash=sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001 \
+    --hash=sha256:3b926723c13eba9f81d2ef3820d63aeceec3b2d4639906047bf675cb8a7a500d \
+    --hash=sha256:3d7f118b5adbfdfead90c25822690b02bc8074fba949bb7858bec4ebd55adb43 \
+    --hash=sha256:46b1c8db8f6122420f32d02fffb924c2fe9bc772d228c7c711748fff56aabb2b \
+    --hash=sha256:47ff3a8bfd8cb9da1af7524b965127095055654c177fcfc7578debcb015eecd0 \
+    --hash=sha256:4d433a51f1870e43a13b6732f92aaf540ff77c2015097c78556f75a2d6c030e0 \
+    --hash=sha256:4f26194e3d95e06501b942642855aed4f953d55e95d7d01b7c4483db3ecff458 \
+    --hash=sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8 \
+    --hash=sha256:5972433ad71a9e46516584ef60a0fda12d9dc459938d1539c3ddecf9bdc1368d \
+    --hash=sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94 \
+    --hash=sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022 \
+    --hash=sha256:63960549e4f8dc41e31accb97b975abaecfc44c03e396c093a6436763c2ea7db \
+    --hash=sha256:64c753a0f87a256020004f37a1c8c02c480e725f910f0b2a0f3f07debd1b2479 \
+    --hash=sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376 \
+    --hash=sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d \
+    --hash=sha256:6d194185eabd279f1c05ebe3504265ddfc5ad2b58d0714f7db9f01da592e9eb6 \
+    --hash=sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3 \
+    --hash=sha256:716ff8ec22f20b4d988b12884086bcef0fc99737043e503f7a3935a6be99b1ea \
+    --hash=sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd \
+    --hash=sha256:7762faa47e8ff7eb80bd261d9a7d8eea2d8baa69de5e95b70c1f338bbe712f02 \
+    --hash=sha256:78474632761faa0fb96f30b1c928c84ebcf68713cbb80d15bab09dfe61640fde \
+    --hash=sha256:799416bae98336e400981ff6e532d67d5c709cfb30afb79865a1315f94b0e224 \
+    --hash=sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76 \
+    --hash=sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804 \
+    --hash=sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1 \
+    --hash=sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913 \
+    --hash=sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714 \
+    --hash=sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc \
+    --hash=sha256:88023dfe18799507b73f1dbb0d14326a17465de1bc9c9c7655c22845e9ddc3a2 \
+    --hash=sha256:89095c1968b4ba8285840e131bf2891b09ae137fe2146905acae0354fbce1b5e \
+    --hash=sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda \
+    --hash=sha256:8e74a6135550c4748af665b1b1118b6aab33b1fc6a16f9aff630af107c3b4512 \
+    --hash=sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28 \
+    --hash=sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699 \
+    --hash=sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3 \
+    --hash=sha256:961be50688f7fba2fa65f63712d3b9b341a22311f5253460ce933f52f0de1c8c \
+    --hash=sha256:98fff996e983a36d3aa2eca83af40c5821202e7e6f32d13ae94e3d2286f10cfe \
+    --hash=sha256:9b8f0f26ca4e7513c534d351eca551947d053fac438f2a04ac96d882909b0d3a \
+    --hash=sha256:9d72af0cf10a76a600a9690078fe31c63b9588c8e86bf9fd353f713c84b5db0f \
+    --hash=sha256:9d8272c0e483b024e1b9ad029821470ed8ec65631dbd90217469da0e7cd89f1c \
+    --hash=sha256:a016194dbe13d14ee9556e734b772d8d67b947092b268d757fd4290e3ba2dfc2 \
+    --hash=sha256:a5781494d4d400a3f47f8f1da94b324f6e6b440a53387774002890a2a2f4b50f \
+    --hash=sha256:a95b05f9baf29b91171b3a8bd2020b028835243e7b0ff6bb23e2a3c228518b1b \
+    --hash=sha256:aa7a1b53a2a4452ada2d1b5dade9960b2522f1e61293a811a077439e39029565 \
+    --hash=sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056 \
+    --hash=sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629 \
+    --hash=sha256:b6422532152adf4e59b110cb2808cee7a033800952f5c036b4af047ee43199e7 \
+    --hash=sha256:b65f590ef2a44640f9a05dbb548a429b4ade77913ce683ac8b1480777658a6c0 \
+    --hash=sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9 \
+    --hash=sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853 \
+    --hash=sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13 \
+    --hash=sha256:bf5c6cf48238b0eb4c086978c492ad1cbc22373fc5b2d7353b3a598ce6db887a \
+    --hash=sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4 \
+    --hash=sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce \
+    --hash=sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac \
+    --hash=sha256:c5f5df567f6eb216de69be06ce55c8b714090fae02b18a3b40da8163b8c5fa9c \
+    --hash=sha256:c941bb58d5a6e1c3892d86e42927ed6c180302f07e6d395d08c416e594b98b46 \
+    --hash=sha256:c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384 \
+    --hash=sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b \
+    --hash=sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210 \
+    --hash=sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc \
+    --hash=sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a \
+    --hash=sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5 \
+    --hash=sha256:d9fafc5aa2e2a39aaf7f8cc0c1f044a9b07fca12e558dca53a3cc5c654ad67a7 \
+    --hash=sha256:db3eb7d46527159a878ec3460e9d40615bc25ba337d477db681aea6e4f05c5d2 \
+    --hash=sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326 \
+    --hash=sha256:df2b82571a1b30f58a87bf4e5a9e78d2b1eff6c6ce8fd3aa3757221f93f0863f \
+    --hash=sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca \
+    --hash=sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98 \
+    --hash=sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9 \
+    --hash=sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5 \
+    --hash=sha256:f5bce581e6b8c235e566a14768a943b172ada3ed73537bb0c0be1edee312d4e7 \
+    --hash=sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc \
+    --hash=sha256:fb62edb5bb52cca65fab91a63afa7561607120d26090a7e8fda6fb9f064726da \
+    --hash=sha256:ff067a8d8d880e7809e4ac88eb009bb848870115317b306666502ccad30b147f
+    # via weasyprint
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+    # via pre-commit
+cssselect2==0.9.0 \
+    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
+    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
+    # via weasyprint
+distlib==0.4.3 \
+    --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \
+    --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed
+    # via virtualenv
+filelock==3.30.0 \
+    --hash=sha256:1774e682dbe443bd60f9609162fc596e2c80dc84ffc2957068953406d0520090 \
+    --hash=sha256:40632998f0772e64183bb819f086a1b9def6be1090cf1dcb9d45f46806ef279b
+    # via
+    #   python-discovery
+    #   virtualenv
+fonttools==4.63.0 \
+    --hash=sha256:032038247a96c1690f9f31e377c389383c902531b085aa4e4dabd6f57f870e69 \
+    --hash=sha256:063e08bd17bd5a90127a14123de0d6a952dbc847695fd98b63c043d58057f90c \
+    --hash=sha256:0c18358a155d75034911c5ee397a5b44cd19dd325dbb8b35fb60bf421d6a72ac \
+    --hash=sha256:0eac00b9118c3c2f87d272e45341871c5b3066baa3c86897fa634a7c3fb59096 \
+    --hash=sha256:1e874792a8212b44583ea02189d9e693906b2f78b261f372f95d6c563210ac1d \
+    --hash=sha256:22135da48a348785c5e2d5d2d9d6bec5ed44adacbaeb9db12d9493bf6c6bfa68 \
+    --hash=sha256:22693918177bd9ceabec4736d338045f357769416fc6b0b2508eefef75b08616 \
+    --hash=sha256:27fdc65af8da6f88b9c6121c47a464cbe359fcfff7ff6fc2d37a1f395d755b78 \
+    --hash=sha256:2b8ae05d9eacf6081414d759c0a352769ac28ce31280d6bb8e77b03f9e3c449f \
+    --hash=sha256:2c14b4fd138c4bafcca294765c547914e1aa431ae1ca94ab99d8db08c958bd3b \
+    --hash=sha256:308f957cdeaf8abe4e5f2f124902ef405448af92c90f80e302a3b771c2e6116b \
+    --hash=sha256:37dd23e621e3b0aef1baa70a303b80aaf38449632cfc8fd2a55fb285bbccfc02 \
+    --hash=sha256:445af2eab030a16b9171ea8bdda7ebf7d96bda2df88ee182a464252f6e05e20d \
+    --hash=sha256:51394295f1a51de8b5f30bdb1e1b9a4231536c7064ef5c6e211eec19fa36036f \
+    --hash=sha256:58dc6bb86a78d782f00f9190ca02c119cf5bbe2807536e361e18d42019f877d8 \
+    --hash=sha256:59ac449f8cca9b4ffa08d2e7bbadad87ce710d69d1eda5c3c1ce579baa987272 \
+    --hash=sha256:6b2248c5decb223562f7902ff6325077a073f608ee8e33e88ad88db734eb9f49 \
+    --hash=sha256:6d4741eb179121cab9eea4cb2393d24492373a260d7945006358c08cfbf45419 \
+    --hash=sha256:6db5140a60a5d731d21ec076745b40a310607731b0a565b50776393188649001 \
+    --hash=sha256:6e528da43bc3791085f8cb6141b1d13e459226790240340fcbb4625649238b03 \
+    --hash=sha256:796f27556dbe094c4824f75ca85267e4df776c79036c8441469a4df37038c196 \
+    --hash=sha256:79cdc9f567aec74a72918fd060283911406750cbc9fd28c1316023deb6ce31a9 \
+    --hash=sha256:7d76edbff9014094dbf03bd2d074709dfa6ec7aba13d838c937a2b33d2d6a86e \
+    --hash=sha256:7d782fac32985914c351556f68ac0855391572bcd87de50e05970d3cd4c96fc5 \
+    --hash=sha256:7dd683fef0663e9f0f45cf541d788d24caa3ec9db50796b588e1757d8b3bc007 \
+    --hash=sha256:85be818f5506e8a7753153def2c9550178f0ecae6a47b5e0e8dbb23f7cc90380 \
+    --hash=sha256:948428a275741f0b64b113c955425a953314f4b9ab9997f73a72c83e68e569c8 \
+    --hash=sha256:9ced0bd02ac751dd6319b0da88aaef24414e3b0dbc32bb4f24944821a3741a27 \
+    --hash=sha256:9e12f105d2b6342c559c298afb674006bb2893afc7102dcf8a1b55b0486b4e40 \
+    --hash=sha256:a8b33a82979e0a6a34ff435cc81317be1f95ec1ebb7a3a2d1c8a6a54f02ae44e \
+    --hash=sha256:a9faff9e0c1f76f9fd55899d2ce785832efebab37eb8ae13995853aef178bef0 \
+    --hash=sha256:af2fd1664d00a397d75f806985ddb36282091c2131a73a6485c23b4a34722263 \
+    --hash=sha256:afefc1ed0a59785a7fb06ea7e1678e849c193e1e387db783579bc7b3056fcfcb \
+    --hash=sha256:b1cd75a03ad8cb5bc40c90bfde68c0c47de423aa19e5c0f362b43520645eea94 \
+    --hash=sha256:ba04cb5891d4c0c21b6da95eda8d7b090021508a294fff33464fc7d241e0856b \
+    --hash=sha256:bf00f21eb5fb721dbaf73d1e9da6d02a1af7768f2ebcf9798be98beab8ba90f6 \
+    --hash=sha256:c0425b277a59cff3d80ca42162a8de360f318438a2ac83570842a678d826d579 \
+    --hash=sha256:c1aaa4b9c75798400ac043ce04d74e7830376c85095a5a6ed7cba2f17a266bf4 \
+    --hash=sha256:c2a2a42198b696a6f48fad91709afb55176e66a5e566131219dba372fb7f8c59 \
+    --hash=sha256:caeb583deeb5168e694b65cda8b4ee62abedfa66cf88488734466f2366b9c4e0 \
+    --hash=sha256:cb014d58140a38135f16064c74c652ed57aa0b75cbf8bb59cac821f7edb5334e \
+    --hash=sha256:ccf41f2efdf56994d22d73bef4ced1052161958169428d06ba9724ea9e9a64be \
+    --hash=sha256:cd7e9857e5e63738b9d9fd707bc1f59c8b09e5177726d23664db393c59bb08bd \
+    --hash=sha256:d76ac49f929aecaf82d83250b8347e099d7aecba0f4726c1d9b6df3b8bb5fe18 \
+    --hash=sha256:d7e5c9973aa04c95650c96e5f5ad865fbf42d62079163ecfab1e01cbc2504c22 \
+    --hash=sha256:dcf076a4474fe0d7367e5bbf5b052c7284fa1feca729c04176ce513521afd8a0 \
+    --hash=sha256:e3297a6a4059b4acc3a1e9a8b04741f240a80044eef08ebd32e8b5bcdddce75b \
+    --hash=sha256:ee08ebfa58f6e1aeff5697ab9582105bb620008c1caafb681e4c557e7483027b \
+    --hash=sha256:ef3048ef05dbb552b89817713d9cac912e00d0fde4a3105c00d29e52e10c89af \
+    --hash=sha256:fd1e3094f42d806d3d7c79162fc59e5910fcbe3a7360c385b8da969bc4493745
+    # via weasyprint
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+    # via pre-commit
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+    # via pre-commit
+numpy==2.4.6 \
+    --hash=sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1 \
+    --hash=sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4 \
+    --hash=sha256:043191bfa8eab18c776647b62723ac9dddece59743b13f49b2016094129c2b3f \
+    --hash=sha256:06ca2f61ec4385a07a6977c55ba998a4466c123642b4a32694d3128fce18c079 \
+    --hash=sha256:0a041d3d761dc3c35cc56ce0351506a02bcbc25f7b169f652435141a17db9096 \
+    --hash=sha256:0ab0a9c4ffb1a6d95ef519fe4247dba8eb6b18ad93999f76b7f657039acabd47 \
+    --hash=sha256:0c9136e14ed34a9e343a31c533d78a9813a69a3148332bce5e9821cb2f996e66 \
+    --hash=sha256:110f8b71aacb688ec69062bb7f6938a0f8acb01b7c1c4beb453c65b6d234584d \
+    --hash=sha256:112b06a867b235ef466ed3508ddf0238050df9c727cafb5301ac385b899189a1 \
+    --hash=sha256:17f9ade344e7d9b464a084d69bcf18fc691cb1db67c62ed80820bf4926d78f0e \
+    --hash=sha256:1e254a00cdf42b1e4d5b3d68d33af63268d41340d8885df2ab6470f2e1500147 \
+    --hash=sha256:1e978ec1e8bd0e0e4de6bb75de9d30cbb74db6b6a2bb727618613703ca0167dd \
+    --hash=sha256:25c692919ac5a01f170a3bfcd62d745b24fd095c353d50812637d6fcab442e75 \
+    --hash=sha256:260a5d70215b61ab4fadf5c7baacd64821842975eea312125ed3c39a6391b063 \
+    --hash=sha256:2803abfebfc990042cd494d8ce2d5f82e9d847af6d35ec486923aa19dbad5e73 \
+    --hash=sha256:29a287e0cf63ff528da061de6b9f64a4618da591ca1046aafc54062e40ca7eab \
+    --hash=sha256:29cb7f67d10b479ff07c17d33e39f78c07f71c40ef30d63c153d340e96cd3fb4 \
+    --hash=sha256:3213d622a0283a39a93d188f3cf72b26862df52fbb4ca3697f51705016523d41 \
+    --hash=sha256:33111801a01c12a8a1e3721f0a9232f8cfc8ae2c6b7098167e6f623c6073f402 \
+    --hash=sha256:357cc07a6d7b0b182ff02249616a03742827ebb1277546b5c7cd7f7620a45698 \
+    --hash=sha256:38efbc8de75c7a0fc1ac190162d892787f3f47b57cc291231aafee36b80982b7 \
+    --hash=sha256:4081eb135ac24158bd51cdfbef16f1c64df7063b1143f24731387137c092bec8 \
+    --hash=sha256:40fdc1ae7125e518ea98e53e69a4ebc27e1fd50510c47b7ea130cf21e5e1d42b \
+    --hash=sha256:4cfe66903cc32a9921a6733d96b19bb6abf310397581bbad89c228f5abaf0ee8 \
+    --hash=sha256:511dbaf848decaaaf4b4ca48032619fb3138710c4bf7da7617765edad1ef96b0 \
+    --hash=sha256:55cced7c52e981362f708ad635198e97a752dfba412cc03c23bbf3bd8d5cd662 \
+    --hash=sha256:56b39e5e0622a09a25bf5baf62f4bcf0cb8a41ae6e2819cf49bbc5a74c083f91 \
+    --hash=sha256:5dbbdb29840ca3d91ee0fece42fc29278886d908280bfec0a5846c6f901a3eb0 \
+    --hash=sha256:5f9fb9157b4ce2971008323afe46053787b526ef624fea915b261468a8421a0f \
+    --hash=sha256:6180d8b35af935aed8ece3a85e0a43f87393ae0ac87c8d2c8bd2c993f7270ef3 \
+    --hash=sha256:68a5124b13fa6cc2086764a20005d30bc0548146f7f5322f02fce212ca14317f \
+    --hash=sha256:68bb27509ac1b9a3443094260f6326150663b06abe40b73a2f81160623da5b67 \
+    --hash=sha256:6f41ae150c4e32db4f3310cdaf64b1593a03dbabe29eec77fc9b50fe64061df6 \
+    --hash=sha256:7265a2f3d436e54ef9f2b52b5c937e6be778781bd97a590319d7348f1c1ca997 \
+    --hash=sha256:72fbe16c6fac95aedf5937fa873445cec2110be35d8a4e9433d7501fd98dae6b \
+    --hash=sha256:7d92c3819208a60205a12a245c91ad70cb0a85336659b19b834205573ac8456e \
+    --hash=sha256:8155154c7c691289fe18f510b5d4657c68c67989f293f0535a91360392ff6538 \
+    --hash=sha256:81a1cca95ed5bb92aa8b10dd2cdc9a0d3853a50fad926c28b5d7e8ea54389627 \
+    --hash=sha256:89cd468399cfd2504718f0ba50e410dca55a170b61a02ad92bb18c8a65186e93 \
+    --hash=sha256:8ad03c0965fb3c692200e74d458ca28c1dbb4ce96f9a479a8aa041ad5fabca02 \
+    --hash=sha256:90f9849678c75fe7afa2d348ac842c168b0a4d3d61919687216dfc547976d853 \
+    --hash=sha256:948424b06129ce883307e8cff868c31396d8dc7630a59c61d70d98dbe70f222c \
+    --hash=sha256:9cd5ffd25db4e7ba6a375693b3fc0fc1791ec636c17db3720da19bde7180ec43 \
+    --hash=sha256:a0df0043bdb289bde1f62da130d20df23d58b45429f752bc7a8fc5325a225ecd \
+    --hash=sha256:a2c306dea656c12c68f51f4cea133cbe78ca7435eb28c735eac1d3ebe73be6e8 \
+    --hash=sha256:a7830bab239b79cda9c08c2da014761cafb48da6150e1da17ac06283f43b6089 \
+    --hash=sha256:a7c711e21628b52034bb5ab8d1bce291f752fcc5e92accc615778acee1ff4778 \
+    --hash=sha256:aaf159caa35993cb1f56fb9b8e4610d35758e7ca005412eb1daa856a78c9c4b1 \
+    --hash=sha256:ae506e6902902557576a26ff33eda8695e7ecb3cb36c3b573a0765dee114ebdb \
+    --hash=sha256:b507f5c4c1d508876d1819b6bf9a49d365b96320b5d4993426b33a23ca4b8261 \
+    --hash=sha256:bf162abab1c1a736333192707cef898e735a5ca00f38f27eeedf44b39d9e85eb \
+    --hash=sha256:c1a2af6c6ef86344a6b0db6b97834208bf598db514f2b155042439b62605601a \
+    --hash=sha256:c2d37ab77531417474168eb79d6d80b14f821a966818505d03013d0833edb7a8 \
+    --hash=sha256:c4fc99836233ea196540b17ab0983aff60ed07941751930f5f4d05bc3b3b7359 \
+    --hash=sha256:d581b735e177fdcdce6fed8e7e8880a3fb6ee4e3653a3ac6af01c6f4c03effc5 \
+    --hash=sha256:d6da64deb6b8ed903e7560180a92f2d804ee1ba5eeb849ac2748b8c1aba1f6d7 \
+    --hash=sha256:d8e8286dd7cea7895157318d1b91cdacac64c479f3cbc8dce548331728484751 \
+    --hash=sha256:ddea102b48f9e339f3948bf22040944184627a30fdf7f858667673b9c5f033c8 \
+    --hash=sha256:dfa20cc6ca228e6b155b11da03825975ce66aea520985dbbddf0f2a5a495c605 \
+    --hash=sha256:e3e5193ef5a3dc73bceee50f7fdc2c90dbb76c42df8d8fae3d1067a583df579e \
+    --hash=sha256:e3eeb0aabd6bd5ce64faae67e9935203a6991b4bc2a485a767fbafb2c5125f45 \
+    --hash=sha256:e5805d5a22fd19c8ccff10a9561f9df94436b0545619ea579db2d3c35294bce2 \
+    --hash=sha256:e85b752a1e912b70eaad4fafbd4d1238007ab221de2009b9a2f5ae7461239895 \
+    --hash=sha256:eaf7fa2de5c0be8ae6ff8e9bea2ccd725e980541244521d8d4b5f3354a27babe \
+    --hash=sha256:ebfb099f8dcf083deef3ac1ca4c1503f387cf76296fcb3816b66f5ecb5f54fdb \
+    --hash=sha256:ece3d2cfe132e7d51f44a832b303895e6f2d499c5e74dfbdb06ee246147a304a \
+    --hash=sha256:ed9749eef4cbd126da3dc1d6bcb3a57f5eb7ac6a6484146bdbf743f552dfc577 \
+    --hash=sha256:ede83e07a75dd06bc501566c1eca2afc0d61677c1472ac9ad93fdee6e638a48d \
+    --hash=sha256:ef4aea96ce4d3b074422cb4f2f64e216bf9e213004bb58ecfdf50ea02ea8eb9a \
+    --hash=sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda \
+    --hash=sha256:f407cb6b8e9d6d8c626bc73c945db1706035af8fd632295547bf1c9e46d092d6 \
+    --hash=sha256:f74a575920ab21fe304421a3fc28793d82e299cae9eccb37084e9fc7f3617c20
+    # via opencv-python-headless
+opencv-python-headless==5.0.0.93 \
+    --hash=sha256:030ca5e0837a2963ab36ef896baa9767eb8d2b83353fb28af5a521e40dd8756f \
+    --hash=sha256:09a872a157c1376ab922a69bbf22f9a95bcc7b658a9d8b436a60212b02b2eeb4 \
+    --hash=sha256:10818d91510e05c04568ae12b5cd120779c70c01bf897b001a6221fe430df80f \
+    --hash=sha256:1e55af3abfb462eeeabe5c775f12bdb36216d8a93a3583d69e6bd6e1d6ba7d00 \
+    --hash=sha256:829717b6a95554f273e49e357cee3b3a2a26b6f4842fbc1bed2b45bdd8f87e0e \
+    --hash=sha256:840bd717c21e5c11cadadc022a823315ea417f961213d06b4df010e019eb16f4 \
+    --hash=sha256:b82f9831daab90b725c7c1ee1b36cb5732c367096ac76d119e64e14eb70d5f3c \
+    --hash=sha256:c6bcd96b185975ea240d22cfdb15a1f6d080cc95264cfbe2621f21bb144d89b9 \
+    --hash=sha256:ed709fdf9aa0bd1f2ed8549e71d19449b03a675bb581eb292285f6861953be37
+    # via -r .github/scripts/requirements_dev.in
+pdf2image==1.17.0 \
+    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
+    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
+    # via -r .github/scripts/requirements_dev.in
+pillow==12.3.0 \
+    --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \
+    --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \
+    --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \
+    --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \
+    --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
+    --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \
+    --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \
+    --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \
+    --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \
+    --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
+    --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \
+    --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \
+    --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \
+    --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \
+    --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \
+    --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \
+    --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
+    --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \
+    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
+    --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \
+    --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \
+    --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \
+    --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \
+    --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \
+    --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \
+    --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \
+    --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \
+    --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
+    --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \
+    --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \
+    --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \
+    --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \
+    --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \
+    --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \
+    --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \
+    --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \
+    --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \
+    --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \
+    --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
+    --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \
+    --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \
+    --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \
+    --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \
+    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
+    --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \
+    --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \
+    --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \
+    --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \
+    --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \
+    --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \
+    --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \
+    --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \
+    --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \
+    --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \
+    --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \
+    --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \
+    --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \
+    --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \
+    --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \
+    --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \
+    --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \
+    --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
+    --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
+    --hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \
+    --hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \
+    --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
+    --hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \
+    --hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \
+    --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
+    --hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \
+    --hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \
+    --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
+    --hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \
+    --hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \
+    --hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \
+    --hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \
+    --hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \
+    --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
+    --hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \
+    --hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \
+    --hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \
+    --hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \
+    --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
+    --hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \
+    --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
+    --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \
+    --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
+    # via
+    #   -r .github/scripts/requirements_dev.in
+    #   pdf2image
+    #   weasyprint
+platformdirs==4.10.0 \
+    --hash=sha256:31e761a6a0ca04faf7353ea759bdba55652be214725111e5aac52dfa29d4bef7 \
+    --hash=sha256:fb516cdb12eb0d857d0cd85a7c57cea4d060bee4578d6cf5a14dfdf8cbf8784a
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+    # via -r .github/scripts/requirements_dev.in
+pycparser==3.0 \
+    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+    # via cffi
+pydyf==0.12.1 \
+    --hash=sha256:ea25b4e1fe7911195cb57067560daaa266639184e8335365cc3ee5214e7eaadc \
+    --hash=sha256:fbd7e759541ac725c29c506612003de393249b94310ea78ae44cb1d04b220095
+    # via weasyprint
+pyphen==0.17.2 \
+    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
+    --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
+    # via weasyprint
+python-discovery==1.4.4 \
+    --hash=sha256:5cad33982d412c1f3ffb8f9ca4ea292c9680bca3942451d30b69c37fce53a4a3 \
+    --hash=sha256:abebe9120b43453b68c908acfb1e72a19d1a959ed2cb620ad38fc57d08056dbe
+    # via virtualenv
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via pre-commit
+tinycss2==1.5.1 \
+    --hash=sha256:3415ba0f5839c062696996998176c4a3751d18b7edaaeeb658c9ce21ec150661 \
+    --hash=sha256:d339d2b616ba90ccce58da8495a78f46e55d4d25f9fd71dfd526f07e7d53f957
+    # via
+    #   cssselect2
+    #   weasyprint
+tinyhtml5==2.1.0 \
+    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
+    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
+    # via weasyprint
+unoserver==3.7 \
+    --hash=sha256:b05f9578506ac7374ae1b314c3a79528636c542ac78220a9ce99110584ca424b \
+    --hash=sha256:fc44e6808071c9d2957e705ecf1742cea8a582aa5d5cc23babf36bb332ec6e8e
+    # via -r .github/scripts/requirements_dev.in
+virtualenv==21.6.1 \
+    --hash=sha256:15f978b7cd329f24855ff4a0c4b4899cc7678589f49adbdcbbb4d3232e641128 \
+    --hash=sha256:afe991df855715a2b2f60edfcc0107ef95a79fdfd8cb4cdaa71603d1c12e463b
+    # via pre-commit
+weasyprint==69.0 \
+    --hash=sha256:475951cfd917014de6d4d005caff48c6aa867e7e42b80cd5b16a0484a1609ee6 \
+    --hash=sha256:a7a32f39ca16bd82ef11de99c92ea4b5f14951c9033af035e451ce4f4ee0a88c
+    # via -r .github/scripts/requirements_dev.in
+webencodings==0.5.1 \
+    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
+    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
+    # via
+    #   cssselect2
+    #   tinycss2
+    #   tinyhtml5
+zopfli==0.4.3 \
+    --hash=sha256:0087c9a6f0c8a052be0f6d1a9bb71b6caffdd3e10201d6d6166e28d482cebe6d \
+    --hash=sha256:47604eee5c6704bdf0e94d8391fe3b74ddb2abd84128fbcfdc3ee0fc265feaef \
+    --hash=sha256:62248dbf8dbcbd588ee194b210e5be9fa80bce29641f55599d6d394bd2a9d8a3 \
+    --hash=sha256:628c3e941752880b3491db8d44163d0aedb221944e22a17187ff7fc549b050f6 \
+    --hash=sha256:769875152d0625c46707bcca57d4b2233fe653482067acd55fbf6ec525cb9bdc \
+    --hash=sha256:7e9703ca6e7ef66c8d05e0826b6f558b680c9db8206f84f05a3ee93430a12e42 \
+    --hash=sha256:7fa3c35193475290e3f007bbcdebdbae64ba2f012d75c632da0d727e1da50d5e \
+    --hash=sha256:88f4fbe429aad72bc206275d81fab11a097e0f951a5848d1f51083c37ea73073 \
+    --hash=sha256:921c2c9907f4364963848da5ad194b46d68865e07fdb975d04fd09bc42d47357 \
+    --hash=sha256:d3a50f91a13cea9bafe025de8fd87a005eb26de02a4f0c193127ddbf23ac8ebe \
+    --hash=sha256:d4f51dd1ab5312e837e2091284e0d9f1a138188f2e65812f9a5799dc02c45f94 \
+    --hash=sha256:eb0c9c1d40a8cb1d58762d7e57290ccb753e0828c4d01be8acb59aae5d0ca206 \
+    --hash=sha256:f2e0adcf7d36c6fd0dd36cc771ef7f0c5803a05666feafcd90d7170174a4148e
+    # via fonttools
+
+# The following packages are considered to be unsafe in a requirements file:
+pip==26.1.2 \
+    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
+    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
+    # via -r .github/scripts/requirements_dev.in
+setuptools==83.0.0 \
+    --hash=sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef \
+    --hash=sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3
+    # via -r .github/scripts/requirements_dev.in
@@ -0,0 +1,2 @@
+tomlkit
+tomli-w
@@ -0,0 +1,14 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
+#
+tomli-w==1.2.0 \
+    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
+    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
+    # via -r .github/scripts/requirements_sync_readme.in
+tomlkit==0.15.0 \
+    --hash=sha256:4dbc8f0fc024412b57ced8757ac7461305126a648ff8c2c807fcb8e133a78738 \
+    --hash=sha256:7d1a9ecba3086638211b13814ea79c90dd54dd11993564376f3aa92271f5c7a3
+    # via -r .github/scripts/requirements_sync_readme.in
@@ -4,18 +4,17 @@
 Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
 """

