Fix language codes in picker

## Summary
Accounts setting page to change a users password or username
Fix huge bug were users can see admin settings due to hard code
admin=true
## Testing
- not run (not requested)

------
[Codex
Task](https://chatgpt.com/codex/tasks/task_b_6934b8ecdbf08328a0951b46db77dfd2)

.dockerignore

@@ -5,6 +5,7 @@ frontend/dist
 frontend/build
 frontend/.vite
 frontend/.tauri
+frontend/src-tauri/target
 
 # Gradle build artifacts
 .gradle

.github/scripts/check_language_properties.py

@@ -1,403 +0,0 @@
-"""
-Author: Ludy87
-Description: This script processes .properties files for localization checks. It compares translation files in a branch with
-a reference file to ensure consistency. The script performs two main checks:
-1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
-2. Ensures that all keys in the translation files are present in the reference file and vice versa.
-
-The script also provides functionality to update the translation files to match the reference file by adding missing keys and
-adjusting the format.
-
-Usage:
-    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
-"""
-# Sample for Windows:
-# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
-
-import copy
-import glob
-import os
-import argparse
-import re
-
-
-def find_duplicate_keys(file_path):
-    """
-    Identifies duplicate keys in a .properties file.
-    :param file_path: Path to the .properties file.
-    :return: List of tuples (key, first_occurrence_line, duplicate_line).
-    """
-    keys = {}
-    duplicates = []
-
-    with open(file_path, "r", encoding="utf-8") as file:
-        for line_number, line in enumerate(file, start=1):
-            stripped_line = line.strip()
-
-            # Skip empty lines and comments
-            if not stripped_line or stripped_line.startswith("#"):
-                continue
-
-            # Split the line into key and value
-            if "=" in stripped_line:
-                key, _ = stripped_line.split("=", 1)
-                key = key.strip()
-
-                # Check if the key already exists
-                if key in keys:
-                    duplicates.append((key, keys[key], line_number))
-                else:
-                    keys[key] = line_number
-
-    return duplicates
-
-
-# Maximum size for properties files (e.g., 200 KB)
-MAX_FILE_SIZE = 200 * 1024
-
-
-def parse_properties_file(file_path):
-    """
-    Parses a .properties file and returns a structured list of its contents.
-    :param file_path: Path to the .properties file.
-    :return: List of dictionaries representing each line in the file.
-    """
-    properties_list = []
-    with open(file_path, "r", encoding="utf-8") as file:
-        for line_number, line in enumerate(file, start=1):
-            stripped_line = line.strip()
-
-            # Handle empty lines
-            if not stripped_line:
-                properties_list.append(
-                    {"line_number": line_number, "type": "empty", "content": ""}
-                )
-                continue
-
-            # Handle comments
-            if stripped_line.startswith("#"):
-                properties_list.append(
-                    {
-                        "line_number": line_number,
-                        "type": "comment",
-                        "content": stripped_line,
-                    }
-                )
-                continue
-
-            # Handle key-value pairs
-            match = re.match(r"^([^=]+)=(.*)$", line)
-            if match:
-                key, value = match.groups()
-                properties_list.append(
-                    {
-                        "line_number": line_number,
-                        "type": "entry",
-                        "key": key.strip(),
-                        "value": value.strip(),
-                    }
-                )
-
-    return properties_list
-
-
-def write_json_file(file_path, updated_properties):
-    """
-    Writes updated properties back to the file in their original format.
-    :param file_path: Path to the .properties file.
-    :param updated_properties: List of updated properties to write.
-    """
-    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
-
-    # Sort lines by their numbers and retain comments and empty lines
-    all_lines = sorted(set(updated_lines.keys()))
-
-    original_format = []
-    for line in all_lines:
-        if line in updated_lines:
-            entry = updated_lines[line]
-        else:
-            entry = None
-        ref_entry = updated_lines[line]
-        if ref_entry["type"] in ["comment", "empty"]:
-            original_format.append(ref_entry)
-        elif entry is None:
-            # Add missing entries from the reference file
-            original_format.append(ref_entry)
-        elif entry["type"] == "entry":
-            # Replace entries with those from the current JSON
-            original_format.append(entry)
-
-    # Write the updated content back to the file