-import base64
 import binascii
-import hashlib
-import json
 import sys
+import json
+import base64
+import hashlib
 from pathlib import Path
-
-from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.exceptions import InvalidSignature

 ART_ROOT = Path(sys.argv[1])
-CONF = Path(sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json")
+CONF = Path(sys.argv[2] if len(sys.argv) > 2 else "frontend/src-tauri/tauri.conf.json")


 def load_pubkey():
@@ -86,7 +86,7 @@ jobs:
              fi
            fi
          else
-            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
+            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
            is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
            if [ "$is_auth" = true ]; then
              should=true
@@ -193,7 +193,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -54,6 +54,7 @@ jobs:
            github.event.comment.user.login == 'Ludy87' ||
            github.event.comment.user.login == 'balazs-szucs' ||
            github.event.comment.user.login == 'reecebrowne' ||
+            github.event.comment.user.login == 'DarioGii' ||
            github.event.comment.user.login == 'EthanHealy01' ||
            github.event.comment.user.login == 'jbrunton96' ||
            github.event.comment.user.login == 'ConnorYoh'
@@ -205,7 +206,7 @@ jobs:
          token: ${{ steps.setup-bot.outputs.token }}

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -241,7 +242,7 @@ jobs:
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -264,7 +265,7 @@ jobs:
        if: needs.check-comment.outputs.enable_prototypes == 'true'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
-          context: .
+          context: ./engine
          file: ./engine/Dockerfile
          push: true
          cache-from: type=gha,scope=stirling-pdf-engine
@@ -31,9 +31,6 @@ jobs:
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
          cache-suffix: ai-engine

      - name: Install Task
@@ -99,14 +96,6 @@ jobs:
          echo "============================================"
          exit 1

-      - name: Build engine production image
-        if: always()
-        run: docker build --file engine/Dockerfile --tag stirling-pdf-engine:ci .
-
-      - name: Build engine development image
-        if: always()
-        run: docker build --file engine/Dockerfile.dev --tag stirling-pdf-engine-dev:ci .
-
      - name: Remove engine check comment on success
        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
        continue-on-error: true
@@ -41,52 +41,35 @@ jobs:

      - name: Check if actor is repo developer
        id: actor
-        env:
-          ACTOR: ${{ github.actor }}
-          BASE_REF: ${{ github.base_ref }}
        run: |
-          if [[ "$ACTOR" == *"[bot]" ]]; then
-            echo "PR opened by a bot - skipping AI title review."
+          if [[ "${{ github.actor }}" == *"[bot]" ]]; then
+            echo "PR opened by a bot – skipping AI title review."
            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
            exit 0
          fi
-          git fetch --quiet origin "$BASE_REF"
-          # Trust list must come from the base ref, never from the PR tree
-          if ! REPO_DEVS_JSON=$(git show "origin/$BASE_REF:.github/config/repo_devs.json" 2>/dev/null); then
-            echo "Error: .github/config/repo_devs.json not found on origin/$BASE_REF" >&2
+          if [ ! -f .github/config/repo_devs.json ]; then
+            echo "Error: .github/config/repo_devs.json not found" >&2
            exit 1
          fi
          # Validate JSON and extract repo_devs
-          REPO_DEVS=$(jq -r '.repo_devs[]' <<< "$REPO_DEVS_JSON" 2>/dev/null || { echo "Error: Invalid JSON in repo_devs.json" >&2; exit 1; })
+          REPO_DEVS=$(jq -r '.repo_devs[]' .github/config/repo_devs.json 2>/dev/null || { echo "Error: Invalid JSON in repo_devs.json" >&2; exit 1; })
          # Convert developer list into Bash array
          mapfile -t DEVS_ARRAY <<< "$REPO_DEVS"
-          if [[ " ${DEVS_ARRAY[*]} " == *" $ACTOR "* ]]; then
+          if [[ " ${DEVS_ARRAY[*]} " == *" ${{ github.actor }} "* ]]; then
            echo "is_repo_dev=true" >> $GITHUB_OUTPUT
          else
            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
          fi

-      - name: Load system prompt from base ref
-        if: steps.actor.outputs.is_repo_dev == 'true'
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: |
-          # System prompt must come from the base ref, never from the PR tree
-          git show "origin/$BASE_REF:.github/config/system-prompt.txt" > "$RUNNER_TEMP/system-prompt.txt"
-
      - name: Get PR diff
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: get_diff
-        env:
-          BASE_REF: ${{ github.base_ref }}
        run: |
-          git fetch origin "$BASE_REF"
-          git diff "origin/$BASE_REF...HEAD" | head -n 10000 | grep -vP '[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x{202E}\x{200B}]' > pr.diff
-          # Random delimiter so diff content cannot forge step outputs
-          DELIM="EOF_$(openssl rand -hex 16)"
-          echo "diff<<$DELIM" >> $GITHUB_OUTPUT
+          git fetch origin ${{ github.base_ref }}
+          git diff origin/${{ github.base_ref }}...HEAD | head -n 10000 | grep -vP '[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x{202E}\x{200B}]' > pr.diff
+          echo "diff<<EOF" >> $GITHUB_OUTPUT
          cat pr.diff >> $GITHUB_OUTPUT
-          echo "$DELIM" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT

      - name: Check and sanitize PR title
        if: steps.actor.outputs.is_repo_dev == 'true'
@@ -107,7 +90,7 @@ jobs:
        uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2.1.1
        with:
          model: openai/gpt-4o
-          system-prompt-file: ${{ runner.temp }}/system-prompt.txt
+          system-prompt-file: ".github/config/system-prompt.txt"
          prompt: |
            Based on the following input data:

@@ -125,11 +108,10 @@ jobs:

      - name: Validate and set SCRIPT_OUTPUT
        if: steps.actor.outputs.is_repo_dev == 'true'
-        env:
-          AI_RESPONSE: ${{ steps.ai-title-analysis.outputs.response }}
-          PR_TITLE: ${{ steps.sanitize_pr_title.outputs.pr_title }}
        run: |
-          printf '%s\n' "$AI_RESPONSE" > ai_response.json
+          cat <<EOF > ai_response.json
+          ${{ steps.ai-title-analysis.outputs.response }}
+          EOF

          # Validate JSON structure
          jq -e '
@@ -167,7 +149,7 @@ jobs:
          echo "### 🤖 AI PR Title Analysis" >> $GITHUB_STEP_SUMMARY
          echo "### Input PR Title" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
-          echo "$PR_TITLE" >> $GITHUB_STEP_SUMMARY
+          echo "${{ steps.sanitize_pr_title.outputs.pr_title }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo '### AI Response (raw JSON)' >> $GITHUB_STEP_SUMMARY
          echo '```json' >> $GITHUB_STEP_SUMMARY
@@ -35,7 +35,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: ${{ matrix.jdk-version }}
          distribution: "temurin"
@@ -192,14 +192,12 @@ jobs:
          retention-days: 3
          if-no-files-found: warn

-      - name: Install uv
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py parses JaCoCo XML through defusedxml to
+        # silence security scanners that pattern-match on the stdlib
+        # xml.etree.ElementTree.parse call.
        if: always() && matrix.flavor == 'saas'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+        run: python -m pip install --quiet defusedxml

      - name: JaCoCo coverage step summary
        # Only the saas leg posts the JUnit summary - it's a strict
@@ -208,7 +206,7 @@ jobs:
        # near-identical tables crowding out the aggregate report.
        if: always() && matrix.flavor == 'saas'
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
@@ -56,7 +56,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -294,7 +294,7 @@ jobs:
        if: always()
        working-directory: frontend
        run: >
-          npx tsx editor/scripts/report-flaky-tests.mts
+          npx tsx scripts/report-flaky-tests.mts
          "${{ github.workspace }}/frontend/playwright-report/results-oauth.json"
          "${{ github.workspace }}/frontend/playwright-report/results-saml.json"
          "${{ github.workspace }}/frontend/playwright-report/results-feature.json"
@@ -329,16 +329,15 @@ jobs:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: ./testing/cucumber/requirements.txt
      - name: Install behave test deps
        run: |
-          uv sync --project engine --locked --group cucumber
+          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
      - name: Build the multi-node image
        working-directory: testing/compose
        run: docker compose -f "$MN_COMPOSE" build
@@ -361,10 +360,10 @@ jobs:
      - name: Run multi-node regression (implemented guarantees)
        working-directory: testing/cucumber
        # -e overrides behave.ini's exclusion of features/multinode; ~@known_gap skips any tracked-gap scenarios.
-        run: uv run --project ../../engine --locked --group cucumber python -m behave features/multinode -e "features/enterprise" --tags="~@known_gap ~@destructive" --no-capture -f plain
+        run: python -m behave features/multinode -e "features/enterprise" --tags="~@known_gap ~@destructive" --no-capture -f plain
      - name: Run multi-node failover (destructive)
        working-directory: testing/cucumber
-        run: uv run --project ../../engine --locked --group cucumber python -m behave features/multinode -e "features/enterprise" --tags="@destructive ~@known_gap" --no-capture -f plain
+        run: python -m behave features/multinode -e "features/enterprise" --tags="@destructive ~@known_gap" --no-capture -f plain
      - name: Dump node logs on failure
        if: failure()
        working-directory: testing/compose
@@ -73,7 +73,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -34,13 +34,10 @@ jobs:
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
          cache-suffix: generated-models

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -21,7 +21,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -22,7 +22,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -6,7 +6,7 @@ on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - ".github/scripts/check_language_toml.py"
      - ".github/workflows/check_toml.yml"

@@ -76,7 +76,7 @@ jobs:
            exit 1
          fi
          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
@@ -166,12 +166,12 @@ jobs:

            // Determine reference file
            let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
+            if (changedFiles.includes("frontend/public/locales/en-US/translation.toml")) {
              console.log("Using PR branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-US/translation.toml",
                ref: branch,
              });

@@ -183,7 +183,7 @@ jobs:
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: repoOwner,
                repo: repoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-US/translation.toml",
                ref: "main",
              });

@@ -195,23 +195,20 @@ jobs:
            console.log(`Reference file path: ${referenceFilePath}`);
            core.exportVariable("REFERENCE_FILE", referenceFilePath);

-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"

      - name: Install Python dependencies
        run: |
-          uv sync --project engine --locked --group tools
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt

      - name: Run Python script to check files
        id: run-check
        run: |
          echo "Running Python script to check TOML files..."
-          uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py \
+          python .github/scripts/check_language_toml.py \
            --actor ${{ github.event.pull_request.user.login }} \
            --reference-file "${REFERENCE_FILE}" \
            --branch "pr-branch" \
@@ -41,7 +41,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -57,13 +57,15 @@ jobs:
            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
            gradle-${{ runner.os }}-${{ runner.arch }}-

-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+
+      - name: Install defusedxml for coverage scripts
+        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
+        # XML through defusedxml - see the script headers for context.
+        run: python -m pip install --quiet defusedxml

      # Pattern matches every artifact this PR's producers might upload:
      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
@@ -156,7 +158,7 @@ jobs:
        # ("how much of the backend do real user flows cover?").
        if: steps.inventory.outputs.found_e2e == 'true'
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
            --github-step-summary
@@ -167,7 +169,7 @@ jobs:
        # is meaningless when one is a strict superset of the other.
        if: steps.inventory.outputs.found_all == 'true'
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
            --github-step-summary
@@ -222,7 +224,7 @@ jobs:
        # generated above) plus whichever frontend artifacts landed.
        # Every input is optional; missing ones render as "-".
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-matrix.py \
+          python scripts/coverage-matrix.py \
            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
            --vitest matrix-inputs/vitest/coverage-summary.json \
@@ -25,7 +25,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: 25
          distribution: temurin
@@ -85,7 +85,7 @@ jobs:
          fi

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -33,7 +33,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -69,17 +69,16 @@ jobs:
          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
          sudo chmod +x /usr/local/bin/docker-compose

-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./testing/cucumber/requirements.txt

-      - name: Install Cucumber and coverage dependencies
+      - name: Pip requirements
        run: |
-          uv sync --project engine --locked --group cucumber --group tools
+          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt

      - name: Extract JaCoCo agent for cucumber coverage
        # Stages build/jacoco/jacocoagent.jar where the coverage override
@@ -122,10 +121,16 @@ jobs:
            echo "report=false" >> "$GITHUB_OUTPUT"
          fi

+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py parses JaCoCo XML through defusedxml -
+        # see the script header for context.
+        if: always() && steps.cucumber-coverage.outputs.report == 'true'
+        run: python -m pip install --quiet defusedxml
+
      - name: Cucumber coverage step summary
        if: always() && steps.cucumber-coverage.outputs.report == 'true'
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
            --title "Cucumber (docker) JaCoCo coverage" \
            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
            --github-step-summary
@@ -21,7 +21,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -93,7 +93,7 @@ jobs:
        # ::warning:: annotations + a job summary; never fails the job.
        if: always()
        working-directory: frontend
-        run: npx tsx editor/scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
+        run: npx tsx scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
      - name: Generate JaCoCo report from e2e:live .exec
@@ -119,18 +119,20 @@ jobs:
            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
            echo "report=false" >> "$GITHUB_OUTPUT"
          fi
-      - name: Install uv
-        if: always()
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Set up Python for coverage summary
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+      - name: Install defusedxml for coverage summary
+        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
+        # to dodge XXE / billion-laughs scanner findings.
+        if: always() && steps.live-coverage.outputs.report == 'true'
+        run: python -m pip install --quiet defusedxml
      - name: e2e:live coverage step summary
        if: always() && steps.live-coverage.outputs.report == 'true'
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
            --title "Playwright (live backend) JaCoCo coverage" \
            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
            --github-step-summary
@@ -153,6 +155,23 @@ jobs:
          retention-days: 7
          if-no-files-found: warn

+      - name: Set up Python for frontend coverage summary
+        # Separate from the backend-coverage python step because the
+        # frontend path doesn't depend on a JaCoCo report - it produces
+        # a summary even on backend failure, as long as some Playwright
+        # tests ran far enough to dump V8 coverage.
+        if: always()
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install defusedxml for frontend coverage summary
+        # Idempotent re-install: the backend-coverage step may have
+        # installed it already, but this leg can run on its own when the
+        # backend report step skips (e.g. .exec missing).
+        if: always()
+        run: python -m pip install --quiet defusedxml
+
      - name: Aggregate Playwright frontend (V8) coverage
        # Rolls per-test V8 dumps from the test-base fixture into one
        # vitest-shaped coverage-summary.json. Tolerates a missing dump
@@ -163,7 +182,7 @@ jobs:
        run: |
          if [ -d .test-state/playwright/coverage-pw ] && \
             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            uv run --project engine --locked --group tools python scripts/playwright-coverage-summary.py \
+            python scripts/playwright-coverage-summary.py \
              .test-state/playwright/coverage-pw \
              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
            echo "summary=true" >> "$GITHUB_OUTPUT"
@@ -175,10 +194,10 @@ jobs:
      - name: Playwright frontend coverage step summary
        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
-          --title "Playwright (live) frontend coverage" \
-          --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-          --github-step-summary
+          python scripts/coverage-summary.py \
+            --title "Playwright (live) frontend coverage" \
+            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
+            --github-step-summary

      - name: Upload Playwright frontend coverage
        # Bundle both the aggregated summary and the raw V8 dumps so
@@ -211,8 +230,8 @@ jobs:
        run: |
          echo "::group::Playwright output dirs"
          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend/editor has
-          # none), so artifacts land under frontend/, not frontend/editor/.
+          # nearest package.json, which is frontend/ (frontend has
+          # none), so artifacts land under frontend/, not frontend/.
          ls -la frontend/playwright-report 2>/dev/null \
            || echo "no playwright-report at frontend/"
          ls -la frontend/test-results 2>/dev/null \
@@ -227,7 +246,7 @@ jobs:
          # test-results/ holds the per-test trace.zip (with browser console
          # logs) + screenshots/video; playwright-report/ is the HTML report.
          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend/editor has none).
+          # package.json, which is frontend/; frontend has none).
          path: |
            frontend/playwright-report/
            frontend/test-results/
@@ -2,8 +2,7 @@ name: Playwright E2E (stubbed)

 # Reusable workflow called from build.yml. Backend-free Playwright suite —
 # fast, no Spring Boot required. Runs against the `stubbed` project which
-# mocks API responses in the browser. Fans out one job per browser
-# (chromium/firefox/webkit) so all three run in parallel on their own runner.
+# mocks API responses in the browser.
 on:
  workflow_call:

@@ -12,19 +11,7 @@ permissions:

 jobs:
  playwright-e2e:
-    name: playwright-e2e (${{ matrix.browser }})
    runs-on: ubuntu-latest
-    strategy:
-      # One browser breaking must not mask a failure in another - report all.
-      fail-fast: false
-      matrix:
-        include:
-          - browser: chromium
-            project: stubbed
-          - browser: firefox
-            project: stubbed-firefox
-          - browser: webkit
-            project: stubbed-webkit
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -40,29 +27,29 @@ jobs:
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
-      - name: Install Playwright (${{ matrix.browser }})
-        run: task e2e:install -- ${{ matrix.browser }}
+      - name: Install Playwright (chromium only)
+        run: task e2e:install -- chromium
      - name: Build frontend (production bundle for vite preview)
        env:
          VITE_BUILD_FOR_PREVIEW: "1"
        run: task frontend:build
-      - name: Run stubbed E2E tests (${{ matrix.browser }})
+      - name: Run stubbed E2E tests (chromium)
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
-        run: task e2e:stubbed-project PROJECT=${{ matrix.project }} -- --workers=3
+        run: task e2e:stubbed -- --workers=3
      - name: Flag flaky tests
        # Runs regardless of the test outcome: a flaky test (passed on retry)
        # leaves the step green, so this is the only place it surfaces. Emits
        # ::warning:: annotations + a job summary; never fails the job.
        if: always()
        working-directory: frontend
-        run: npx tsx editor/scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
+        run: npx tsx scripts/report-flaky-tests.mts "$PLAYWRIGHT_JSON_OUTPUT_FILE"
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: ${{ github.workspace }}/frontend/playwright-report/results.json
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: playwright-report-stubbed-${{ matrix.browser }}-${{ github.run_id }}
+          name: playwright-report-stubbed-${{ github.run_id }}
          path: frontend/playwright-report/
          retention-days: 7
@@ -113,31 +113,31 @@ jobs:
          NPM_CONFIG_IGNORE_SCRIPTS: "true"
        working-directory: frontend
        run: |
-          mkdir -p editor/src/assets
-          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json

      - name: Postprocess with project script (BASE version)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        env:
          PR_IS_FORK: "true"
        run: |
-          node base/frontend/editor/scripts/generate-licenses.js \
-            --input frontend/editor/src/assets/3rdPartyLicenses.json
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json

      - name: Copy postprocessed artifacts back (fork PRs)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        run: |
-          mkdir -p frontend/editor/src/assets
-          if [ -f "base/frontend/editor/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/editor/src/assets/3rdPartyLicenses.json frontend/editor/src/assets/3rdPartyLicenses.json
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
          fi
-          if [ -f "base/frontend/editor/src/assets/license-warnings.json" ]; then
-            cp base/frontend/editor/src/assets/license-warnings.json frontend/editor/src/assets/license-warnings.json
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
          fi

      - name: Check for license warnings
        run: |
-          if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
          else
            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
@@ -185,10 +185,10 @@ jobs:
            echo ""
            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
                echo ""
                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/editor/src/assets/license-warnings.json || true
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
              fi
            else
              echo "✅ **Passed** – no license warnings detected."
@@ -214,7 +214,7 @@ jobs:
              const fs = require('fs');
              let warningDetails = '';
              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/editor/src/assets/license-warnings.json', 'utf8'));
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
              } catch (e) {
                warningDetails = 'Unable to read warning details';
@@ -254,7 +254,7 @@ jobs:
      - name: Commit changes (Push only)
        if: github.event_name == 'push'
        run: |
-          git add frontend/editor/src/assets/3rdPartyLicenses.json
+          git add frontend/src/assets/3rdPartyLicenses.json
          # Note: Do NOT commit license-warnings.json - it's only for PR review
          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV

@@ -272,7 +272,7 @@ jobs:

          The following licenses may require review for corporate compatibility:

-          $(cat frontend/editor/src/assets/license-warnings.json | jq -r '.warnings[].message')
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')

          Please review these licenses to ensure they are acceptable for your use case."
          fi
@@ -345,7 +345,7 @@ jobs:
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -1,8 +1,8 @@
 name: Frontend lint, type-check, and build

 # Reusable workflow called from build.yml when frontend / testing sources
-# change. Runs `task frontend:check:all` and uploads the 
-# coverage + dist artifacts for downstream jobs.
+# change. Runs the consolidated `task frontend:check:all` (lint, types,
+# unit tests, build) and uploads the dist artifact for downstream jobs.
 on:
  workflow_call:

@@ -105,32 +105,44 @@ jobs:
                comment_id: existing.id,
              });
            }
-      - name: Install uv
+      - name: Vitest coverage
+        # Separate from `frontend:check:all` so the quality-gate run stays
+        # uninstrumented (faster signal) and coverage stays an informational
+        # follow-up. Continue-on-error keeps the workflow green even when
+        # a handful of test files refuse to import (e.g. missing icon
+        # specifiers) - the summary still gets posted with whatever
+        # vitest managed to instrument.
+        id: frontend-coverage
+        continue-on-error: true
+        run: task frontend:test:coverage
+      - name: Set up Python for coverage summary
        if: always()
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
+          python-version: "3.12"
+      - name: Install defusedxml for coverage summary
+        # See coverage-summary.py header - it parses XML through defusedxml
+        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
+        if: always()
+        run: python -m pip install --quiet defusedxml
      - name: Vitest coverage step summary
        if: always()
        run: |
-          uv run --project engine --locked --group tools python scripts/coverage-summary.py \
+          python scripts/coverage-summary.py \
            --title "Frontend Vitest coverage" \
-            --vitest frontend/editor/coverage/coverage-summary.json \
+            --vitest frontend/coverage/coverage-summary.json \
            --github-step-summary
      - name: Upload vitest coverage report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-coverage
-          path: frontend/editor/coverage/
+          path: frontend/coverage/
          retention-days: 7
          if-no-files-found: warn
      - name: Upload frontend build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-build
-          path: frontend/editor/dist/
+          path: frontend/dist/
          retention-days: 3
@@ -52,7 +52,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -142,7 +142,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -240,7 +240,7 @@ jobs:
      # before the second setup-java overwrites JAVA_HOME.
      - name: Set up x86_64 JDK 25 (macOS universal JRE)
        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -252,7 +252,7 @@ jobs:

      # Temurin has no windows-aarch64 JDK 25 yet; Microsoft OpenJDK does.
      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}
@@ -441,7 +441,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -454,7 +454,7 @@ jobs:
          }
          EOF
          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
+          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json

      - name: Import release GPG signing key (Linux)
        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -475,7 +475,7 @@ jobs:
          fi

      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -502,9 +502,10 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}
+          updaterJsonKeepUniversal: true

      # Bundled libwayland conflicts with the host's on some distros (Fedora
      # Wayland: EGL_BAD_PARAMETER, blank window - #6878). Repack without it,
@@ -521,7 +522,7 @@ jobs:
          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
        run: |
          set -euo pipefail
-          AI=$(find "$PWD/frontend/editor/src-tauri/target" -name "*.AppImage" | head -1)
+          AI=$(find "$PWD/frontend/src-tauri/target" -name "*.AppImage" | head -1)
          if [ -z "$AI" ]; then echo "No AppImage found - skipping"; exit 0; fi
          chmod +x "$AI"
          WORK=$(mktemp -d)
@@ -578,7 +579,7 @@ jobs:
          # inner exe before packing and the setup exe after, so verifying the setup
          # exe is the arm64 equivalent of the MSI + inner-exe check below.
          if ("${{ matrix.platform }}" -eq "windows-11-arm") {
-            $setupExes = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*-setup.exe" -Recurse -File
+            $setupExes = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*-setup.exe" -Recurse -File
            if ($setupExes.Count -eq 0) {
              Write-Host "[ERROR] No NSIS installer found under target/"
              exit 1
@@ -598,7 +599,7 @@ jobs:
          $allSigned = $true

          # Check MSI installer (outer wrapper - what users download)
-          $msiFiles = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
          if ($msiFiles.Count -eq 0) {
            Write-Host "[ERROR] No MSI found under target/"
            exit 1
@@ -681,7 +682,7 @@ jobs:
          # Absolute dist path so the cd below can't break the copy targets.
          DIST="$GITHUB_WORKSPACE/dist"
          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          echo "=== tauri bundle artifacts ==="
          find . -path "*/bundle/*" \( -name "*.msi" -o -name "*.deb" \
@@ -742,7 +743,7 @@ jobs:
        with:
          sparse-checkout: |
            .github/scripts/verify-updater-signatures.py
-            frontend/editor/src-tauri/tauri.conf.json
+            frontend/src-tauri/tauri.conf.json
          sparse-checkout-cone-mode: false

      - name: Download all Tauri artifacts
@@ -887,17 +888,11 @@ jobs:

      # Gate publish on valid updater sigs. Runs after the review upload (so
      # artifacts survive for debugging) and before action-gh-release.
-      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
      - name: Verify updater signatures
        run: |
-          uv run --project engine --locked --only-group updater-signatures python .github/scripts/verify-updater-signatures.py \
-            ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
+          python3 -m pip install --quiet 'cryptography==44.0.0'
+          python3 .github/scripts/verify-updater-signatures.py \
+            ./artifacts/tauri frontend/src-tauri/tauri.conf.json

      # workflow_dispatch path requires platform=='all' so a single-platform
      # dispatch can't overwrite an existing release's full latest.json with a
@@ -59,10 +59,9 @@ jobs:
  # the story itself — a shared component, a theme token — still surfaces within
  # a day.
  a11y-all-stories:
-    name: a11y (every story, light + dark)
+    name: a11y (every story)
    runs-on: ubuntu-latest
-    # Two full sweeps (one per theme), each ~30 minutes of browser time.
-    timeout-minutes: 120
+    timeout-minutes: 60
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -82,7 +81,7 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

-      - name: a11y gate (every story, light + dark)
+      - name: a11y gate (every story)
        run: task frontend:storybook:a11y

      - name: Upload scan reports
@@ -28,9 +28,6 @@ jobs:
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
          cache-suffix: pre-commit

      - name: Install Task
@@ -50,13 +50,13 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -67,7 +67,7 @@ jobs:
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Convert repository owner to lowercase
        id: repoowner
@@ -75,7 +75,7 @@ jobs:

      - name: Generate tags for base image
        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
@@ -60,7 +60,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -103,20 +103,20 @@ jobs:
          cosign-release: "v2.4.1"

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Convert repository owner to lowercase
        id: repoowner
@@ -125,7 +125,7 @@ jobs:
      - name: Generate tags for latest
        id: meta
        if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -173,7 +173,7 @@ jobs:

      - name: Generate tags for latest-fat
        id: meta-fat
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
@@ -217,7 +217,7 @@ jobs:

      - name: Generate tags for ultra-lite
        id: meta-lite
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
@@ -26,13 +26,13 @@ jobs:
        uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -45,7 +45,7 @@ jobs:
          persist-credentials: false

      - name: "Run analysis"
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif
          results_format: sarif
@@ -34,7 +34,7 @@ jobs:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -84,12 +84,12 @@ jobs:
          body: |
            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot].

-            Regenerates `frontend/editor/src/portal/generated/docsManifest.json`
+            Regenerates `frontend/src/processor/proprietary/generated/docsManifest.json`
            from the Stirling docs repo via `npm run docs:sync`.
          labels: |
            Documentation
            github-actions
            Front End
-          add-paths: frontend/editor/src/portal/generated/docsManifest.json
+          add-paths: frontend/src/processor/proprietary/generated/docsManifest.json
          delete-branch: true
          sign-commits: true
@@ -12,7 +12,7 @@ on:
      - "app/proprietary/build.gradle"
      - "gradle/spotless.gradle"
      - "README.md"
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
      - "scripts/ignore_translation.toml"

@@ -51,25 +51,28 @@ jobs:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+
+      - name: Install Python dependencies
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+
      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true
-          cache-dependency-glob: |
-            engine/pyproject.toml
-            engine/uv.lock
          cache-suffix: sync-files

-      - name: Install Python dependencies
-        run: |
-          uv sync --project engine --locked --group tools
-
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Sync translation TOML files
        run: |
-          uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-US/translation.toml" --branch main

      - name: Sort translation TOML files
        run: |
@@ -77,12 +80,12 @@ jobs:

      - name: Commit translation files
        run: |
-          git add frontend/editor/public/locales/*/translation.toml
+          git add frontend/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

      - name: Sync README.md
        run: |
-          uv run --project engine --locked --group tools python scripts/counter_translation_v3.py
+          python scripts/counter_translation_v3.py

      - name: Run git add
        run: |
@@ -107,7 +110,7 @@ jobs:
            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:

            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
            - Ensured consistency and synchronization across all supported language files.
            - Highlighted any missing or incomplete translations.
            - **Format**: TOML
@@ -132,5 +135,5 @@ jobs:
          sign-commits: true
          add-paths: |
            README.md
-            frontend/editor/public/locales/*/translation.toml
+            frontend/public/locales/*/translation.toml
            scripts/ignore_translation.toml
@@ -152,7 +152,7 @@ jobs:
      - name: Cache Rust build
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
-          workspaces: frontend/editor/src-tauri
+          workspaces: frontend/src-tauri
          # Stable key shared across workflows so the nightly warmer.
          # rust-cache still appends OS + rustc + Cargo.lock.
          shared-key: tauri-${{ matrix.name }}
@@ -162,7 +162,7 @@ jobs:

      - name: Set up x86_64 JDK 25 (macOS universal JRE)
        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -174,7 +174,7 @@ jobs:

      # Temurin has no windows-aarch64 JDK 25 yet; Microsoft OpenJDK does.
      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}
@@ -353,7 +353,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -386,7 +386,7 @@ jobs:

      - name: Build Tauri app (signed)
        if: env.SIGN_BUNDLE == 'true'
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -412,7 +412,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          # Linux: build deb+rpm only here (deb-only on minimal smoke builds).
          # AppImage runs in its own continue-on-error step below so its
@@ -421,7 +421,7 @@ jobs:

      - name: Build Tauri app (unsigned)
        if: env.SIGN_BUNDLE != 'true'
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SIGN: "0"
@@ -432,7 +432,7 @@ jobs:
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          # Linux: build deb+rpm only here (deb-only on minimal smoke builds).
          # AppImage runs in its own continue-on-error step below so its
@@ -447,7 +447,7 @@ jobs:
      - name: Build Tauri app (Linux AppImage)
        if: matrix.platform == 'ubuntu-22.04' && !inputs.minimal
        continue-on-error: true
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SIGN: ${{ (inputs.sign && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
@@ -460,7 +460,7 @@ jobs:
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: --bundles appimage

@@ -472,7 +472,7 @@ jobs:
        continue-on-error: true
        run: |
          set -euo pipefail
-          AI=$(find "$PWD/frontend/editor/src-tauri/target" -name "*.AppImage" | head -1)
+          AI=$(find "$PWD/frontend/src-tauri/target" -name "*.AppImage" | head -1)
          if [ -z "$AI" ]; then echo "No AppImage found - skipping"; exit 0; fi
          chmod +x "$AI"
          WORK=$(mktemp -d)
@@ -509,7 +509,7 @@ jobs:
        if: env.SIGN_BUNDLE == 'true' && matrix.platform == 'macos-15'
        run: |
          echo "🔍 Verifying notarization status..."
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          DMG_FILE=$(find . -name "*.dmg" | head -1)
          if [ -n "$DMG_FILE" ]; then
            echo "Found DMG: $DMG_FILE"
@@ -526,7 +526,7 @@ jobs:
          # Absolute dist path so the cd below can't break the copy targets.
          DIST="$GITHUB_WORKSPACE/dist"
          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
@@ -638,7 +638,7 @@ jobs:
      - name: Verify build artifacts
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Check for expected artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ] || [ "${{ matrix.platform }}" = "windows-11-arm" ]; then
@@ -669,7 +669,7 @@ jobs:
      - name: Test artifact sizes
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
@@ -61,7 +61,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -79,7 +79,7 @@ jobs:
          echo "Disk space after cleanup:" && df -h

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -107,7 +107,7 @@ jobs:
          STIRLING_PDF_DESKTOP_UI: false

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
        id: buildx
@@ -199,7 +199,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
        id: buildx
@@ -33,7 +33,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: "25"
          distribution: "temurin"
@@ -67,7 +67,7 @@ jobs:
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT

      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}
@@ -19,16 +19,12 @@ version.properties
 #### Stirling-PDF Files ###
 pipeline/
 !pipeline/.gitkeep
-# The rule above targets the app's runtime pipeline working dir, but it also
-# matches these Java source dirs; keep the source tracked.
-!app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/
-!app/core/src/test/java/stirling/software/SPDF/controller/api/pipeline/
 customFiles/
 configs/
 watchedFolders/
 # The rule above targets the app's runtime watched-folders working dir, but it
 # also matches this frontend source component dir; keep the source tracked.
-!frontend/editor/src/proprietary/components/watchedFolders/
+!frontend/src/editor/proprietary/components/watchedFolders/
 clientWebUI/
 # Scratch dir used by local fixture-regeneration runs (see
 # app/proprietary/src/test/resources/db-migration-fixtures/README.md).
@@ -178,7 +174,7 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/editor/src-tauri/provisioner/target
+frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -229,7 +225,7 @@ out/
 *.asc

 # Allow test fixture certificates (synthetic, no real credentials)
-!frontend/editor/src/core/tests/test-fixtures/certs/**
+!frontend/src/editor/core/tests/test-fixtures/certs/**