-    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
-        for entry in original_format:
-            if entry["type"] == "comment":
-                file.write(f"{entry['content']}\n")
-            elif entry["type"] == "empty":
-                file.write(f"{entry['content']}\n")
-            elif entry["type"] == "entry":
-                file.write(f"{entry['key']}={entry['value']}\n")
-
-
-def update_missing_keys(reference_file, file_list, branch=""):
-    """
-    Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference .properties file.
-    :param file_list: List of translation files to update.
-    :param branch: Branch where the files are located.
-    """
-    reference_properties = parse_properties_file(reference_file)
-    for file_path in file_list:
-        basename_current_file = os.path.basename(os.path.join(branch, file_path))
-        if (
-            basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".properties")
-            or not basename_current_file.startswith("messages_")
-        ):
-            continue
-
-        current_properties = parse_properties_file(os.path.join(branch, file_path))
-        updated_properties = []
-        for ref_entry in reference_properties:
-            ref_entry_copy = copy.deepcopy(ref_entry)
-            for current_entry in current_properties:
-                if current_entry["type"] == "entry":
-                    if ref_entry_copy["type"] != "entry":
-                        continue
-                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
-                        ref_entry_copy["value"] = current_entry["value"]
-            updated_properties.append(ref_entry_copy)
-        write_json_file(os.path.join(branch, file_path), updated_properties)
-
-
-def check_for_missing_keys(reference_file, file_list, branch):
-    update_missing_keys(reference_file, file_list, branch)
-
-
-def read_properties(file_path):
-    if os.path.isfile(file_path) and os.path.exists(file_path):
-        with open(file_path, "r", encoding="utf-8") as file:
-            return file.read().splitlines()
-    return [""]
-
-
-def check_for_differences(reference_file, file_list, branch, actor):
-    reference_branch = reference_file.split("/")[0]
-    basename_reference_file = os.path.basename(reference_file)
-
-    report = []
-    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_lines = read_properties(reference_file)
-    has_differences = False
-
-    only_reference_file = True
-
-    file_arr = file_list
-
-    if len(file_list) == 1:
-        file_arr = file_list[0].split()
-    base_dir = os.path.abspath(
-        os.path.join(os.getcwd(), "app", "core", "src", "main", "resources")
-    )
-
-    for file_path in file_arr:
-        file_normpath = os.path.normpath(file_path)
-        absolute_path = os.path.abspath(file_normpath)
-        # Verify that file is within the expected directory
-        if not absolute_path.startswith(base_dir):
-            raise ValueError(f"Unsafe file found: {file_normpath}")
-        # Verify file size before processing
-        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
-            raise ValueError(
-                f"The file {file_normpath} is too large and could pose a security risk."
-            )
-
-        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
-        if (
-            basename_current_file == basename_reference_file
-            or (
-                # only local windows command
-                not file_normpath.startswith(
-                    os.path.join(
-                        "", "app", "core", "src", "main", "resources", "messages_"
-                    )
-                )
-                and not file_normpath.startswith(
-                    os.path.join(
-                        os.getcwd(),
-                        "app",
-                        "core",
-                        "src",
-                        "main",
-                        "resources",
-                        "messages_",
-                    )
-                )
-            )
-            or not file_normpath.endswith(".properties")
-            or not basename_current_file.startswith("messages_")
-        ):
-            continue
-        only_reference_file = False
-        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
-        current_lines = read_properties(os.path.join(branch, file_path))
-        reference_line_count = len(reference_lines)
-        current_line_count = len(current_lines)
-
-        if reference_line_count != current_line_count:
-            report.append("")
-            report.append("1. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            has_differences = True
-            if reference_line_count > current_line_count:
-                report.append(
-                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
-                )
-            elif reference_line_count < current_line_count:
-                report.append(
-                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
-                )
-        else:
-            report.append("1. **Test Status:** ✅ **_Passed_**")
-
-        # Check for missing or extra keys
-        current_keys = []
-        reference_keys = []
-        for line in current_lines:
-            if not line.startswith("#") and line != "" and "=" in line:
-                key, _ = line.split("=", 1)
-                current_keys.append(key)
-        for line in reference_lines:
-            if not line.startswith("#") and line != "" and "=" in line:
-                key, _ = line.split("=", 1)
-                reference_keys.append(key)
-
-        current_keys_set = set(current_keys)
-        reference_keys_set = set(reference_keys)
-        missing_keys = current_keys_set.difference(reference_keys_set)
-        extra_keys = reference_keys_set.difference(current_keys_set)
-        missing_keys_list = list(missing_keys)
-        extra_keys_list = list(extra_keys)
-
-        if missing_keys_list or extra_keys_list:
-            has_differences = True
-            missing_keys_str = "`, `".join(missing_keys_list)
-            extra_keys_str = "`, `".join(extra_keys_list)
-            report.append("2. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            if missing_keys_list:
-                spaces_keys_list = []
-                for key in missing_keys_list:
-                    if " " in key:
-                        spaces_keys_list.append(key)
-                if spaces_keys_list:
-                    spaces_keys_str = "`, `".join(spaces_keys_list)
-                    report.append(
-                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
-                    )
-                report.append(
-                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
-                )
-            if extra_keys_list:
-                report.append(
-                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
-                )
-        else:
-            report.append("2. **Test Status:** ✅ **_Passed_**")
-
-        if find_duplicate_keys(os.path.join(branch, file_normpath)):
-            has_differences = True
-            output = "\n".join(
-                [
-                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
-                    for key, first, duplicate in find_duplicate_keys(
-                        os.path.join(branch, file_normpath)
-                    )
-                ]
-            )
-            report.append("3. **Test Status:** ❌ **_Failed_**")
-            report.append("  - **Issue:**")
-            report.append("    - duplicate entries were found:")
-            report.append(output)
-        else:
-            report.append("3. **Test Status:** ✅ **_Passed_**")
-
-        report.append("")
-        report.append("---")
-        report.append("")
-    if has_differences:
-        report.append("## ❌ Overall Check Status: **_Failed_**")
-        report.append("")
-        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/resources/messages_en_GB.properties)"
-        )
-    else:
-        report.append("## ✅ Overall Check Status: **_Success_**")
-        report.append("")
-        report.append(
-            f"Thanks @{actor} for your help in keeping the translations up to date."
-        )
-
-    if not only_reference_file:
-        print("\n".join(report))
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys")
-    parser.add_argument(
-        "--actor",
-        required=False,
-        help="Actor from PR.",
-    )
-    parser.add_argument(
-        "--reference-file",
-        required=True,
-        help="Path to the reference file.",
-    )
-    parser.add_argument(
-        "--branch",
-        type=str,
-        required=True,
-        help="Branch name.",
-    )
-    parser.add_argument(
-        "--check-file",
-        type=str,
-        required=False,
-        help="List of changed files, separated by spaces.",
-    )
-    parser.add_argument(
-        "--files",
-        nargs="+",
-        required=False,
-        help="List of changed files, separated by spaces.",
-    )
-    args = parser.parse_args()
-
-    # Sanitize --actor input to avoid injection attacks
-    if args.actor:
-        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
-
-    # Sanitize --branch input to avoid injection attacks
-    if args.branch:
-        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
-
-    file_list = args.files
-    if file_list is None:
-        if args.check_file:
-            file_list = [args.check_file]
-        else:
-            file_list = glob.glob(
-                os.path.join(
-                    os.getcwd(),
-                    "app",
-                    "core",
-                    "src",
-                    "main",
-                    "resources",
-                    "messages_*.properties",
-                )
-            )
-        update_missing_keys(args.reference_file, file_list)
-    else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_toml.py