 # SSH Keys
 *.pub
@@ -271,7 +267,7 @@ node_modules/
 *compact*.json
 test_batch.json
 *.backup.*.json
-frontend/editor/public/locales/*/translation.backup*.json
+frontend/public/locales/*/translation.backup*.json

 # Development/build artifacts
 .gradle-cache/
@@ -296,4 +292,4 @@ docs/type3/signatures/
 *.playwright-mcp.png

 # Local screenshot artifacts from *-screenshots.spec.ts
-frontend/editor/screenshots/
+frontend/screenshots/
@@ -15,14 +15,14 @@ testing/compose/validate-mcp-test.sh:curl-auth-header:92
 testing/compose/validate-mcp-test.sh:curl-auth-header:116

 # Storybook example showing curl with a fake Bearer token placeholder (sk_live_a3f8...).
-frontend/editor/src/proprietary/ui/CodeBlock.stories.tsx:curl-auth-header:5
+frontend/src/editor/proprietary/ui/CodeBlock.stories.tsx:curl-auth-header:5

 # Truncated placeholder API key in portal docs example (sk_live_8f2c...e10) - not a real secret.
-frontend/editor/src/portal/components/docs/GettingStartedSection.tsx:generic-api-key:30
+frontend/src/processor/proprietary/components/docs/GettingStartedSection.tsx:generic-api-key:30

 # False positive: generic-api-key matches the Java type name "X509Certificate"
 # in a method signature (CreateSignatureBase.resolveSignatureAlgorithm) - not a secret.
-app/core/src/main/java/stirling/software/SPDF/pdf/signature/CreateSignatureBase.java:generic-api-key:224
+app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java:generic-api-key:224

 # Supabase publishable key (public by design, RLS-protected) used as a CI fallback
 # default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
@@ -1,5 +1,5 @@
 {
  "ignoredFiles": [
-    "frontend/editor/src-tauri/icons/icon.png"
+    "frontend/src-tauri/icons/icon.png"
  ]
 }
@@ -39,7 +39,6 @@ tasks:
  provisioner:
    desc: "Build installer provisioner"
    platforms: [windows]
-    dir: editor
    cmds:
      - node scripts/build-provisioner.mjs

@@ -47,55 +46,48 @@ tasks:
    desc: "Start Tauri desktop dev mode"
    deps: [prepare]
    ignore_error: true
-    dir: editor
    cmds:
      - npx tauri dev --no-watch

  build:
    desc: "Build Tauri desktop app (production)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build

  build:dev:
    desc: "Build Tauri desktop app (dev, no bundling)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --no-bundle

  build:dev:mac:
    desc: "Build Tauri desktop .app bundle (macOS)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'

  build:dev:windows:
    desc: "Build Tauri desktop NSIS installer (Windows)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'

  build:dev:linux:
    desc: "Build Tauri desktop AppImage (Linux)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'

  test:
    desc: "Run Tauri/Cargo tests"
    deps: [prepare]
-    dir: editor/src-tauri
+    dir: src-tauri
    cmds:
      - cargo test

  clean:
    desc: "Clean Tauri/Cargo build artifacts"
-    dir: editor
    cmds:
      - task: jlink:clean
      - cd src-tauri && cargo clean
@@ -117,7 +109,6 @@ tasks:

  jlink:verify:
    desc: "Fail the build if the bundled JRE is older than the app JAR requires"
-    dir: editor
    env:
      REQUIRED_JAVA: "{{.REQUIRED_JAVA}}"
    cmds:
@@ -135,15 +126,15 @@ tasks:
        platforms: [windows]
      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
        platforms: [linux, darwin]
-      - mkdir -p frontend/editor/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/editor/src-tauri/libs/
+      - mkdir -p frontend/src-tauri/libs
+      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
    status:
-      - test -f frontend/editor/src-tauri/libs/stirling-pdf-*.jar
+      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar

  jlink:runtime:
    desc: "Create custom JRE with jlink"
    deps: [jlink:jar]
-    dir: editor/src-tauri
+    dir: src-tauri
    cmds:
      - rm -rf runtime/jre
      - mkdir -p runtime
@@ -202,7 +193,7 @@ tasks:

  jlink:clean:
    desc: "Remove JLink runtime and bundled JARs"
-    dir: editor/src-tauri
+    dir: src-tauri
    cmds:
      - rm -rf libs runtime

@@ -215,7 +206,6 @@ tasks:
    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
    deps: [jlink:jar]
    platforms: [darwin]
-    dir: editor
    env:
      JLINK_MODULES: "{{.JLINK_MODULES}}"
      OUTPUT_DIR: src-tauri/runtime/jre
@@ -3,27 +3,18 @@ version: '3'
 tasks:
  install:
    desc: "Install Playwright browsers"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:install' ]
    cmds:
      - npx playwright install {{.CLI_ARGS}} --with-deps

  stubbed:
    desc: "Run stubbed E2E tests"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=stubbed {{.CLI_ARGS}}

-  stubbed-project:
-    desc: "Run the stubbed E2E suite for a single Playwright project"
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    vars:
-      PROJECT: '{{.PROJECT | default "stubbed"}}'
-    cmds:
-      - npx playwright test --project={{.PROJECT}} {{.CLI_ARGS}}
-
  live:
    desc: "Run live E2E tests"
    summary: |
@@ -91,7 +82,7 @@ tasks:
  live:runner:
    internal: true
    deps: [ ':frontend:prepare' ]
-    dir: frontend/editor
+    dir: frontend
    vars:
      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
    cmds:
@@ -160,14 +151,14 @@ tasks:
      up first with:
        task e2e:oauth:up
        task e2e:saml:up
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=enterprise {{.CLI_ARGS}}

  cross-browser:
    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
@@ -2,49 +2,22 @@ version: '3'

 tasks:
  install:
-    desc: "Install engine runtime and development dependencies"
+    desc: "Install engine dependencies"
    run: once
    cmds:
      - uv python install 3.13.8
-      - uv sync --locked --group engine --group engine-dev
+      - uv sync
    sources:
      - uv.lock
      - pyproject.toml
    status:
      - test -d .venv

-  lock:
-    desc: "Update the engine lockfile from project metadata"
-    cmds:
-      - uv lock
-
-  lock:upgrade:
-    desc: "Upgrade allowed engine dependencies and update the lockfile"
-    cmds:
-      - uv lock --upgrade
-
-  lock:check:
-    desc: "Check whether the engine lockfile is current"
-    cmds:
-      - uv lock --check
-
-  update:
-    desc: "Upgrade engine dependencies and synchronize the environment"
-    cmds:
-      - task: lock:upgrade
-      - uv sync --locked --group engine --group engine-dev
-
-  update:all:
-    desc: "Upgrade all Python dependency groups and synchronize the environment"
-    cmds:
-      - task: lock:upgrade
-      - uv sync --locked --all-groups
-
  prepare:
    desc: "Set up engine .env from template"
    deps: [install]
    cmds:
-      - uv run --locked --group engine --group engine-dev scripts/setup_env.py
+      - uv run scripts/setup_env.py
    sources:
      - scripts/setup_env.py
    generates:
@@ -60,7 +33,7 @@ tasks:
    env:
      PYTHONUNBUFFERED: "1"
    cmds:
-      - uv run --locked --group engine uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"

  dev:
    desc: "Start engine dev server with hot reload"
@@ -72,43 +45,43 @@ tasks:
    env:
      PYTHONUNBUFFERED: "1"
    cmds:
-      - uv run --locked --group engine --group engine-dev uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload

  lint:
    desc: "Run linting"
    deps: [install]
    cmds:
-      - uv run --locked --group engine --group engine-dev ruff check .
+      - uv run ruff check .

  lint:fix:
    desc: "Auto-fix lint issues"
    deps: [install]
    cmds:
-      - uv run --locked --group engine --group engine-dev ruff check . --fix
+      - uv run ruff check . --fix

  format:
    desc: "Auto-fix code formatting"
    deps: [install]
    cmds:
-      - uv run --locked --group engine --group engine-dev ruff format .
+      - uv run ruff format .

  format:check:
    desc: "Check code formatting"
    deps: [install]
    cmds:
-      - uv run --locked --group engine --group engine-dev ruff format . --diff
+      - uv run ruff format . --diff

  typecheck:
    desc: "Run type checking"
    deps: [install]
    cmds:
-      - uv run --locked --group engine --group engine-dev pyright . --warnings
+      - uv run pyright . --warnings

  test:
    desc: "Run tests"
    deps: [prepare]
    cmds:
-      - uv run --locked --group engine --group engine-dev pytest tests
+      - uv run pytest tests

  fix:
    desc: "Auto-fix lint + format"
@@ -129,7 +102,7 @@ tasks:
    desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
    deps: [install, ":backend:swagger"]
    cmds:
-      - uv run --locked --group engine --group engine-dev python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py
+      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py
    sources:
      - ../SwaggerDoc.json
      - scripts/generate_tool_models.py
@@ -141,7 +114,7 @@ tasks:
    desc: "Fail if the committed tool models are out of date"
    deps: [install, ":backend:swagger"]
    cmds:
-      - uv run --locked --group engine --group engine-dev python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py --check
+      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py --io-output src/stirling/models/tool_io.py --check

  clean:
    desc: "Clean build artifacts"
@@ -3,7 +3,7 @@ version: '3'
 # Tasks operate from the workspace root (frontend/). Editor commands pass
 # `editor` as the vite project root (positional after `build` / before the
 # mode flag) or use `--project editor/...` for tsc — so the editor lives
-# under frontend/editor/ without each task needing a cd.
+# under frontend/ without each task needing a cd.

 tasks:
  install:
@@ -26,34 +26,34 @@ tasks:
    vars:
      MODE: '{{.MODE | default ""}}'
    cmds:
-      - npx tsx editor/scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
+      - npx tsx scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
    sources:
-      - editor/scripts/setup-env.mts
+      - scripts/setup-env.mts
    generates:
-      - editor/.env.local
-      - editor/.env{{if .MODE}}.{{.MODE}}{{end}}.local
+      - .env.local
+      - .env{{if .MODE}}.{{.MODE}}{{end}}.local

  prepare:icons:
    internal: true
    run: once
    deps: [install]
    cmds:
-      - node editor/scripts/generate-icons.js
+      - node scripts/generate-icons.js

  prepare:og:
    internal: true
    run: when_changed
    desc: "Regenerate OG/social-preview metadata from the tool registry"
    cmds:
-      - node editor/scripts/generate-og-metadata.mjs
+      - node scripts/generate-og-metadata.mjs
    sources:
-      - editor/src/core/types/toolId.ts
-      - editor/src/core/utils/urlMapping.ts
-      - editor/src/core/data/useTranslatedToolRegistry.tsx
-      - editor/public/og_images/*.png
+      - src/editor/core/types/toolId.ts
+      - src/editor/core/utils/urlMapping.ts
+      - src/editor/core/data/useTranslatedToolRegistry.tsx
+      - public/og_images/*.png
    generates:
-      - editor/src/core/data/ogImageMap.json
-      - editor/public/og-metadata.json
+      - src/editor/core/data/ogImageMap.json
+      - public/og-metadata.json

  prepare:
    desc: "Set up dev environment"
@@ -88,7 +88,7 @@ tasks:
        sh: >-
          {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
    cmds:
-      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
+      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}

  dev:
    desc: "Start frontend dev server"
@@ -143,13 +143,13 @@ tasks:
    desc: "Production build (default mode)"
    deps: [prepare]
    cmds:
-      - npx vite build editor
+      - npx vite build

  build:core:
    desc: "Build for core mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode core
+      - npx vite build --mode core

  build:proprietary:
    desc: "Build for proprietary mode"
@@ -157,7 +157,7 @@ tasks:
    vars:
      PREVIEW: '{{.PREVIEW | default ""}}'
    cmds:
-      - '{{if .PREVIEW}}VITE_BUILD_FOR_PREVIEW=1 {{end}}npx vite build editor --mode proprietary'
+      - '{{if .PREVIEW}}VITE_BUILD_FOR_PREVIEW=1 {{end}}npx vite build --mode proprietary'

  build:saas:
    desc: "Build for SaaS mode"
@@ -165,7 +165,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx vite build editor --mode saas
+      - npx vite build --mode saas

  build:desktop:
    desc: "Build for desktop mode"
@@ -173,13 +173,13 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx vite build editor --mode desktop
+      - npx vite build --mode desktop

  build:prototypes:
    desc: "Build for prototypes mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode prototypes
+      - npx vite build --mode prototypes


  storybook:
@@ -211,13 +211,11 @@ tasks:
      - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}

  storybook:a11y:
-    desc: "a11y regression gate over every story, light and dark: fail only on NEW axe violations"
+    desc: "a11y regression gate over every story: fail only on NEW axe violations"
    deps: [prepare, storybook:browser]
    cmds:
      - node .storybook/a11y-scan.mjs
      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-      - SCAN_THEME=dark node .storybook/a11y-scan.mjs
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json

  storybook:a11y:changed:
    desc: "a11y gate over the stories this branch affects (default base origin/main)"
@@ -246,17 +244,13 @@ tasks:
          fi
          node .storybook/a11y-scan.mjs {{.CHANGED}}
          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-          SCAN_THEME=dark node .storybook/a11y-scan.mjs {{.CHANGED}}
-          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json

  storybook:a11y:record:
-    desc: "Re-record both a11y baselines (run after intentionally fixing/adding violations)"
+    desc: "Re-record the a11y baseline (run after intentionally fixing/adding violations)"
    deps: [prepare, storybook:browser]
    cmds:
      - node .storybook/a11y-scan.mjs
      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record
-      - SCAN_THEME=dark node .storybook/a11y-scan.mjs
-      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record --baseline .storybook/a11y-baseline.dark.json

  # ============================================================
  # Code quality
@@ -266,7 +260,8 @@ tasks:
    desc: "Run linting"
    deps: [install]
    cmds:
-      - task: lint:oxlint
+      - task: lint:eslint
+      - task: lint:dpdm
      - task: lint:colors
      - task: lint:css

@@ -277,35 +272,43 @@ tasks:
      # Covers the whole editor tree, including the portal/processor layer and
      # public/css. Vendored CSS and build output are excluded via ignoreFiles
      # in stylelint.config.mjs.
-      - npx stylelint "editor/**/*.css"
+      - npx stylelint "src/**/*.css"

  lint:colors:
    desc: "Enforce theme tokens — no hardcoded colours or raw primitives in components"
    aliases: [lint:colours]
    deps: [install]
    cmds:
-      - node editor/scripts/lint/theme-lint.mjs
-      - node editor/scripts/lint/theme-lint.mjs css-colors
-      - node editor/scripts/lint/theme-lint.mjs code-colors
-      - node editor/scripts/lint/theme-lint.mjs no-primitives
+      - node scripts/lint/theme-lint.mjs
+      - node scripts/lint/theme-lint.mjs css-colors
+      - node scripts/lint/theme-lint.mjs code-colors
+      - node scripts/lint/theme-lint.mjs no-primitives

  contrast:
    desc: "Report low-contrast theme token pairs (warning only, never blocks)"
    deps: [install]
    cmds:
-      - node editor/scripts/lint/theme-lint.mjs contrast
+      - node scripts/lint/theme-lint.mjs contrast

-  lint:oxlint:
-    desc: "Run oxlint linting"
+  lint:eslint:
+    desc: "Run ESLint linting"
    deps: [install]
    cmds:
-      - npx oxlint --config oxlint.config.ts --max-warnings=0
+      - npx eslint --max-warnings=0
+
+  lint:dpdm:
+    desc: "Run circular import linting"
+    deps: [install]
+    cmds:
+      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
+      # shell-agnostic. Covers the whole editor tree, including the portal layer.
+      - npx dpdm "src/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1

  lint:fix:
    desc: "Auto-fix lint issues"
    deps: [install]
    cmds:
-      - npx oxlint --config oxlint.config.ts --fix
+      - npx eslint --fix

  format:
    desc: "Auto-fix code formatting"
@@ -340,14 +343,14 @@ tasks:
    deps: [prepare]
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/core/tsconfig.json }
+        vars: { PROJECT: src/editor/core/tsconfig.json }

  typecheck:proprietary:
    desc: "Typecheck proprietary build variant"
    deps: [prepare]
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/proprietary/tsconfig.json }
+        vars: { PROJECT: src/editor/proprietary/tsconfig.json }

  typecheck:saas:
    desc: "Typecheck SaaS build variant"
@@ -356,7 +359,7 @@ tasks:
        vars: { MODE: saas }
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/saas/tsconfig.json }
+        vars: { PROJECT: src/editor/saas/tsconfig.json }

  typecheck:desktop:
    desc: "Typecheck desktop build variant"
@@ -365,35 +368,35 @@ tasks:
        vars: { MODE: desktop }
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/desktop/tsconfig.json }
+        vars: { PROJECT: src/editor/desktop/tsconfig.json }

  typecheck:cloud:
    desc: "Typecheck cloud shared layer (standalone)"
    deps: [prepare]
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/cloud/tsconfig.json }
+        vars: { PROJECT: src/editor/cloud/tsconfig.json }

  typecheck:scripts:
    desc: "Typecheck scripts"
    deps: [prepare]
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/scripts/tsconfig.json }
+        vars: { PROJECT: scripts/tsconfig.json }

  typecheck:prototypes:
    desc: "Typecheck prototypes build variant"
    deps: [prepare]
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/prototypes/tsconfig.json }
+        vars: { PROJECT: src/editor/prototypes/tsconfig.json }

  typecheck:portal:
    desc: "Typecheck developer portal build variant"
    deps: [install]
    cmds:
      - task: typecheck:_run
-        vars: { PROJECT: editor/src/portal/tsconfig.json }
+        vars: { PROJECT: src/processor/proprietary/tsconfig.json }

  typecheck:storybook:
    desc: "Typecheck Storybook config and stories"
@@ -430,7 +433,7 @@ tasks:
  og:check:
    desc: "Fail if committed OG/social-preview metadata is out of date"
    cmds:
-      - node editor/scripts/generate-og-metadata.mjs --check
+      - node scripts/generate-og-metadata.mjs --check

  check:all:
    desc: "Full CI quality gate"
@@ -457,29 +460,35 @@ tasks:
  test:editor:
    desc: "Run editor tests"
    deps: [prepare]
-    vars:
-      COVERAGE: '{{.COVERAGE | default .CI | default "false"}}'
    cmds:
-      - >
-        npx vitest run --root editor
-        {{if eq .COVERAGE "true"}}--coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage{{end}}
+      - npx vitest run --root .

  test:watch:
    desc: "Run tests in watch mode"
    deps: [prepare]
    cmds:
-      - npx vitest --watch --root editor
+      - npx vitest --watch --root .

  test:coverage:
    desc: "Run tests with coverage (one-shot; CI-friendly)."
+    deps: [prepare]
    cmds:
-      - task: test:editor
-        vars: { COVERAGE: "true" }
+      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
+      # mode). Explicit reporter list because v8 + json-summary is what the
+      # coverage-summary.py helper consumes; html/text are kept for humans.
+      #
+      # reportsDirectory is pinned to ./coverage relative to vitest's root
+      # (--root .), so output lands at frontend/coverage/. The
+      # CI upload step reads from that path. An earlier attempt with
+      # `./editor/coverage` double-nested into frontend/coverage;
+      # pinning future-proofs against vitest changing the default.
+      - >
+        npx vitest run --root . --coverage
+        --coverage.provider=v8
+        --coverage.reporter=text-summary
+        --coverage.reporter=json-summary
+        --coverage.reporter=html
+        --coverage.reportsDirectory=./coverage

  # ============================================================
  # Code Generation
@@ -489,25 +498,25 @@ tasks:
    desc: "Generate tool API types from the Java OpenAPI spec"
    deps: [install, ":backend:swagger"]
    cmds:
-      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --io-output editor/src/core/types/toolIO.ts
+      - npx tsx scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output src/editor/core/types/toolApiTypes.ts --io-output src/editor/core/types/toolIO.ts
    sources:
-      - editor/scripts/generate-tool-api-types.mts
+      - scripts/generate-tool-api-types.mts
      - ../SwaggerDoc.json
    generates:
-      - editor/src/core/types/toolApiTypes.ts
-      - editor/src/core/types/toolIO.ts
+      - src/editor/core/types/toolApiTypes.ts
+      - src/editor/core/types/toolIO.ts

  tool-models:check:
    desc: "Fail if committed tool API types are out of date"
    deps: [install, ":backend:swagger"]
    cmds:
-      - npx tsx editor/scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output editor/src/core/types/toolApiTypes.ts --io-output editor/src/core/types/toolIO.ts --check
+      - npx tsx scripts/generate-tool-api-types.mts --spec ../SwaggerDoc.json --output src/editor/core/types/toolApiTypes.ts --io-output src/editor/core/types/toolIO.ts --check

  licenses:generate:
    desc: "Generate frontend license report"
    deps: [install]
    cmds:
-      - node editor/scripts/generate-licenses.js
+      - node scripts/generate-licenses.js