@@ -1,6 +1,6 @@
 """
 Author: Ludy87
-Description: This script processes JSON translation files for localization checks. It compares translation files in a branch with
+Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
 a reference file to ensure consistency. The script performs two main checks:
 1. Verifies that the number of translation keys in the translation files matches the reference file.
 2. Ensures that all keys in the translation files are present in the reference file and vice versa.
@@ -9,10 +9,10 @@ The script also provides functionality to update the translation files to match
 adjusting the format.
 
 Usage:
-    python check_language_json.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
 # Sample for Windows:
-# python .github/scripts/check_language_json.py --reference-file frontend/public/locales/en-GB/translation.json --branch "" --files frontend/public/locales/de-DE/translation.json frontend/public/locales/fr-FR/translation.json
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
 
 import copy
 import glob
@@ -20,12 +20,14 @@ import os
 import argparse
 import re
 import json
+import tomllib  # Python 3.11+ (stdlib)
+import tomli_w  # For writing TOML files
 
 
 def find_duplicate_keys(file_path, keys=None, prefix=""):
     """
-    Identifies duplicate keys in a JSON file (including nested keys).
-    :param file_path: Path to the JSON file.
+    Identifies duplicate keys in a TOML file (including nested keys).
+    :param file_path: Path to the TOML file.
     :param keys: Dictionary to track keys (used for recursion).
     :param prefix: Prefix for nested keys.
     :return: List of tuples (key, first_occurrence_path, duplicate_path).
@@ -35,8 +37,9 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
 
     duplicates = []
 
-    with open(file_path, "r", encoding="utf-8") as file:
-        data = json.load(file)
+    # Load TOML file
+    with open(file_path, 'rb') as file:
+        data = tomllib.load(file)
 
     def process_dict(obj, current_prefix=""):
         for key, value in obj.items():
@@ -54,18 +57,18 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for JSON files (e.g., 500 KB)
+# Maximum size for TOML files (e.g., 500 KB)
 MAX_FILE_SIZE = 500 * 1024
 
 
-def parse_json_file(file_path):
+def parse_toml_file(file_path):
     """
-    Parses a JSON translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the JSON file.
+    Parses a TOML translation file and returns a flat dictionary of all keys.
+    :param file_path: Path to the TOML file.
     :return: Dictionary with flattened keys.
     """
-    with open(file_path, "r", encoding="utf-8") as file:
-        data = json.load(file)
+    with open(file_path, 'rb') as file:
+        data = tomllib.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
         items = {}
@@ -99,38 +102,37 @@ def unflatten_dict(d, sep="."):
     return result
 
 
-def write_json_file(file_path, updated_properties):
+def write_toml_file(file_path, updated_properties):
     """
-    Writes updated properties back to the JSON file.
-    :param file_path: Path to the JSON file.
+    Writes updated properties back to the TOML file.
+    :param file_path: Path to the TOML file.
     :param updated_properties: Dictionary of updated properties to write.
     """
     nested_data = unflatten_dict(updated_properties)
 
-    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
-        json.dump(nested_data, file, ensure_ascii=False, indent=2)
-        file.write("\n")  # Add trailing newline
+    with open(file_path, "wb") as file:
+        tomli_w.dump(nested_data, file)
 
 
 def update_missing_keys(reference_file, file_list, branch=""):
     """
     Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference JSON file.
+    :param reference_file: Path to the reference TOML file.
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_properties = parse_json_file(reference_file)
+    reference_properties = parse_toml_file(reference_file)
 
     for file_path in file_list:
         basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
             basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".json")
+            or not file_path.endswith(".toml")
             or not os.path.dirname(file_path).endswith("locales")
         ):
             continue
 