  # ============================================================
  # Clean
@@ -516,7 +525,7 @@ tasks:
  clean:
    desc: "Clean build artifacts and caches"
    cmds:
-      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, editor/dist, dist
+      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, dist, dist
        platforms: [windows]
-      - cmd: rm -rf node_modules/.vite editor/dist dist
+      - cmd: rm -rf node_modules/.vite dist dist
        platforms: [linux, darwin]
@@ -21,7 +21,7 @@ vars:
    ':(exclude).devcontainer/*'
    ':(exclude)app/core/src/main/resources/*'
    ':(exclude)app/proprietary/src/main/resources/*'
-    ':(exclude)frontend/editor/public/vendor/*'
+    ':(exclude)frontend/public/vendor/*'
    ':(exclude)*Dockerfile*'
    ':(exclude)*pdfjs*'
    ':(exclude)*thirdParty*'
@@ -39,16 +39,12 @@ vars:
    ':(exclude)*.min.*'
    ':(exclude)*diff.js'
    ':(exclude).github/workflows/*'
-  LOCALE_TOML: 'frontend/editor/public/locales/*/translation.toml'
+  LOCALE_TOML: 'frontend/public/locales/*/translation.toml'

  # gitleaks is pinned + checksum-verified by scripts/pre-commit/install_gitleaks.py,
  # which owns the version and caches the binary here.
  GITLEAKS_BIN: '.task/bin/gitleaks{{if eq OS "windows"}}.exe{{end}}'

-env:
-  # Keep repository-wide checks isolated from the engine runtime environment.
-  UV_PROJECT_ENVIRONMENT: '.venv-pre-commit'
-
 tasks:
  default:
    desc: "Check formatting, spelling, and secrets across the repo"
@@ -80,19 +76,19 @@ tasks:
    desc: "Install the pinned pre-commit Python tools"
    run: once
    cmds:
-      - uv sync --project engine --locked --group pre-commit
+      - uv sync --project scripts/pre-commit --locked
    sources:
-      - engine/uv.lock
-      - engine/pyproject.toml
+      - scripts/pre-commit/uv.lock
+      - scripts/pre-commit/pyproject.toml
    status:
-      - test -d engine/.venv-pre-commit
+      - test -d scripts/pre-commit/.venv

  clean:
-    desc: "Remove the cached gitleaks binary and the pre-commit virtualenv"
+    desc: "Remove the cached gitleaks binary and the tool virtualenv"
    cmds:
-      - cmd: rm -rf engine/.venv-pre-commit .task/bin/gitleaks
+      - cmd: rm -rf scripts/pre-commit/.venv .task/bin/gitleaks
        platforms: [linux, darwin]
-      - cmd: cmd /c "rmdir /s /q engine\.venv-pre-commit & del /q .task\bin\gitleaks.exe"
+      - cmd: cmd /c "rmdir /s /q scripts\pre-commit\.venv & del /q .task\bin\gitleaks.exe"
        platforms: [windows]
        ignore_error: true

@@ -101,26 +97,26 @@ tasks:
  ruff:
    deps: [install]
    cmds:
-      - uv run --project engine --locked --group pre-commit ruff check --isolated --line-length=120 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
+      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})

  ruff-format:
    deps: [install]
    cmds:
-      - uv run --project engine --locked --group pre-commit ruff format --isolated --line-length=120 {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
+      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})

  codespell:
    deps: [install]
    cmds:
-      - uv run --project engine --locked --group pre-commit codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
+      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})

  toml-sort:
    deps: [install]
    cmds:
-      - uv run --project engine --locked --group pre-commit python scripts/pre-commit/sort_locale_toml.py {{if .FIX}}--fix {{end}}{{.LOCALE_TOML}}
+      - uv run --project scripts/pre-commit --no-sync python scripts/pre-commit/sort_locale_toml.py {{if .FIX}}--fix {{end}}{{.LOCALE_TOML}}

  whitespace:
    cmds:
-      - uv run --project engine --locked --group pre-commit python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
+      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}

  gitleaks:
    deps: [gitleaks-bin]
@@ -134,4 +130,4 @@ tasks:
    internal: true
    desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
    cmds:
-      - uv run --project engine --locked --group pre-commit python scripts/pre-commit/install_gitleaks.py
+      - uv run --no-project python scripts/pre-commit/install_gitleaks.py
@@ -2,6 +2,8 @@
  "recommendations": [
    "elagil.pre-commit-helper", // Support for pre-commit hooks to enforce code quality
    "josevseb.google-java-format-for-vs-code", // Google Java code formatter to follow the Google Java Style Guide
+    "ms-python.black-formatter", // Python code formatter using Black
+    "ms-python.flake8", // Flake8 linter for Python to enforce code quality
    "ms-python.python", // Official Microsoft Python extension with IntelliSense, debugging, and Jupyter support
    "ms-vscode-remote.vscode-remote-extensionpack", // Remote Development Pack for SSH, WSL, and Containers
    // "Oracle.oracle-java", // Oracle Java extension with additional features for Java development
@@ -17,7 +19,6 @@
    "yzhang.markdown-all-in-one", // Markdown All-in-One extension for enhanced Markdown editing
    "stylelint.vscode-stylelint", // Stylelint extension for CSS and SCSS linting
    "redhat.vscode-yaml", // YAML extension for Visual Studio Code
-    "tamasfe.even-better-toml", // TOML language support and formatting
-    "oxc.oxc-vscode", // Oxc (oxlint) extension for JavaScript/TypeScript linting
+    "dbaeumer.vscode-eslint", // ESLint extension for TypeScript linting
  ]
 }
@@ -20,9 +20,8 @@
    "editor.defaultFormatter": "vscode.json-language-features"
  },
  "[python]": {
-    "editor.defaultFormatter": "charliermarsh.ruff"
+    "editor.defaultFormatter": "ms-python.black-formatter"
  },
-  "ruff.configuration": "${workspaceFolder}/engine/pyproject.toml",
  "[gradle-kotlin-dsl]": {
    "editor.defaultFormatter": "vscjava.vscode-gradle"
  },
@@ -10,14 +10,14 @@ When adding tools, follow this systematic approach using the established pattern

 Create these files in the correct directories:
 ```
-frontend/editor/src/hooks/tools/[toolName]/
+frontend/src/hooks/tools/[toolName]/
  ├── use[ToolName]Parameters.ts     # Parameter definitions and validation
  └── use[ToolName]Operation.ts      # Tool operation logic using useToolOperation

-frontend/editor/src/components/tools/[toolName]/
+frontend/src/components/tools/[toolName]/
  └── [ToolName]Settings.tsx         # Settings UI component (if needed)

-frontend/editor/src/tools/
+frontend/src/tools/
  └── [ToolName].tsx                 # Main tool component
 ```

@@ -128,7 +128,7 @@ export default [ToolName] as ToolComponent;
 ## 3. Register Tool in System
 Update these files to register your new tool:

-**Tool Registry** (`frontend/editor/src/data/useTranslatedToolRegistry.tsx`):
+**Tool Registry** (`frontend/src/data/useTranslatedToolRegistry.tsx`):
 1. Add imports at the top:
 ```typescript
 import [ToolName] from "../tools/[ToolName]";
@@ -155,7 +155,7 @@ import [ToolName]Settings from "../components/tools/[toolName]/[ToolName]Setting
 ## 4. Add Tooltips (Optional but Recommended)
 Create user-friendly tooltips to help non-technical users understand your tool. **Use simple, clear language - avoid technical jargon:**

-**Tooltip Hook** (`frontend/editor/src/components/tooltips/use[ToolName]Tips.ts`):
+**Tooltip Hook** (`frontend/src/components/tooltips/use[ToolName]Tips.ts`):
 ```typescript
 import { useTranslation } from 'react-i18next';
 import { TooltipContent } from '../../types/tips';
@@ -202,7 +202,7 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.

-**File to update:** `frontend/editor/public/locales/en-US/translation.toml`
+**File to update:** `frontend/public/locales/en-US/translation.toml`

 **Required Translation Keys**:
 ```toml
@@ -139,10 +139,10 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie

 #### Environment Variables
 - All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/editor/.env` — core and shared vars (base, loaded in every mode)
-  - `frontend/editor/.env.proprietary` — proprietary-only vars, e.g. the admin portal's SaaS/account-link keys (layered on top of `.env` in proprietary mode)
-  - `frontend/editor/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/editor/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
+  - `frontend/.env` — core and shared vars (base, loaded in every mode)
+  - `frontend/.env.proprietary` — proprietary-only vars, e.g. the admin portal's SaaS/account-link keys (layered on top of `.env` in proprietary mode)
+  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
+  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
 - These files are committed to Git and must not contain private keys
 - Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
 - Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
@@ -153,9 +153,9 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 #### Import Paths - CRITICAL
 **ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.

-For a broader explanation of the frontend layering and override architecture, read @frontend/editor/DeveloperGuide.md
+For a broader explanation of the frontend layering and override architecture, read @frontend/DeveloperGuide.md

-Before touching colours or theming (tokens, dark mode, accent colours), read @frontend/editor/src/core/theme/README.md — it explains the palette/`--c-*` token system and the rule that literal colours live only in `primitives.css`.
+Before touching colours or theming (tokens, dark mode, accent colours), read @frontend/src/editor/core/theme/README.md — it explains the palette/`--c-*` token system and the rule that literal colours live only in `primitives.css`.

 ```typescript
 // ✅ CORRECT - Use @app/* for all imports
@@ -192,7 +192,7 @@ What goes where:
 - **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
 - **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.

-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (all enforced by the linter). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
+`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.

 Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).

@@ -270,7 +270,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `frontend/editor/src/core/contexts/FileContext.tsx`
+**Location**: `frontend/src/editor/core/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -295,7 +295,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/src/editor/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -383,7 +383,7 @@ return useToolOperation({
 ### Frontend Directory Structure
 The frontend is organized with a clear separation of concerns:

- **`frontend/editor/src/core/`**: Main application code (shared, production-ready components)
+- **`frontend/src/editor/core/`**: Main application code (shared, production-ready components)
  - **`core/components/`**: React components organized by feature
    - `core/components/tools/`: Individual PDF tool implementations
    - `core/components/viewer/`: PDF viewer components
@@ -401,17 +401,17 @@ The frontend is organized with a clear separation of concerns:
  - **`core/data/`**: Static data (tool taxonomy, etc.)
  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)

- **`frontend/editor/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/editor/src/proprietary/`**: Proprietary/licensed features
- **`frontend/editor/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/editor/public/`**: Static assets served directly
+- **`frontend/src/editor/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/src/editor/proprietary/`**: Proprietary/licensed features
+- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/public/`**: Static assets served directly
  - `public/locales/`: Translation JSON files

 ### Component Architecture
- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/editor/public/` (modern)
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/editor/public/locales/` (converted from .properties)
+  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
  - Conversion Script: `scripts/convert_properties_to_json.py`

 ### Configuration Modes
@@ -436,7 +436,7 @@ The frontend is organized with a clear separation of concerns:
 4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
 5. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/editor/public/locales/` or use conversion script
+   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
 6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status
@@ -454,7 +454,7 @@ The frontend is organized with a clear separation of concerns:
 ## Translation Rules

 - **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
- Translation files are located in `frontend/editor/public/locales/`
+- Translation files are located in `frontend/public/locales/`
 - After changing any translation file, run `task pre-commit:fix`

 ## Important Notes
@@ -158,7 +158,7 @@ Stirling-PDF/
 │   │   │   └── locales/       # Internationalization files (JSON)
 │   │   └── vite.config.ts     # Vite configuration
 │   ├── package.json       # Shared workspace dependencies
-│   └── oxlint.config.ts   # Shared lint config
+│   └── eslint.config.mjs  # Shared lint config
 ├── customFiles/           # Custom static files and templates (generated at runtime used to replace existing files)
 ├── docs/                  # Documentation files
 ├── exampleYmlFiles/       # Example YAML configuration files
@@ -458,7 +458,7 @@ For Stirling 2.0, new features are built as React components:

 1. **Create the React Component:**
   ```typescript
-   // frontend/editor/src/tools/NewTool.tsx
+   // frontend/src/tools/NewTool.tsx
   import { useState } from 'react';
   import { Button, FileInput, Container } from '@mantine/core';

@@ -10,20 +10,18 @@ if that directory exists, is licensed under the license defined in "app/propriet
 if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
-* All content that resides under the "frontend/editor/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/proprietary/LICENSE".
-* All content that resides under the "frontend/editor/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/desktop/LICENSE".
-* All content that resides under the "frontend/editor/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/saas/LICENSE".
-* All content that resides under the "frontend/editor/src/cloud/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/cloud/LICENSE".
-* All content that resides under the "frontend/editor/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
-* All content that resides under the "frontend/editor/src/portal/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/portal/LICENSE".
-* All content that resides under the "frontend/editor/src/portal-saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/portal-saas/LICENSE".
+* All content that resides under the "frontend/src/editor/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/editor/proprietary/LICENSE".
+* All content that resides under the "frontend/src/editor/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/editor/desktop/LICENSE".
+* All content that resides under the "frontend/src/editor/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/editor/saas/LICENSE".
+* All content that resides under the "frontend/src/editor/cloud/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/editor/cloud/LICENSE".
+* All content that resides under the "frontend/src/editor/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/editor/prototypes/LICENSE".
+* All content that resides under the "frontend/src/processor/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/processor/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.

@@ -86,7 +86,7 @@ If you're using Tauri's built-in updater feature:

 ## Configuration Files

-### 1. Tauri Configuration (frontend/editor/src-tauri/tauri.conf.json)
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)

 The Windows signing configuration is already set up:

@@ -10,7 +10,7 @@ dependencies {
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
    api "org.apache.commons:commons-lang3:${commonsLang3}"
-    api 'com.drewnoakes:metadata-extractor:2.21.0' // Image metadata extractor
+    api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor
    api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
@@ -21,8 +21,8 @@ dependencies {
    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
-    api 'org.simplejavamail:simple-java-mail:9.2.0'
-    api 'org.simplejavamail:outlook-module:9.2.0' // MSG file support
+    api 'org.simplejavamail:simple-java-mail:8.12.6'
+    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
    api 'jakarta.mail:jakarta.mail-api:2.1.5'
    runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'

@@ -1,4 +1,4 @@
-package stirling.software.common.util;
+package org.apache.pdfbox.examples.util;

 import java.io.File;
 import java.io.IOException;
@@ -1,6 +1,5 @@
 package stirling.software.common.config.swagger;

-import java.lang.reflect.Method;
 import java.util.Arrays;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -19,7 +18,6 @@ import stirling.software.common.model.tool.ToolFormat;
 import stirling.software.common.model.tool.ToolIO;
 import stirling.software.common.model.tool.ToolIOCase;
 import stirling.software.common.model.tool.ToolIOWhen;
-import stirling.software.common.service.ToolIOParameterDefaults;

 /**
 * Publishes each {@link ToolIO} into the spec as {@code x-stirling-io}, which is how the frontend
@@ -51,42 +49,40 @@ public class ToolIOOperationCustomizer
        if (declaration == null) {
            return operation;
        }
-        operation.addExtension(EXTENSION_NAME, toExtension(declaration, handlerMethod.getMethod()));
+        operation.addExtension(EXTENSION_NAME, toExtension(declaration));
        operation.setDescription(appendSummaryLine(operation.getDescription(), declaration));
        return operation;
    }

-    private static Map<String, Object> toExtension(ToolIO declaration, Method handler) {
+    private static Map<String, Object> toExtension(ToolIO declaration) {
        Map<String, Object> extension = new LinkedHashMap<>();
        extension.put("accepts", names(declaration.accepts()));
        extension.put("produces", declaration.produces().name());
        extension.put("arity", declaration.arity().name());
        if (declaration.cases().length > 0) {
-            extension.put("cases", cases(declaration, handler));
+            extension.put("cases", cases(declaration));
        }
        return extension;
    }

-    private static List<Map<String, Object>> cases(ToolIO declaration, Method handler) {
-        return Arrays.stream(declaration.cases()).map(rule -> toCase(rule, handler)).toList();
+    private static List<Map<String, Object>> cases(ToolIO declaration) {
+        return Arrays.stream(declaration.cases()).map(ToolIOOperationCustomizer::toCase).toList();
    }

-    private static Map<String, Object> toCase(ToolIOCase rule, Method handler) {
+    private static Map<String, Object> toCase(ToolIOCase rule) {
        Map<String, Object> entry = new LinkedHashMap<>();
-        entry.put("when", Arrays.stream(rule.when()).map(c -> toCondition(c, handler)).toList());
+        entry.put(
+                "when",
+                Arrays.stream(rule.when()).map(ToolIOOperationCustomizer::toCondition).toList());
        entry.put("produces", rule.produces().name());
        entry.put("arity", rule.arity().name());
        return entry;
    }

-    private static Map<String, Object> toCondition(ToolIOWhen condition, Method handler) {
+    private static Map<String, Object> toCondition(ToolIOWhen condition) {
        Map<String, Object> entry = new LinkedHashMap<>();
        entry.put("param", condition.param());
        entry.put("matches", List.of(condition.matches()));
-        // The default the endpoint uses when this parameter is absent, so a step that never sends
-        // it still resolves. Omitted when the parameter is required with none.
-        ToolIOParameterDefaults.resolve(handler, condition.param())
-                .ifPresent(value -> entry.put("default", value));
        return entry;
    }

@@ -1046,8 +1046,6 @@ public class ApplicationProperties {

        // 'https://app.example.com'). If not set, falls back to backendUrl.
        private boolean enableMobileScanner = true; // Enable mobile phone QR code upload feature
-        private boolean enableMobileSignature =
-                true; // Enable drawing signatures on a phone via QR code
        private MobileScannerSettings mobileScannerSettings = new MobileScannerSettings();
        private ServerCertificate serverCertificate = new ServerCertificate();

@@ -1106,13 +1104,6 @@ public class ApplicationProperties {
        @Data
        public static class Encryption {
            private boolean enabled = false;
-
-            /**
-             * Emit an audit event for every decrypt of an encrypted blob. Compliance reviewers
-             * (HIPAA) expect read audit, so it defaults on; busy multi-user installs can disable.
-             * Denied decrypts and key lifecycle events are always audited regardless.
-             */
-            private boolean auditReads = true;
        }

        @Data
@@ -5,18 +5,13 @@ import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;

 /** The runtime form of a {@link ToolIO} declaration, read off a handler method once at startup. */
 public record ToolIOSpec(
        Set<ToolFormat> accepts, ToolFormat produces, ToolArity arity, List<Case> cases) {

-    /**
-     * @param paramDefault the value used when the parameter is absent, or null when it has no
-     *     default - an absent parameter then leaves the case unresolved rather than defaulted.
-     */
-    public record When(String param, List<String> matches, String paramDefault) {
+    public record When(String param, List<String> matches) {

        boolean holdsFor(Object value) {
            String normalised = normalise(value);
@@ -24,14 +19,6 @@ public record ToolIOSpec(
        }
    }

-    /** Supplies the default value a request parameter takes when a caller omits it. */
-    @FunctionalInterface
-    public interface ParameterDefaults {
-        Optional<String> defaultFor(String param);
-
-        ParameterDefaults NONE = param -> Optional.empty();
-    }
-
    /**
     * Both sides of a condition are normalised at comparison, not at construction: the declaration
     * reaches the frontend and the engine as published data, and normalising only one side there
@@ -57,33 +44,25 @@ public record ToolIOSpec(
    }

    public static ToolIOSpec from(ToolIO annotation) {
-        return from(annotation, ParameterDefaults.NONE);
-    }
-
-    public static ToolIOSpec from(ToolIO annotation, ParameterDefaults defaults) {
        return new ToolIOSpec(
                new LinkedHashSet<>(Arrays.asList(annotation.accepts())),
                annotation.produces(),
                annotation.arity(),
-                Arrays.stream(annotation.cases()).map(rule -> toCase(rule, defaults)).toList());
+                Arrays.stream(annotation.cases()).map(ToolIOSpec::toCase).toList());
    }

-    private static Case toCase(ToolIOCase rule, ParameterDefaults defaults) {
-        List<When> when = Arrays.stream(rule.when()).map(c -> toWhen(c, defaults)).toList();
+    private static Case toCase(ToolIOCase rule) {
+        List<When> when = Arrays.stream(rule.when()).map(ToolIOSpec::toWhen).toList();
        return new Case(when, rule.produces(), rule.arity());
    }

-    private static When toWhen(ToolIOWhen condition, ParameterDefaults defaults) {
-        return new When(
-                condition.param(),
-                List.of(condition.matches()),
-                defaults.defaultFor(condition.param()).orElse(null));
+    private static When toWhen(ToolIOWhen condition) {
+        return new When(condition.param(), List.of(condition.matches()));
    }

    /**
-     * First matching {@link Case} wins. A parameter the caller omitted resolves to its declared
-     * default; only a parameter with no default leaves the output uncertain, since an unseen value
-     * might then have picked another branch.
+     * First matching {@link Case} wins. If none match but one reads a parameter we cannot see, the
+     * declared output comes back uncertain: a value we never saw might have picked another branch.
     *
     * @param parameters the step's configured parameters, or null when not known
     */
@@ -92,17 +71,12 @@ public record ToolIOSpec(
        for (Case rule : cases) {
            boolean allHold = true;
            for (When condition : rule.when()) {
-                Object value;
-                if (parameters != null && parameters.containsKey(condition.param())) {
-                    value = parameters.get(condition.param());
-                } else if (condition.paramDefault() != null) {
-                    value = condition.paramDefault();
-                } else {
+                if (parameters == null || !parameters.containsKey(condition.param())) {
                    sawUnknownParam = true;
                    allHold = false;
                    continue;
                }
-                allHold &= condition.holdsFor(value);
+                allHold &= condition.holdsFor(parameters.get(condition.param()));
            }
            if (allHold) {
                return new Output(rule.produces(), rule.arity(), true);
@@ -17,6 +17,7 @@ import java.util.concurrent.Semaphore;
 import java.util.function.Consumer;

 import org.apache.pdfbox.Loader;
+import org.apache.pdfbox.examples.util.DeletingRandomAccessFile;
 import org.apache.pdfbox.io.IOUtils;
 import org.apache.pdfbox.io.MemoryUsageSetting;
 import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
@@ -30,7 +31,6 @@ import org.springframework.web.multipart.MultipartFile;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.api.PDFFile;
-import stirling.software.common.util.DeletingRandomAccessFile;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.TempFileManager;

@@ -89,22 +89,13 @@ public class MobileScannerService {
     *
     * @param sessionId Unique session identifier
     * @param files Files to upload
-     * @throws IllegalArgumentException If the session is unknown or expired
     * @throws IOException If file storage fails
     */
    public void uploadFiles(String sessionId, List<MultipartFile> files) throws IOException {
        validateSessionId(sessionId);

-        // Uploads only land in a session a desktop client actually created, never conjure one
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null
-                || System.currentTimeMillis() > session.getLastAccessTime() + SESSION_TIMEOUT_MS) {
-            if (session != null) {
-                deleteSession(sessionId);
-            }
-            log.warn("Rejected mobile scanner upload for unknown session: {}", sessionId);
-            throw new IllegalArgumentException("Session not found or expired");
-        }
+        SessionData session =
+                activeSessions.computeIfAbsent(sessionId, id -> new SessionData(sessionId));

        // Create session directory
        Path sessionDir = getSafeSessionDirectory(sessionId);
@@ -5,7 +5,6 @@ import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.UnknownHostException;
-import java.util.List;
 import java.util.Locale;
 import java.util.regex.Pattern;

@@ -156,7 +155,8 @@ public class SsrfProtectionService {
                    return false;
                }

-                if (config.isBlockCloudMetadata() && isCloudMetadataAddress(address)) {
+                if (config.isBlockCloudMetadata()
+                        && isCloudMetadataAddress(address.getHostAddress())) {
                    log.debug("URL blocked - cloud metadata endpoint: {}", url);
                    return false;
                }
@@ -189,15 +189,16 @@ public class SsrfProtectionService {
            }

            byte[] bytes = addr6.getAddress();
-            // Local-use NAT64 (64:ff9b:1::/48) is internal whatever IPv4 it embeds
-            if (isNat64LocalUsePrefix(bytes)) {
-                return true;
-            }
-
-            for (String ipv4 : extractEmbeddedIpv4(bytes)) {
-                if (isPrivateIPv4Range(ipv4)) {
-                    return true;
-                }
+            if (isIpv4MappedAddress(bytes)) {
+                String ipv4 =
+                        (bytes[12] & 0xff)
+                                + "."
+                                + (bytes[13] & 0xff)
+                                + "."
+                                + (bytes[14] & 0xff)
+                                + "."
+                                + (bytes[15] & 0xff);
+                return isPrivateIPv4Range(ipv4);
            }

            int firstByte = bytes[0] & 0xff;
@@ -210,79 +211,18 @@ public class SsrfProtectionService {
        return false;
    }

-    /**
-     * Extracts the IPv4 addresses wrapped by IPv6 transition formats so they can be classified by
-     * the IPv4 rules. The wrapping prefixes are globally routable, so only the extracted IPv4
-     * decides whether the destination is internal.
-     */
-    private List<String> extractEmbeddedIpv4(byte[] addr) {
-        if (addr == null || addr.length != 16) {
-            return List.of();
+    private boolean isIpv4MappedAddress(byte[] addr) {
+        if (addr.length != 16) {
+            return false;
        }
-
-        // ::ffff:w.x.y.z, ::w.x.y.z and well-known NAT64 64:ff9b::/96 all embed at bytes 12-15
-        if (isIpv4MappedOrCompatibleAddress(addr) || isNat64WellKnownPrefix(addr)) {
-            return List.of(toIpv4String(addr, 12, false));
-        }
-
-        // 6to4 (2002::/16) embeds the tunnel endpoint IPv4 at bytes 2-5
-        if ((addr[0] & 0xff) == 0x20 && (addr[1] & 0xff) == 0x02) {
-            return List.of(toIpv4String(addr, 2, false));
-        }
-
-        // Teredo (2001::/32) embeds the server IPv4 at bytes 4-7 and the client IPv4 inverted at
-        // bytes 12-15
-        if ((addr[0] & 0xff) == 0x20 && (addr[1] & 0xff) == 0x01 && addr[2] == 0 && addr[3] == 0) {
-            return List.of(toIpv4String(addr, 4, false), toIpv4String(addr, 12, true));
-        }
-
-        return List.of();
-    }
-
-    private String toIpv4String(byte[] addr, int offset, boolean inverted) {
-        int mask = inverted ? 0xff : 0x00;
-        return ((addr[offset] ^ mask) & 0xff)
-                + "."
-                + ((addr[offset + 1] ^ mask) & 0xff)
-                + "."
-                + ((addr[offset + 2] ^ mask) & 0xff)
-                + "."
-                + ((addr[offset + 3] ^ mask) & 0xff);
-    }
-
-    private boolean isIpv4MappedOrCompatibleAddress(byte[] addr) {
        for (int i = 0; i < 10; i++) {
            if (addr[i] != 0) {
                return false;
            }
        }
-        // ::ffff:w.x.y.z is IPv4-mapped, ::w.x.y.z is the deprecated IPv4-compatible form
-        return (addr[10] == (byte) 0xff && addr[11] == (byte) 0xff)
-                || (addr[10] == 0 && addr[11] == 0);
-    }
-
-    private boolean isNat64WellKnownPrefix(byte[] addr) {
-        if (!hasNat64Prefix(addr)) {
-            return false;
-        }
-        for (int i = 4; i < 12; i++) {
-            if (addr[i] != 0) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    private boolean isNat64LocalUsePrefix(byte[] addr) {
-        return hasNat64Prefix(addr) && addr[4] == 0 && addr[5] == 1;
-    }
-
-    private boolean hasNat64Prefix(byte[] addr) {
-        return addr.length == 16
-                && addr[0] == 0
-                && (addr[1] & 0xff) == 0x64
-                && (addr[2] & 0xff) == 0xff
-                && (addr[3] & 0xff) == 0x9b;
+        // For IPv4-mapped IPv6 addresses, bytes 10 and 11 must be 0xff (i.e., address is
+        // ::ffff:w.x.y.z)
+        return addr[10] == (byte) 0xff && addr[11] == (byte) 0xff;
    }

    private boolean isPrivateIPv4Range(String ip) {
@@ -320,17 +260,6 @@ public class SsrfProtectionService {
        return false;
    }

-    private boolean isCloudMetadataAddress(InetAddress address) {
-        if (address instanceof Inet6Address addr6) {
-            for (String ipv4 : extractEmbeddedIpv4(addr6.getAddress())) {
-                if (isCloudMetadataAddress(ipv4)) {
-                    return true;
-                }
-            }
-        }
-        return isCloudMetadataAddress(address.getHostAddress());
-    }
-
    private boolean isCloudMetadataAddress(String ip) {
        String normalizedIp = normalizeIpv4MappedAddress(ip);
        // Cloud metadata endpoints for AWS, GCP, Azure, Oracle Cloud, and IBM Cloud
@@ -1,92 +0,0 @@
-package stirling.software.common.service;
-
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
-import java.lang.reflect.Parameter;
-import java.util.Optional;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.NotNull;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * The value a request parameter takes when the caller omits it, read from the request model so a
- * {@code @ToolIOCase} can be resolved even for a step that never sends the parameter it branches
- * on. The default is read from the field so it cannot drift.
- */
-@Slf4j
-public final class ToolIOParameterDefaults {
-
-    // Swagger's sentinel for an unset @Schema string member; not a real default value.
-    private static final String SCHEMA_UNSET = "##default";
-
-    private ToolIOParameterDefaults() {}
-
-    /**
-     * The default {@code param} resolves to when absent, or empty when the parameter is required
-     * with no declared default - in which case an unset value leaves the output genuinely unknown
-     * rather than defaulted, and the chain reports it as uncertain.
-     *
-     * <p>Precedence: an explicit {@code @Schema(defaultValue)}, then the field's own value (a
-     * primitive's language default, or an initializer), then the empty string for an optional field
-     * left null, and finally empty for a required field with none of the above.
-     */
-    public static Optional<String> resolve(Method handler, String param) {
-        for (Parameter parameter : handler.getParameters()) {
-            Field field = findField(parameter.getType(), param);
-            if (field != null) {
-                return fromField(parameter.getType(), field);
-            }
-        }
-        return Optional.empty();
-    }
-
-    private static Optional<String> fromField(Class<?> owner, Field field) {
-        Schema schema = field.getAnnotation(Schema.class);
-        if (schema != null
-                && !schema.defaultValue().isEmpty()
-                && !SCHEMA_UNSET.equals(schema.defaultValue())) {
-            return Optional.of(schema.defaultValue());
-        }
-        Object value = readField(owner, field);
-        if (value != null) {
-            return Optional.of(String.valueOf(value));
-        }
-        return isRequired(field, schema) ? Optional.empty() : Optional.of("");
-    }
-
-    private static Object readField(Class<?> owner, Field field) {
-        try {
-            Object instance = owner.getDeclaredConstructor().newInstance();
-            field.setAccessible(true);
-            return field.get(instance);
-        } catch (ReflectiveOperationException | RuntimeException e) {
-            // A request model we cannot instantiate leaves the default unknown, which the check
-            // treats conservatively as uncertain. Never break startup over it.
-            log.warn("Could not read default of {}.{}", owner.getSimpleName(), field.getName(), e);
-            return null;
-        }
-    }
-
-    private static boolean isRequired(Field field, Schema schema) {
-        if (schema != null && schema.requiredMode() == Schema.RequiredMode.REQUIRED) {
-            return true;
-        }
-        return field.isAnnotationPresent(NotNull.class)
-                || field.isAnnotationPresent(NotBlank.class);
-    }
-
-    private static Field findField(Class<?> type, String name) {
-        for (Class<?> c = type; c != null && c != Object.class; c = c.getSuperclass()) {
-            try {
-                return c.getDeclaredField(name);
-            } catch (NoSuchFieldException ignored) {
-                // Try the superclass; request models extend a shared file-input base.
-            }
-        }
-        return null;
-    }
-}
@@ -67,10 +67,7 @@ public class ToolIORegistry implements ToolMetadataService, ToolIOSource {
        if (annotation == null) {
            return;
        }
-        Method method = handler.getMethod();
-        ToolIOSpec spec =
-                ToolIOSpec.from(
-                        annotation, param -> ToolIOParameterDefaults.resolve(method, param));
+        ToolIOSpec spec = ToolIOSpec.from(annotation);
        for (String pattern : extractPatterns(info)) {
            target.put(pattern, spec);
        }
@@ -1,67 +0,0 @@
-package stirling.software.common.util;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.regex.Pattern;
-
-/**
- * Neutralises CSV formula injection (CWE-1236) so spreadsheets treat untrusted cells as text.
- *
- * <p>Apply at CSV write time only; applying it on read would add a fresh apostrophe every round
- * trip.
- */
-public final class CsvUtils {
-
-    // Leading characters a spreadsheet may read as the start of a formula.
-    private static final String FORMULA_TRIGGERS = "=+-@\t\r";
-
-    // Real numbers must pass through untouched or extracted tables stop summing.
-    private static final Pattern NUMERIC_PATTERN =
-            Pattern.compile(
-                    "^[+-]?[$£¥€₹]?"
-                            + "(?:(?:\\d+|\\d{1,3}(?:,\\d{3})+)(?:\\.\\d+)?|\\.\\d+)"
-                            + "(?:[eE][+-]?\\d+)?"
-                            + "[%‰]?[$£¥€₹]?\\s*$");
-
-    // A run of hyphens is a common "no value" placeholder and cannot be a formula.
-    private static final Pattern DASH_PLACEHOLDER_PATTERN = Pattern.compile("^-+\\s*$");
-
-    private CsvUtils() {}
-
-    /**
-     * Prefix a single apostrophe when the value starts with a formula trigger character.
-     *
-     * @param value the cell value about to be written, may be null
-     * @return the value, prefixed only when a spreadsheet could evaluate it as a formula
-     */
-    public static String neutraliseFormula(String value) {
-        if (value == null || value.isEmpty()) {
-            return value;
-        }
-        if (FORMULA_TRIGGERS.indexOf(value.charAt(0)) < 0) {
-            return value;
-        }
-        if (NUMERIC_PATTERN.matcher(value).matches()
-                || DASH_PLACEHOLDER_PATTERN.matcher(value).matches()) {
-            return value;
-        }
-        return "'" + value;
-    }
-
-    /**
-     * Apply {@link #neutraliseFormula(String)} to every cell of a row about to be written.
-     *
-     * @param row the row of cell values, may be null
-     * @return a new list with each cell neutralised, or null when the row is null
-     */
-    public static List<String> neutraliseRow(List<String> row) {
-        if (row == null) {
-            return null;
-        }
-        List<String> neutralised = new ArrayList<>(row.size());
-        for (String cell : row) {
-            neutralised.add(neutraliseFormula(cell));
-        }
-        return neutralised;
-    }
-}
@@ -194,7 +194,7 @@ public class EmlParser {
        }
        attachment.setFilename(filename);

-        String contentId = embedded ? stripCid(resource.getContentId()) : null;
+        String contentId = embedded ? stripCid(resourceName) : null;
        attachment.setContentId(contentId);

        String detectedContentType = EmlProcessingUtils.detectMimeType(filename, contentType);
@@ -23,7 +23,6 @@ import org.springframework.web.multipart.MultipartFile;

 import com.fathzer.soft.javaluator.DoubleEvaluator;

-import io.github.pixee.security.Filenames;
 import io.github.pixee.security.HostValidator;
 import io.github.pixee.security.Urls;

@@ -122,9 +121,6 @@ public class GeneralUtils {
     *   <li>Fresh Matcher instances ensure thread safety
     * </ul>
     *
-     * <p>Any directory component is stripped first, so attacker-supplied upload names cannot leak
-     * path traversal into derived names such as zip entries.
-     *
     * @param filename the filename to process, may be null
     * @return filename without extension, or "default" if input is null
     */
@@ -137,20 +133,18 @@ public class GeneralUtils {
            return filename;
        }

-        String simpleName = Filenames.toSimpleFileName(filename);
-
-        int dotIndex = simpleName.lastIndexOf('.');
-        if (dotIndex > 0 && dotIndex < simpleName.length() - 1) {
-            return simpleName.substring(0, dotIndex);
+        int dotIndex = filename.lastIndexOf('.');
+        if (dotIndex > 0 && dotIndex < filename.length() - 1) {
+            return filename.substring(0, dotIndex);
        }

-        if (dotIndex == 0 || dotIndex == simpleName.length() - 1 || dotIndex == -1) {
-            return simpleName;
+        if (dotIndex == 0 || dotIndex == filename.length() - 1 || dotIndex == -1) {
+            return filename;
        }

        Pattern pattern = patternCache.getPattern(RegexPatternUtils.getExtensionRegex());
-        Matcher matcher = pattern.matcher(simpleName);
-        return matcher.find() ? matcher.replaceFirst("") : simpleName;
+        Matcher matcher = pattern.matcher(filename);
+        return matcher.find() ? matcher.replaceFirst("") : filename;
    }

    /**
@@ -3,12 +3,10 @@ package stirling.software.common.util;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 import java.util.Set;
-import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 import java.util.zip.ZipOutputStream;
@@ -54,24 +52,9 @@ public class OfficeDocumentSanitizer {
                    "odt", "ott", "ods", "ots", "odp", "otp", "odg", "otg", "odf", "odc", "odi",
                    "odm");

-    // Flat (uncompressed) OpenDocument: a single XML file rather than a zip container.
-    private static final Set<String> FLAT_XML_EXTENSIONS =
-            Set.of("fodt", "fods", "fodp", "fodg", "fodm");
-
    private static final Set<String> ODF_XML_PARTS =
            Set.of("content.xml", "styles.xml", "meta.xml", "settings.xml");

-    // Markers that make an unparseable XML part too dangerous to hand to LibreOffice unsanitized.
-    // Namespace declarations legitimately contain http URLs, so match reference
-    // attributes and non-web schemes rather than any URL-looking text.
-    private static final Pattern EXTERNAL_REFERENCE_MARKER =
-            Pattern.compile(
-                    "targetmode\\s*=\\s*[\"']?\\s*external"
-                            + "|href\\s*=\\s*[\"']?\\s*(?:https?|ftp|file|smb):"
-                            + "|\\b(?:file|smb):/"
-                            + "|\\\\\\\\\\w",
-                    Pattern.CASE_INSENSITIVE);
-
    private final SsrfProtectionService ssrfProtectionService;
    private final ApplicationProperties applicationProperties;

@@ -87,9 +70,7 @@ public class OfficeDocumentSanitizer {
            return false;
        }
        String lower = extension.toLowerCase(Locale.ROOT);
-        return OOXML_EXTENSIONS.contains(lower)
-                || ODF_EXTENSIONS.contains(lower)
-                || FLAT_XML_EXTENSIONS.contains(lower);
+        return OOXML_EXTENSIONS.contains(lower) || ODF_EXTENSIONS.contains(lower);
    }

    public byte[] sanitize(byte[] documentBytes, String extension) throws IOException {
@@ -103,36 +84,6 @@ public class OfficeDocumentSanitizer {
        if (!isSanitizableExtension(extension)) {
            return documentBytes;
        }
-        if (FLAT_XML_EXTENSIONS.contains(extension.toLowerCase(Locale.ROOT))) {
-            return sanitizeFlatXml(documentBytes);
-        }
-        return sanitizeZipContainer(documentBytes);
-    }
-
-    // Flat XML has no container to fall back on, so a parse failure must fail closed.
-    public byte[] sanitizeFlatXml(byte[] documentBytes) throws IOException {
-        if (documentBytes == null || documentBytes.length == 0) {
-            throw new IOException("Office document input is empty or null");
-        }
-        if (applicationProperties.getSystem().isDisableSanitize()) {
-            log.debug("Office document sanitization disabled by configuration");
-            return documentBytes;
-        }
-        try {
-            return sanitizeOdfXml(documentBytes);
-        } catch (ParserConfigurationException | SAXException | TransformerException e) {
-            throw new IOException("Failed to sanitize flat XML office document", e);
-        }
-    }
-
-    public byte[] sanitizeZipContainer(byte[] documentBytes) throws IOException {
-        if (documentBytes == null || documentBytes.length == 0) {
-            throw new IOException("Office document input is empty or null");
-        }
-        if (applicationProperties.getSystem().isDisableSanitize()) {
-            log.debug("Office document sanitization disabled by configuration");
-            return documentBytes;
-        }

        ByteArrayOutputStream out = new ByteArrayOutputStream(documentBytes.length);
        try (ZipInputStream zipIn =
@@ -166,7 +117,7 @@ public class OfficeDocumentSanitizer {
        return out.toByteArray();
    }

-    private byte[] sanitizeEntry(String entryName, byte[] entryBytes) throws IOException {
+    private byte[] sanitizeEntry(String entryName, byte[] entryBytes) {
        String lower = entryName.toLowerCase(Locale.ROOT);
        try {
            if (lower.endsWith(".rels")) {
@@ -179,14 +130,6 @@ public class OfficeDocumentSanitizer {
                | SAXException
                | IOException
                | TransformerException e) {
-            // An unparseable part carrying an external reference must not reach LibreOffice.
-            if (containsExternalReferenceMarker(entryBytes)) {
-                throw new IOException(
-                        "Unparseable XML part '"
-                                + entryName
-                                + "' contains an external reference and cannot be sanitized",
-                        e);
-            }
            log.warn(
                    "Failed to parse XML part '{}' for sanitization, leaving as-is: {}",
                    entryName,
@@ -195,11 +138,6 @@ public class OfficeDocumentSanitizer {
        return entryBytes;
    }

-    private boolean containsExternalReferenceMarker(byte[] entryBytes) {
-        String raw = new String(entryBytes, StandardCharsets.ISO_8859_1);
-        return EXTERNAL_REFERENCE_MARKER.matcher(raw).find();
-    }
-
    private boolean isOdfXmlPart(String lowerName) {
        int slash = lowerName.lastIndexOf('/');
        String base = slash >= 0 ? lowerName.substring(slash + 1) : lowerName;
@@ -6,11 +6,6 @@ public class RequestUriUtils {

    private static final Pattern SHARE_LINK_PATTERN = Pattern.compile("^/share/[^/]+/?$");

-    // Only the phone side of the QR pairing is anonymous: it checks the session, then uploads.
-    // Every other mobile-scanner path is desktop-side and stays behind authentication.
-    private static final Pattern MOBILE_SCANNER_PUBLIC_PATTERN =
-            Pattern.compile("^/api/v1/mobile-scanner/(?:upload|validate-session)/[a-zA-Z0-9-]+/?$");
-
    public static boolean isStaticResource(String requestURI) {
        return isStaticResource("", requestURI);
    }
@@ -61,10 +56,8 @@ public class RequestUriUtils {
            return true;
        }

-        // Mobile pages reached by scanning a QR code (peer-to-peer, no backend auth
-        // needed): /mobile-scanner uploads photos, /mobile-sign draws a signature.
-        if (normalizedUri.startsWith("/mobile-scanner")
-                || normalizedUri.startsWith("/mobile-sign")) {
+        // Mobile scanner page for QR code-based file uploads (peer-to-peer, no backend auth needed)
+        if (normalizedUri.startsWith("/mobile-scanner")) {
            return true;
        }

@@ -207,8 +200,8 @@ public class RequestUriUtils {
                || trimmedUri.startsWith("/healthz")
                || trimmedUri.startsWith("/liveness")
                || trimmedUri.startsWith("/readiness")
-                // Phone-side mobile scanner/signature calls only (see pattern above)
-                || MOBILE_SCANNER_PUBLIC_PATTERN.matcher(trimmedUri).matches()
+                || trimmedUri.startsWith(
+                        "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
                || trimmedUri.startsWith("/api/v1/webhooks/")
                || trimmedUri.startsWith("/v1/api-docs")
                // Workflow participant endpoints - access controlled by share tokens, not login
@@ -156,28 +156,12 @@ class MobileScannerServiceTest {
        }

        @Test
-        @DisplayName("rejects uploads to a session no desktop client registered")
-        void rejectsUnknownSession() {
-            assertThrows(
-                    IllegalArgumentException.class,
-                    () -> service.uploadFiles("new-session", List.of(file("a.txt", "data"))));
+        @DisplayName("auto-creates a session when uploading to an unregistered session ID")
+        void autoCreatesSession() throws IOException {
+            service.uploadFiles("new-session", List.of(file("a.txt", "data")));

-            assertTrue(service.getSessionFiles("new-session").isEmpty());
-            assertFalse(Files.exists(tempDir.resolve("new-session")));
-        }
-
-        @Test
-        @DisplayName("rejects uploads to an expired session and clears it")
-        void rejectsExpiredSession() {
-            service.createSession("stale");
-            forceLastAccess("stale", System.currentTimeMillis() - (20 * 60 * 1000L));
-
-            assertThrows(
-                    IllegalArgumentException.class,
-                    () -> service.uploadFiles("stale", List.of(file("a.txt", "data"))));
-
-            assertNull(service.validateSession("stale"));
-            assertFalse(Files.exists(tempDir.resolve("stale")));
+            List<FileMetadata> metas = service.getSessionFiles("new-session");
+            assertEquals(1, metas.size());
        }

        @Test
@@ -303,67 +303,5 @@ class SsrfProtectionServiceTest {
        void blocksIpv4MappedPrivate() {
            assertThat(service.isUrlAllowed("http://[::ffff:10.0.0.1]")).isFalse();
        }
-
-        @Test
-        @DisplayName("blocks IPv4-compatible ::a.b.c.d of a private address")
-        void blocksIpv4CompatiblePrivate() {
-            // ::a00:1 is ::10.0.0.1
-            assertThat(service.isUrlAllowed("http://[::a00:1]")).isFalse();
-        }
-    }
-
-    @Nested
-    @DisplayName("MEDIUM level - IPv6 transition addresses wrapping IPv4")
-    class MediumIpv6Transition {
-
-        @BeforeEach
-        void medium() {
-            config.setEnabled(true);
-            config.setLevel(SsrfProtectionLevel.MEDIUM);
-        }
-
-        @ParameterizedTest
-        @ValueSource(
-                strings = {
-                    "http://[64:ff9b::a00:1]", // NAT64 well-known wrapping 10.0.0.1
-                    "http://[64:ff9b::7f00:1]", // NAT64 well-known wrapping 127.0.0.1
-                    "http://[64:ff9b::a9fe:a9fe]", // NAT64 well-known wrapping 169.254.169.254
-                    "http://[2002:c0a8:5::1]", // 6to4 wrapping 192.168.0.5
-                    "http://[2002:a9fe:a9fe::1]", // 6to4 wrapping 169.254.169.254
-                    "http://[2001:0:a00:1::]", // Teredo server 10.0.0.1
-                    "http://[2001:0:4136:e378:8000:63bf:3f57:fffa]" // Teredo client 192.168.0.5
-                })
-        @DisplayName("blocks transition addresses wrapping an internal IPv4")
-        void blocksWrappedInternalIpv4(String url) {
-            assertThat(service.isUrlAllowed(url)).isFalse();
-        }
-
-        @Test
-        @DisplayName("blocks the local-use NAT64 prefix 64:ff9b:1::/48 outright")
-        void blocksNat64LocalUsePrefix() {
-            assertThat(service.isUrlAllowed("http://[64:ff9b:1::1]")).isFalse();
-            assertThat(service.isUrlAllowed("http://[64:ff9b:1:ffff::5db8:d822]")).isFalse();
-        }
-
-        @ParameterizedTest
-        @ValueSource(
-                strings = {
-                    "http://[64:ff9b::5db8:d822]", // NAT64 well-known wrapping 93.184.216.34
-                    "http://[2002:5db8:d822::1]", // 6to4 wrapping 93.184.216.34
-                    "http://[2001:0:4136:e378:8000:63bf:3fff:fdd2]", // Teredo, both IPv4s public
-                    "http://[2001:db8::1]" // documentation prefix, not Teredo
-                })
-        @DisplayName("allows transition addresses wrapping a public IPv4")
-        void allowsWrappedPublicIpv4(String url) {
-            assertThat(service.isUrlAllowed(url)).isTrue();
-        }
-
-        @Test
-        @DisplayName("blocks cloud metadata behind 6to4 even with private-network checks off")
-        void blocksMetadataBehindSixToFour() {
-            config.setBlockPrivateNetworks(false);
-            config.setBlockLinkLocal(false);
-            assertThat(service.isUrlAllowed("http://[2002:a9fe:a9fe::1]")).isFalse();
-        }
    }
 }
@@ -101,12 +101,7 @@ class ToolChainValidatorConformanceTest {
                for (JsonNode match : condition.get("matches")) {
                    matches.add(match.asString());
                }
-                JsonNode paramDefault = condition.get("default");
-                when.add(
-                        new ToolIOSpec.When(
-                                condition.get("param").asString(),
-                                matches,
-                                paramDefault == null ? null : paramDefault.asString()));
+                when.add(new ToolIOSpec.When(condition.get("param").asString(), matches));
            }
            cases.add(
                    new ToolIOSpec.Case(
@@ -1,94 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import java.util.Arrays;
-import java.util.List;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.ValueSource;
-
-class CsvUtilsTest {
-
-    @ParameterizedTest
-    @ValueSource(
-            strings = {
-                "=cmd|'/c calc'!A1",
-                "=1+1",
-                "@SUM(A1)",
-                "+cmd|'/c calc'!A1",
-                "-2+3+cmd|'/c calc'!A1",
-                "\t=1+1",
-                "\r=1+1",
-                "\tSUM(A1)",
-                "=HYPERLINK(\"http://evil\",\"click\")",
-                "@",
-                "="
-            })
-    void testNeutraliseFormula_dangerousValuesArePrefixed(String value) {
-        assertEquals("'" + value, CsvUtils.neutraliseFormula(value));
-    }
-
-    @ParameterizedTest
-    @ValueSource(
-            strings = {
-                "-12.50",
-                "+3",
-                "-1,234.00",
-                "-12%",
-                "-$4",
-                "1e-5",
-                "-1e-5",
-                "-0",
-                "-.5",
-                "+1,000",
-                "-1234567",
-                "-12.50 ",
-                "-£4.99",
-                "-4€"
-            })
-    void testNeutraliseFormula_numbersAreUnchanged(String value) {
-        assertEquals(value, CsvUtils.neutraliseFormula(value));
-    }
-
-    @ParameterizedTest
-    @ValueSource(strings = {"-", "--", "---"})
-    void testNeutraliseFormula_dashPlaceholdersAreUnchanged(String value) {
-        assertEquals(value, CsvUtils.neutraliseFormula(value));
-    }
-
-    @ParameterizedTest
-    @ValueSource(strings = {"Alice", "30", "hello=world", " =1+1", "a-b", "1-2", "(1,234.00)"})
-    void testNeutraliseFormula_harmlessValuesAreUnchanged(String value) {
-        assertEquals(value, CsvUtils.neutraliseFormula(value));
-    }
-
-    @Test
-    void testNeutraliseFormula_nullAndEmpty() {
-        assertNull(CsvUtils.neutraliseFormula(null));
-        assertEquals("", CsvUtils.neutraliseFormula(""));
-    }
-
-    @Test
-    void testNeutraliseFormula_isNotIdempotentOnAlreadyPrefixedValue() {
-        // A prefixed value no longer starts with a trigger, so apostrophes cannot stack
-        String once = CsvUtils.neutraliseFormula("=1+1");
-        assertEquals("'=1+1", once);
-        assertEquals(once, CsvUtils.neutraliseFormula(once));
-    }
-
-    @Test
-    void testNeutraliseRow_prefixesOnlyDangerousCells() {
-        List<String> row = Arrays.asList("Total", "-1,234.00", "=1+1", null);
-
-        List<String> result = CsvUtils.neutraliseRow(row);
-
-        assertEquals(Arrays.asList("Total", "-1,234.00", "'=1+1", null), result);
-    }
-
-    @Test
-    void testNeutraliseRow_nullRow() {
-        assertNull(CsvUtils.neutraliseRow(null));
-    }
-}
@@ -221,29 +221,7 @@ public class GeneralUtilsTest {

        // Test multiple dots
        assertEquals("file.with.multiple", GeneralUtils.removeExtension("file.with.multiple.dots"));
-        // Directory components are stripped, only the base name is kept
-        assertEquals("file", GeneralUtils.removeExtension("path/to/file.ext"));
-    }
-
-    @Test
-    void testRemoveExtensionStripsPathTraversal() {
-        assertEquals("passwd", GeneralUtils.removeExtension("../../../etc/passwd.txt"));
-        assertEquals("evil", GeneralUtils.removeExtension("/absolute/path/evil.pdf"));
-        assertEquals("passwd", GeneralUtils.removeExtension("....//....//etc/passwd.txt"));
-
-        // No result may carry a separator that a zip entry could use to escape its directory
-        for (String traversal :
-                new String[] {
-                    "../../evil.pdf",
-                    "..\\..\\evil.pdf",
-                    "dir/../../evil.pdf",
-                    "/etc/cron.d/payload",
-                    "a/b/c"
-                }) {
-            String result = GeneralUtils.removeExtension(traversal);
-            assertFalse(result.contains("/"), "Result should not contain '/': " + result);
-            assertFalse(result.contains("\\"), "Result should not contain '\\': " + result);
-        }
+        assertEquals("path/to/file", GeneralUtils.removeExtension("path/to/file.ext"));
    }

    @Test
@@ -440,7 +418,6 @@ public class GeneralUtilsTest {
        // Test complex cases
        assertEquals(
                "complex.file.name", GeneralUtils.getTitleFromFilename("complex.file.name.txt"));
-        // Directory components are stripped, only the base name is kept
-        assertEquals("file", GeneralUtils.getTitleFromFilename("path/to/file.ext"));
+        assertEquals("path/to/file", GeneralUtils.getTitleFromFilename("path/to/file.ext"));
    }
 }
@@ -61,20 +61,6 @@ class OfficeDocumentSanitizerTest {
                    + "<draw:frame><draw:image xlink:href=\"Pictures/image1.png\" xlink:type=\"simple\"/></draw:frame>"
                    + "</office:text></office:body></office:document-content>";

-    private static final String FLAT_ODF_EXTERNAL =
-            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
-                    + "<office:document"
-                    + " xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\""
-                    + " xmlns:draw=\"urn:oasis:names:tc:opendocument:xmlns:drawing:1.0\""
-                    + " xmlns:xlink=\"http://www.w3.org/1999/xlink\""
-                    + " office:mimetype=\"application/vnd.oasis.opendocument.text\">"
-                    + "<office:body><office:text>"
-                    + "<draw:frame><draw:image xlink:href=\""
-                    + EXTERNAL_URL
-                    + "\" xlink:type=\"simple\"/></draw:frame>"
-                    + "<draw:frame><draw:image xlink:href=\"Pictures/image1.png\"/></draw:frame>"
-                    + "</office:text></office:body></office:document>";
-
    private SsrfProtectionService ssrfProtectionService;
    private ApplicationProperties applicationProperties;
    private OfficeDocumentSanitizer sanitizer;
@@ -95,11 +81,6 @@ class OfficeDocumentSanitizerTest {
        assertTrue(sanitizer.isSanitizableExtension("odt"));
        assertTrue(sanitizer.isSanitizableExtension("ods"));
        assertTrue(sanitizer.isSanitizableExtension("odp"));
-        assertTrue(sanitizer.isSanitizableExtension("fodt"));
-        assertTrue(sanitizer.isSanitizableExtension("FODS"));
-        assertTrue(sanitizer.isSanitizableExtension("fodp"));
-        assertTrue(sanitizer.isSanitizableExtension("fodg"));
-        assertTrue(sanitizer.isSanitizableExtension("fodm"));
        assertFalse(sanitizer.isSanitizableExtension("pdf"));
        assertFalse(sanitizer.isSanitizableExtension("html"));
        assertFalse(sanitizer.isSanitizableExtension(""));
@@ -362,78 +343,6 @@ class OfficeDocumentSanitizerTest {
        assertTrue(out.contains("#anchor"));
    }

-    @Test
-    void sanitize_unparseablePartWithExternalReferenceFailsClosed() throws IOException {
-        // DOCTYPE makes the part unparseable; it must not slip past sanitization.
-        String poisonedRels =
-                "<?xml version=\"1.0\"?><!DOCTYPE Relationships SYSTEM \"http://evil.example/x.dtd\">"
-                        + "<Relationships><Relationship Id=\"rId1\" Target=\""
-                        + EXTERNAL_URL
-                        + "\" TargetMode=\"External\"/></Relationships>";
-        Map<String, byte[]> entries = new LinkedHashMap<>();
-        entries.put("word/_rels/document.xml.rels", poisonedRels.getBytes(StandardCharsets.UTF_8));
-        byte[] docx = zip(entries);
-
-        assertThrows(IOException.class, () -> sanitizer.sanitize(docx, "docx"));
-    }
-
-    @Test
-    void sanitize_unparseablePartWithoutExternalReferencePassesThrough() throws IOException {
-        byte[] broken = "<content><item>unclosed</content>".getBytes(StandardCharsets.UTF_8);
-        Map<String, byte[]> entries = new LinkedHashMap<>();
-        entries.put("content.xml", broken);
-        byte[] odt = zip(entries);
-
-        byte[] cleaned = sanitizer.sanitize(odt, "odt");
-
-        Map<String, byte[]> result = unzip(cleaned);
-        assertArrayEquals(broken, result.get("content.xml"));
-    }
-
-    @Test
-    void sanitize_flatOdfStripsExternalHrefButKeepsInternal() throws IOException {
-        byte[] fodt = FLAT_ODF_EXTERNAL.getBytes(StandardCharsets.UTF_8);
-
-        String cleaned = new String(sanitizer.sanitize(fodt, "fodt"), StandardCharsets.UTF_8);
-
-        assertFalse(cleaned.contains(EXTERNAL_URL), "External xlink:href should be stripped");
-        assertTrue(cleaned.contains("Pictures/image1.png"), "Internal href should be preserved");
-    }
-
-    @Test
-    void sanitizeFlatXml_stripsExternalHref() throws IOException {
-        String cleaned =
-                new String(
-                        sanitizer.sanitizeFlatXml(
-                                FLAT_ODF_EXTERNAL.getBytes(StandardCharsets.UTF_8)),
-                        StandardCharsets.UTF_8);
-
-        assertFalse(cleaned.contains(EXTERNAL_URL));
-    }
-
-    @Test
-    void sanitizeFlatXml_unparseableInputThrows() {
-        byte[] withDoctype =
-                ("<?xml version=\"1.0\"?><!DOCTYPE office:document SYSTEM"
-                                + " \"http://evil.example/x.dtd\"><office:document/>")
-                        .getBytes(StandardCharsets.UTF_8);
-
-        assertThrows(IOException.class, () -> sanitizer.sanitizeFlatXml(withDoctype));
-    }
-
-    @Test
-    void sanitizeZipContainer_stripsExternalRelationshipWithoutExtensionHint() throws IOException {
-        Map<String, byte[]> entries = new LinkedHashMap<>();
-        entries.put("word/_rels/document.xml.rels", DOCX_RELS.getBytes(StandardCharsets.UTF_8));
-        byte[] docx = zip(entries);
-
-        Map<String, byte[]> result = unzip(sanitizer.sanitizeZipContainer(docx));
-
-        String rels =
-                new String(result.get("word/_rels/document.xml.rels"), StandardCharsets.UTF_8);
-        assertFalse(rels.contains(EXTERNAL_URL));
-    }
-
    private static byte[] zip(Map<String, byte[]> entries) throws IOException {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        try (ZipOutputStream zos = new ZipOutputStream(baos)) {
@@ -73,13 +73,6 @@ class RequestUriUtilsTest {
        assertTrue(RequestUriUtils.isStaticResource("/mobile-scanner"));
    }

-    @Test
-    void testIsStaticResource_mobileSignPath() {
-        // The phone-side signature drawing page, reached from the Sign tool QR code.
-        assertTrue(RequestUriUtils.isStaticResource("/mobile-sign"));
-        assertTrue(RequestUriUtils.isStaticResource("/app", "/app/mobile-sign"));
-    }
-
    @Test
    void testIsStaticResource_portalShell() {
        // The admin portal SPA shell (/processor) is served pre-auth so it's directly navigable.
@@ -190,55 +183,6 @@ class RequestUriUtilsTest {
        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/api/v1/webhooks/whk_abc123", "/app"));
    }

-    // --- mobile scanner / mobile signature QR pairing ---
-
-    @Test
-    void testIsPublicAuthEndpoint_mobileScannerPhoneEndpoints() {
-        // The phone has no login: it validates the QR session, then uploads to it.
-        assertTrue(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/validate-session/2f1c9a3b-4d5e", ""));
-        assertTrue(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/upload/2f1c9a3b-4d5e", ""));
-        assertTrue(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/app/api/v1/mobile-scanner/upload/2f1c9a3b-4d5e", "/app"));
-    }
-
-    @Test
-    void testIsPublicAuthEndpoint_mobileScannerDesktopEndpointsProtected() {
-        // Desktop calls these through the authenticated api client - they must not be anonymous
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/create-session/abc-123", ""));
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint("/api/v1/mobile-scanner/files/abc-123", ""));
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/download/abc-123/scan.jpg", ""));
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint("/api/v1/mobile-scanner/session/abc-123", ""));
-    }
-
-    @Test
-    void testIsPublicAuthEndpoint_mobileScannerCraftedPathsNotPublic() {
-        // A prefix match on the public paths must not smuggle in a download
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/upload/../download/abc-123/scan.jpg", ""));
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/upload/abc-123/../../download/abc-123/scan.jpg",
-                        ""));
-        assertFalse(
-                RequestUriUtils.isPublicAuthEndpoint(
-                        "/api/v1/mobile-scanner/validate-session/abc-123/files", ""));
-        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/api/v1/mobile-scanner/upload", ""));
-        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/api/v1/mobile-scanner/uploads/abc", ""));
-        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/api/v1/mobile-scanner/", ""));
-    }
-
    @Test
    void testIsPublicAuthEndpoint_withContextPath() {
        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/login", "/app"));
@@ -156,7 +156,7 @@ if (buildWithPortal) {
 }
 // Workspace root holds package.json and node_modules (shared across editor /
 // future portal). Editor-specific paths (src, public, dist, tauri) live one
-// level deeper under frontend/editor/.
+// level deeper under frontend/.

 // Vite mode: -PprototypesMode > -PfrontendMode > enableSaas > disableAdditional > proprietary.
 def frontendModeOverride = project.findProperty('frontendMode')?.toString()?.toLowerCase()
@@ -176,11 +176,11 @@ def frontendBuildTask = "frontend:build:${frontendMode}"

 // Workspace root holds package.json and node_modules (shared across editor /
 // future portal). Editor-specific paths (src, public, dist, tauri) live one
-// level deeper under frontend/editor/. When the portal lands as an embedded
+// level deeper under frontend/. When the portal lands as an embedded
 // app, add a sibling frontendPortalDir / frontendPortalDistDir alongside.
 def frontendDir = file('../../frontend')
-def frontendEditorDir = file('../../frontend/editor')
-def frontendEditorDistDir = file('../../frontend/editor/dist')
+def frontendEditorDir = file('../../frontend')
+def frontendEditorDistDir = file('../../frontend/dist')
 def resourcesStaticDir = file('src/main/resources/static')
 def generatedFrontendPaths = [
    'assets',
@@ -312,9 +312,8 @@ tasks.register('cleanFrontendAssets', Delete) {
    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
    // Prerendered per-route SPA pages (e.g. compress.html) carry per-tool OG tags and are
    // copied from the frontend build. Remove stale ones so renamed/removed tools don't linger.
-    // api-landing.html, mobile-upload.html and mobile-sign.html are real backend source files,
-    // not generated artifacts.
-    delete fileTree(dir: resourcesStaticDir, includes: ['*.html'], excludes: ['api-landing.html', 'mobile-upload.html', 'mobile-sign.html'])
+    // api-landing.html and mobile-upload.html are real backend source files, not generated artifacts.
+    delete fileTree(dir: resourcesStaticDir, includes: ['*.html'], excludes: ['api-landing.html', 'mobile-upload.html'])
    // Nested prerendered route pages (e.g. settings/people.html)
    delete new File(resourcesStaticDir, 'settings')
 }
@@ -14,7 +14,7 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package stirling.software.SPDF.pdf.signature;
+package org.apache.pdfbox.examples.signature;

 import java.io.IOException;
 import java.io.InputStream;
@@ -14,7 +14,7 @@
 * limitations under the License.
 */

-package stirling.software.SPDF.pdf.signature;
+package org.apache.pdfbox.examples.signature;

 import java.io.IOException;
 import java.io.InputStream;
@@ -14,7 +14,7 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package stirling.software.SPDF.pdf.signature;
+package org.apache.pdfbox.examples.signature;

 import java.io.IOException;
 import java.io.InputStream;
@@ -15,7 +15,7 @@
 * limitations under the License.
 */

-package stirling.software.SPDF.pdf.signature;
+package org.apache.pdfbox.examples.signature;

 import java.io.ByteArrayInputStream;
 import java.io.IOException;
@@ -14,7 +14,7 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package stirling.software.SPDF.utils;
+package org.apache.pdfbox.examples.util;

 import java.io.IOException;
 import java.io.InputStream;
@@ -61,7 +61,6 @@ public class PdfOverlayController {
        int overlayPos = request.getOverlayPosition();

        MultipartFile[] overlayFiles = request.getOverlayFiles();
-        validateOverlayFiles(overlayFiles);
        File[] overlayPdfFiles = new File[overlayFiles.length];
        List<File> tempFiles = new ArrayList<>(); // List to keep track of temporary files

@@ -121,29 +120,10 @@ public class PdfOverlayController {
        }
    }

-    // Both fields are declared required, but @ModelAttribute binding leaves them null when the
-    // caller omits them, which would otherwise surface as a 500 instead of a 400.
-    private void validateOverlayFiles(MultipartFile[] overlayFiles) {
-        if (overlayFiles == null || overlayFiles.length == 0) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.overlayFilesRequired", "At least one overlay file is required");
-        }
-        for (MultipartFile overlayFile : overlayFiles) {
-            if (overlayFile == null || overlayFile.isEmpty()) {
-                throw ExceptionUtils.createIllegalArgumentException(
-                        "error.overlayFileEmpty", "Overlay files must not be empty");
-            }
-        }
-    }
-
    private Map<Integer, String> prepareOverlayGuide(
            int basePageCount, File[] overlayFiles, String mode, int[] counts, List<File> tempFiles)
            throws IOException {
        Map<Integer, String> overlayGuide = new HashMap<>();
-        if (mode == null) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.invalidFormat", "Invalid {0} format: {1}", "overlay mode", "null");
-        }
        switch (mode) {
            case "SequentialOverlay":
                sequentialOverlay(overlayGuide, overlayFiles, basePageCount, tempFiles);
@@ -2,7 +2,6 @@ package stirling.software.SPDF.controller.api.converters;

 import java.io.File;
 import java.io.IOException;
-import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -42,7 +41,6 @@ import stirling.software.common.util.OfficeDocumentSanitizer;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 import stirling.software.common.util.RegexPatternUtils;
-import stirling.software.common.util.SvgSanitizer;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
@@ -52,24 +50,13 @@ import stirling.software.common.util.WebResponseUtils;
@Slf4j
 public class ConvertOfficeController {

-    private static final int SNIFF_BYTES = 8192;
-
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final RuntimePathConfig runtimePathConfig;
    private final CustomHtmlSanitizer customHtmlSanitizer;
    private final OfficeDocumentSanitizer officeDocumentSanitizer;
-    private final SvgSanitizer svgSanitizer;
    private final EndpointConfiguration endpointConfiguration;
    private final TempFileManager tempFileManager;

-    private enum SniffedContent {
-        ZIP_OFFICE,
-        FLAT_XML_OFFICE,
-        SVG,
-        HTML,
-        UNKNOWN
-    }
-
    private boolean isUnoconvertAvailable() {
        return endpointConfiguration.isGroupEnabled("Unoconvert")
                || endpointConfiguration.isGroupEnabled("Python");
@@ -100,11 +87,17 @@ public class ConvertOfficeController {
        Path inputPath = workDir.resolve(baseName + "." + extensionLower);
        Path outputPath = workDir.resolve(baseName + ".pdf");

-        try {
-            writeSanitizedInput(inputFile, inputPath, extensionLower);
-        } catch (IOException e) {
-            FileUtils.deleteQuietly(workDir.toFile());
-            throw e;
+        // Sanitize input before LibreOffice sees it so embedded URLs can't trigger SSRF.
+        if ("html".equals(extensionLower) || "htm".equals(extensionLower)) {
+            String htmlContent = new String(inputFile.getBytes(), StandardCharsets.UTF_8);
+            String sanitizedHtml = customHtmlSanitizer.sanitize(htmlContent);
+            Files.writeString(inputPath, sanitizedHtml, StandardCharsets.UTF_8);
+        } else if (officeDocumentSanitizer.isSanitizableExtension(extensionLower)) {
+            byte[] sanitized =
+                    officeDocumentSanitizer.sanitize(inputFile.getBytes(), extensionLower);
+            Files.write(inputPath, sanitized);
+        } else {
+            Files.copy(inputFile.getInputStream(), inputPath, StandardCopyOption.REPLACE_EXISTING);
        }

        Path libreOfficeProfile = null;
@@ -207,144 +200,6 @@ public class ConvertOfficeController {
        }
    }

-    // Sanitize input before LibreOffice sees it so embedded URLs can't trigger SSRF.
-    private void writeSanitizedInput(MultipartFile inputFile, Path inputPath, String extensionLower)
-            throws IOException {
-        byte[] head;
-        try (InputStream in = inputFile.getInputStream()) {
-            head = in.readNBytes(SNIFF_BYTES);
-        }
-        SniffedContent sniffed = sniffContent(head);
-        boolean htmlExtension = "html".equals(extensionLower) || "htm".equals(extensionLower);
-
-        if (htmlExtension || sniffed == SniffedContent.HTML) {
-            String htmlContent = new String(inputFile.getBytes(), StandardCharsets.UTF_8);
-            String sanitizedHtml = customHtmlSanitizer.sanitize(htmlContent);
-            Files.writeString(inputPath, sanitizedHtml, StandardCharsets.UTF_8);
-        } else if (sniffed == SniffedContent.SVG) {
-            Files.write(inputPath, svgSanitizer.sanitize(inputFile.getBytes()));
-        } else if (sniffed == SniffedContent.FLAT_XML_OFFICE) {
-            Files.write(inputPath, officeDocumentSanitizer.sanitizeFlatXml(inputFile.getBytes()));
-        } else if (sniffed == SniffedContent.ZIP_OFFICE) {
-            Files.write(
-                    inputPath, officeDocumentSanitizer.sanitizeZipContainer(inputFile.getBytes()));
-        } else if (officeDocumentSanitizer.isSanitizableExtension(extensionLower)) {
-            byte[] sanitized =
-                    officeDocumentSanitizer.sanitize(inputFile.getBytes(), extensionLower);
-            Files.write(inputPath, sanitized);
-        } else {
-            Files.copy(inputFile.getInputStream(), inputPath, StandardCopyOption.REPLACE_EXISTING);
-        }
-    }
-
-    // LibreOffice routes on content, not extension, so sniffing decides; unknown stays as today.
-    private SniffedContent sniffContent(byte[] head) {
-        if (head == null || head.length < 4) {
-            return SniffedContent.UNKNOWN;
-        }
-        if (head[0] == 0x50 && head[1] == 0x4B && head[2] == 0x03 && head[3] == 0x04) {
-            return isOfficeZip(head) ? SniffedContent.ZIP_OFFICE : SniffedContent.UNKNOWN;
-        }
-        String rootElement = firstElementName(decodeHead(head));
-        if ("svg".equals(rootElement) || rootElement.endsWith(":svg")) {
-            return SniffedContent.SVG;
-        }
-        if (rootElement.startsWith("office:document") || "w:worddocument".equals(rootElement)) {
-            return SniffedContent.FLAT_XML_OFFICE;
-        }
-        if ("html".equals(rootElement)) {
-            return SniffedContent.HTML;
-        }
-        return SniffedContent.UNKNOWN;
-    }
-
-    // Only re-zip containers that look like OOXML/ODF; other archives keep the raw copy path.
-    private boolean isOfficeZip(byte[] head) {
-        if (head.length < 30) {
-            return false;
-        }
-        int nameLength = (head[26] & 0xFF) | ((head[27] & 0xFF) << 8);
-        if (nameLength <= 0 || 30 + nameLength > head.length) {
-            return false;
-        }
-        String firstEntry =
-                new String(head, 30, nameLength, StandardCharsets.ISO_8859_1)
-                        .toLowerCase(Locale.ROOT);
-        return "mimetype".equals(firstEntry) || "[content_types].xml".equals(firstEntry);
-    }
-
-    private String decodeHead(byte[] head) {
-        if (head.length >= 2) {
-            if ((head[0] & 0xFF) == 0xFF && (head[1] & 0xFF) == 0xFE) {
-                return new String(head, StandardCharsets.UTF_16LE);
-            }
-            if ((head[0] & 0xFF) == 0xFE && (head[1] & 0xFF) == 0xFF) {
-                return new String(head, StandardCharsets.UTF_16BE);
-            }
-        }
-        return new String(head, StandardCharsets.UTF_8);
-    }
-
-    // Returns the lower-cased root element name, or empty when the input is not markup.
-    private String firstElementName(String prefix) {
-        int i = 0;
-        while (i < prefix.length()) {
-            char c = prefix.charAt(i);
-            if (Character.isWhitespace(c) || c == '\uFEFF') {
-                i++;
-                continue;
-            }
-            if (c != '<') {
-                return "";
-            }
-            if (prefix.startsWith("<?", i)) {
-                int end = prefix.indexOf("?>", i);
-                if (end < 0) {
-                    return "";
-                }
-                i = end + 2;
-                continue;
-            }
-            if (prefix.startsWith("<!--", i)) {
-                int end = prefix.indexOf("-->", i);
-                if (end < 0) {
-                    return "";
-                }
-                i = end + 3;
-                continue;
-            }
-            // a doctype declares the root element, so its name answers the question
-            if (prefix.regionMatches(true, i, "<!doctype", 0, 9)) {
-                return readName(prefix, skipWhitespace(prefix, i + 9));
-            }
-            if (prefix.startsWith("<!", i)) {
-                return "";
-            }
-            return readName(prefix, i + 1);
-        }
-        return "";
-    }
-
-    private int skipWhitespace(String value, int from) {
-        int i = from;
-        while (i < value.length() && Character.isWhitespace(value.charAt(i))) {
-            i++;
-        }
-        return i;
-    }
-
-    private String readName(String value, int from) {
-        int end = from;
-        while (end < value.length()) {
-            char c = value.charAt(end);
-            if (Character.isWhitespace(c) || c == '>' || c == '/') {
-                break;
-            }
-            end++;
-        }
-        return value.substring(from, end).toLowerCase(Locale.ROOT);
-    }
-
    private boolean isValidFileExtension(String fileExtension) {
        return RegexPatternUtils.getInstance()
                .getFileExtensionValidationPattern()
@@ -10,10 +10,8 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.ArrayList;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
-import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;

@@ -39,7 +37,6 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.tool.ToolFormat;
 import stirling.software.common.model.tool.ToolIO;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.service.SsrfProtectionService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
@@ -57,35 +54,12 @@ public class ConvertWebsiteToPDF {
    private final RuntimePathConfig runtimePathConfig;
    private final ApplicationProperties applicationProperties;
    private final TempFileManager tempFileManager;
-    private final SsrfProtectionService ssrfProtectionService;

    private static final Pattern FILE_SCHEME_PATTERN =
            Pattern.compile("(?<![a-z0-9_])file\\s*:(?:/{1,3}|%2f|%5c|%3a|&#x2f;|&#47;)");

    private static final Pattern NUMERIC_HTML_ENTITY_PATTERN = Pattern.compile("&#(x?[0-9a-f]+);");

-    // Tags whose resources WeasyPrint actually fetches; <a href> is deliberately excluded
-    private static final Pattern RESOURCE_TAG_PATTERN =
-            Pattern.compile(
-                    "<\\s*(?:img|link|source|embed|object|image|input|track)\\b([^>]*)>",
-                    Pattern.CASE_INSENSITIVE);
-
-    private static final Pattern RESOURCE_ATTRIBUTE_PATTERN =
-            Pattern.compile(
-                    "\\b(?:src|srcset|href|data|poster)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))",
-                    Pattern.CASE_INSENSITIVE);
-
-    private static final Pattern CSS_URL_PATTERN =
-            Pattern.compile(
-                    "url\\(\\s*(?:\"([^\"]*)\"|'([^']*)'|([^)\\s]*))\\s*\\)",
-                    Pattern.CASE_INSENSITIVE);
-
-    private static final Pattern CSS_IMPORT_PATTERN =
-            Pattern.compile("@import\\s+(?:\"([^\"]*)\"|'([^']*)')", Pattern.CASE_INSENSITIVE);
-
-    private static final Pattern URI_SCHEME_PATTERN =
-            Pattern.compile("^([a-z][a-z0-9+.-]*):", Pattern.CASE_INSENSITIVE);
-
    @AutoJobPostMapping(
            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
            value = "/url/pdf",
@@ -141,8 +115,7 @@ public class ConvertWebsiteToPDF {
            // Download the remote content first to ensure we don't allow dangerous schemes
            String htmlContent = fetchRemoteHtml(URL);

-            if (containsDisallowedUriScheme(htmlContent)
-                    || containsBlockedResourceReference(htmlContent, URL)) {
+            if (containsDisallowedUriScheme(htmlContent)) {
                URI rejectionLocation =
                        uriComponentsBuilder
                                .queryParam("error", "error.disallowedUrlContent")
@@ -236,124 +209,6 @@ public class ConvertWebsiteToPDF {
        return FILE_SCHEME_PATTERN.matcher(normalized).find();
    }

-    // WeasyPrint fetches sub-resources itself, so every referenced URL needs the SSRF check too
-    private boolean containsBlockedResourceReference(String htmlContent, String baseUrl) {
-        if (htmlContent == null || htmlContent.isEmpty()) {
-            return false;
-        }
-
-        URI baseUri;
-        try {
-            baseUri = URI.create(baseUrl);
-        } catch (IllegalArgumentException e) {
-            log.debug("Unable to parse base URL for resource validation: {}", baseUrl);
-            return false;
-        }
-
-        Set<String> checkedHosts = new HashSet<>();
-        for (String candidate : extractResourceUrls(htmlContent)) {
-            if (!isResourceReferenceAllowed(candidate, baseUri, checkedHosts)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    private List<String> extractResourceUrls(String htmlContent) {
-        List<String> urls = new ArrayList<>();
-
-        Matcher tagMatcher = RESOURCE_TAG_PATTERN.matcher(htmlContent);
-        while (tagMatcher.find()) {
-            Matcher attributeMatcher = RESOURCE_ATTRIBUTE_PATTERN.matcher(tagMatcher.group(1));
-            while (attributeMatcher.find()) {
-                addResourceCandidates(urls, firstNonNullGroup(attributeMatcher));
-            }
-        }
-
-        Matcher cssUrlMatcher = CSS_URL_PATTERN.matcher(htmlContent);
-        while (cssUrlMatcher.find()) {
-            addResourceCandidates(urls, firstNonNullGroup(cssUrlMatcher));
-        }
-
-        Matcher cssImportMatcher = CSS_IMPORT_PATTERN.matcher(htmlContent);
-        while (cssImportMatcher.find()) {
-            addResourceCandidates(urls, firstNonNullGroup(cssImportMatcher));
-        }
-
-        return urls;
-    }
-
-    private String firstNonNullGroup(Matcher matcher) {
-        for (int group = 1; group <= matcher.groupCount(); group++) {
-            if (matcher.group(group) != null) {
-                return matcher.group(group);
-            }
-        }
-        return null;
-    }
-
-    // Splits srcset candidate lists; over-splitting a plain URL is harmless as pieces stay relative
-    private void addResourceCandidates(List<String> urls, String attributeValue) {
-        if (attributeValue == null || attributeValue.isBlank()) {
-            return;
-        }
-        for (String entry : attributeValue.split(",")) {
-            String trimmed = entry.trim();
-            if (trimmed.isEmpty()) {
-                continue;
-            }
-            int descriptorStart = trimmed.indexOf(' ');
-            urls.add(descriptorStart > 0 ? trimmed.substring(0, descriptorStart) : trimmed);
-        }
-    }
-
-    private boolean isResourceReferenceAllowed(
-            String candidate, URI baseUri, Set<String> checkedHosts) {
-        String url = decodeUrlHtmlEntities(candidate).trim();
-        if (url.isEmpty() || url.startsWith("#")) {
-            return true;
-        }
-
-        Matcher schemeMatcher = URI_SCHEME_PATTERN.matcher(url);
-        if (schemeMatcher.find()) {
-            String scheme = schemeMatcher.group(1).toLowerCase(Locale.ROOT);
-            if ("data".equals(scheme)) {
-                return true;
-            }
-            if (!"http".equals(scheme) && !"https".equals(scheme)) {
-                log.warn("Rejected resource reference with disallowed scheme: {}", scheme);
-                return false;
-            }
-        }
-
-        URI resolved;
-        try {
-            resolved = baseUri.resolve(new URI(url.replace(" ", "%20")));
-        } catch (Exception e) {
-            log.debug("Skipping unparseable resource reference: {}", url);
-            return true;
-        }
-
-        String host = resolved.getHost() != null ? resolved.getHost() : resolved.getAuthority();
-        if (host == null) {
-            return true;
-        }
-        // One check per distinct host keeps the DNS lookups bounded on resource-heavy pages
-        if (!checkedHosts.add(host.toLowerCase(Locale.ROOT))) {
-            return true;
-        }
-
-        return ssrfProtectionService.isUrlAllowed(resolved.toString());
-    }
-
-    private String decodeUrlHtmlEntities(String value) {
-        return decodeNumericHtmlEntities(value)
-                .replace("&colon;", ":")
-                .replace("&sol;", "/")
-                .replace("&frasl;", "/")
-                .replace("&amp;", "&");
-    }
-
    private String normalizeForSchemeDetection(String htmlContent) {
        String lowerCaseContent = htmlContent.toLowerCase(Locale.ROOT);
        String decodedHtmlEntities = decodeNumericHtmlEntities(lowerCaseContent);
@@ -35,7 +35,6 @@ import stirling.software.common.model.tool.ToolArity;
 import stirling.software.common.model.tool.ToolFormat;
 import stirling.software.common.model.tool.ToolIO;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.CsvUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.WebResponseUtils;

@@ -74,7 +73,7 @@ public class ExtractCSVController {
                    StringWriter sw = new StringWriter();
                    try (CSVPrinter printer = format.print(sw)) {
                        for (List<String> row : fragments.get(i).rawRows()) {
-                            printer.printRecord(CsvUtils.neutraliseRow(row));
+                            printer.printRecord(row);
                        }
                    }
                    csvEntries.add(
@@ -33,7 +33,6 @@ import lombok.RequiredArgsConstructor;

 import stirling.software.common.model.FormFieldWithCoordinates;
 import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.util.CsvUtils;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.FormUtils;
 import stirling.software.common.util.TempFileManager;
@@ -185,11 +184,7 @@ public class FormFillController {
                csvWriter.writeNext(header);

                for (FormUtils.FormFieldInfo field : fields) {
-                    csvWriter.writeNext(
-                            new String[] {
-                                CsvUtils.neutraliseFormula(field.name()),
-                                CsvUtils.neutraliseFormula(field.value())
-                            });
+                    csvWriter.writeNext(new String[] {field.name(), field.value()});
                }
            }

@@ -194,9 +194,6 @@ public class ConfigController {
            configData.put(
                    "enableMobileScanner",
                    applicationProperties.getSystem().isEnableMobileScanner());
-            configData.put(
-                    "enableMobileSignature",
-                    applicationProperties.getSystem().isEnableMobileSignature());
            configData.put(
                    "mobileScannerConvertToPdf",
                    applicationProperties.getSystem().getMobileScannerSettings().isConvertToPdf());
@@ -62,17 +62,12 @@ public class MobileScannerController {
    }

    /**
-     * Check if any feature backed by these transfer sessions is enabled. The mobile scanner and
-     * mobile signature drawing share this session/upload API, so the endpoints stay available while
-     * either feature is on; each flag independently controls only its own UI.
+     * Check if mobile scanner feature is enabled
     *
     * @return Error response if disabled, null if enabled
     */
    private ResponseEntity<Map<String, Object>> checkFeatureEnabled() {
-        boolean anyEnabled =
-                applicationProperties.getSystem().isEnableMobileScanner()
-                        || applicationProperties.getSystem().isEnableMobileSignature();
-        if (!anyEnabled) {
+        if (!applicationProperties.getSystem().isEnableMobileScanner()) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN)
                    .body(
                            Map.of(
@@ -280,8 +275,7 @@ public class MobileScannerController {
            @Parameter(description = "Filename to download", required = true) @PathVariable
                    String filename) {

-        if (!applicationProperties.getSystem().isEnableMobileScanner()
-                && !applicationProperties.getSystem().isEnableMobileSignature()) {
+        if (!applicationProperties.getSystem().isEnableMobileScanner()) {
            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
        }

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
James Brunton	a243056c3e	Merge branch 'main' into processor-restructure	2026-08-07 09:36:43 +01:00
James Brunton	aa6ac5c7a3	(scripted) Restructure frontend so processor and editor are more distinct in the tree	2026-08-06 17:18:41 +01:00
James Brunton	71ef9dcde8	(scripted) Update paths for new frontend structure	2026-08-06 17:17:54 +01:00
James Brunton	b9d3a3128b	Fix Storybook Vite interaction	2026-08-06 17:17:20 +01:00
James Brunton	0bf35a98c0	Fix hidden circular dependency in watched folders code	2026-08-06 17:17:20 +01:00
James Brunton	10d9127d29	Drop me (Setup scripts)	2026-08-06 17:17:20 +01:00