-        current_properties = parse_json_file(os.path.join(branch, file_path))
+        current_properties = parse_toml_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -141,16 +143,16 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_json_file(os.path.join(branch, file_path), updated_properties)
+        write_toml_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
     update_missing_keys(reference_file, file_list, branch)
 
 
-def read_json_keys(file_path):
+def read_toml_keys(file_path):
     if os.path.isfile(file_path) and os.path.exists(file_path):
-        return parse_json_file(file_path)
+        return parse_toml_file(file_path)
     return {}
 
 
@@ -160,7 +162,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_json_keys(reference_file)
+    reference_keys = read_toml_keys(reference_file)
     has_differences = False
 
     only_reference_file = True
@@ -197,12 +199,12 @@ def check_for_differences(reference_file, file_list, branch, actor):
         ):
             continue
 
-        if not file_normpath.endswith(".json") or basename_current_file != "translation.json":
+        if not file_normpath.endswith(".toml") or basename_current_file != "translation.toml":
             continue
 
         only_reference_file = False
         report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_json_keys(os.path.join(branch, file_path))
+        current_keys = read_toml_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -272,7 +274,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.json](https://github.com/Stirling-Tools/Stirling-PDF/blob/V2/frontend/public/locales/en-GB/translation.json)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -286,7 +288,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
     parser.add_argument(
         "--actor",
         required=False,
@@ -337,9 +339,9 @@ if __name__ == "__main__":
                     "public",
                     "locales",
                     "*",
-                    "translation.json",
+                    "translation.toml",
                 )
             )
         update_missing_keys(args.reference_file, file_list)
     else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -306,8 +306,10 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
               environment:
-                DISABLE_ADDITIONAL_FEATURES: "true"
-                SECURITY_ENABLELOGIN: "false"
+                DISABLE_ADDITIONAL_FEATURES: "false"
+                SECURITY_ENABLELOGIN: "true"
+                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
+                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
                 SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -14,6 +14,7 @@ jobs:
     permissions:
       issues: write
     if: |
+      vars.CI_PROFILE != 'lite' &&
       github.event.issue.pull_request &&
       (
         contains(github.event.comment.body, 'prdeploy') ||
@@ -180,7 +181,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha

.github/workflows/build.yml

@@ -262,7 +262,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
+        include:
+          - docker-rev: docker/embedded/Dockerfile
+            artifact-suffix: Dockerfile
+          - docker-rev: docker/embedded/Dockerfile.ultra-lite
+            artifact-suffix: Dockerfile.ultra-lite
+          - docker-rev: docker/embedded/Dockerfile.fat
+            artifact-suffix: Dockerfile.fat
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -272,6 +278,13 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      - name: Free disk space on runner
+        run: |
+          echo "Disk space before cleanup:" && df -h
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
+          docker system prune -af || true
+          echo "Disk space after cleanup:" && df -h
+
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
@@ -301,7 +314,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/backend/${{ matrix.docker-rev }}
+          file: ./${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -313,7 +326,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: reports-docker-${{ matrix.docker-rev }}
+          name: reports-docker-${{ matrix.artifact-suffix }}
           path: |
             build/reports/tests/
             build/test-results/

.github/workflows/check_toml.yml

@@ -1,19 +1,14 @@
-name: Check Properties Files on PR
+name: Check TOML Translation Files on PR
+
+# This workflow validates TOML translation files
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
-      - "app/core/src/main/resources/messages_*.properties"
+      - "frontend/public/locales/*/translation.toml"
 
 # cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
   cancel-in-progress: true
@@ -73,22 +68,22 @@ jobs:
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
-                   # Check if PR number exists
-            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-              echo "Error: PR number is empty"
-              exit 1
-            fi
-            # Get changed files and filter for properties files, handle case where no matches are found
-            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
-            # Check if any files were found
-            if [ ! -s changed_files.txt ]; then
-              echo "No properties files changed in this PR"
-              echo "Workflow will exit early as no relevant files to check"
-              exit 0
-            fi
-            echo "Found $(wc -l < changed_files.txt) matching properties files"
+          # Check if PR number exists
+          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+            echo "Error: PR number is empty"
+            exit 1
+          fi
+          # Get changed files and filter for TOML translation files
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          # Check if any files were found
+          if [ ! -s changed_files.txt ]; then
+            echo "No TOML translation files changed in this PR"
+            echo "Workflow will exit early as no relevant files to check"
+            exit 0
+          fi
+          echo "Found $(wc -l < changed_files.txt) matching TOML files"
 
-      - name: Determine reference file test
+      - name: Determine reference file
         id: determine-file
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -125,11 +120,11 @@ jobs:
               pull_number: prNumber,
             });
 
-            // Filter for relevant files based on the PR changes
+            // Filter for relevant TOML files based on the PR changes
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^app\/core\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
+                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -169,16 +164,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("app/core/src/main/resources/messages_en_GB.properties")) {
+            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "app/core/src/main/resources/messages_en_GB.properties",
+                path: "frontend/public/locales/en-GB/translation.toml",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-messages_en_GB.properties";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -186,11 +181,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "app/core/src/main/resources/messages_en_GB.properties",
+                path: "frontend/public/locales/en-GB/translation.toml",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-messages_en_GB.properties";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -198,11 +193,20 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Python dependencies
+        run: |
+          pip install tomli-w
+
       - name: Run Python script to check files
         id: run-check
         run: |
-          echo "Running Python script to check files..."
-          python .github/scripts/check_language_properties.py \
+          echo "Running Python script to check TOML files..."
+          python .github/scripts/check_language_toml.py \
             --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
@@ -213,7 +217,7 @@ jobs:
         id: capture-output
         run: |
           if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Test, capturing output..."
+            echo "Capturing output..."
             SCRIPT_OUTPUT=$(cat result.txt)
             echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
             echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
@@ -227,7 +231,7 @@ jobs:
               echo "FAIL_JOB=false" >> $GITHUB_ENV
             fi
           else
-            echo "No update found."
+            echo "No output found."
             echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
             echo "FAIL_JOB=false" >> $GITHUB_ENV
           fi
@@ -249,7 +253,7 @@ jobs:
               issue_number: issueNumber
             });
 
-            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
+            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
 
             // Only update or create comments by the action user
             const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
@@ -260,7 +264,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 comment_id: comment.id,
-                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Updated existing comment.");
             } else if (!comment) {
@@ -269,7 +273,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 issue_number: issueNumber,
-                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Created new comment.");
             } else {
@@ -287,6 +291,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/multiOSReleases.yml

@@ -1,4 +1,4 @@
-name: Test Installers Build
+name: Multi-OS Tauri Releases
 
 on:
   workflow_dispatch:
@@ -6,7 +6,23 @@ on:
       test_mode:
         description: "Run in test mode (skip release step)"
         required: false
-        default: "false"
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  push:
+    branches: [main, V2, V2-demo, V2-master]
   release:
     types: [created]
 
@@ -14,288 +30,501 @@ permissions:
   contents: read
 
 jobs:
-  read_versions:
+  determine-matrix:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
-      versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Set up JDK
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          distribution: 'temurin'
-          java-version: '21'
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
 
-      # ✅ Get version from Gradle
       - name: Get version number
         id: versionNumber
         run: |
+          echo "Running gradlew printVersion..."
+          ./gradlew printVersion --quiet
           VERSION=$(./gradlew printVersion --quiet | tail -1)
+          echo "Extracted version: $VERSION"
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      # ✅ Get Mac-specific version from Gradle
-      - name: Get version number mac
-        id: versionNumberMac
+      - name: Determine build matrix
+        id: set-matrix
         run: |
-          VERSION_MAC=$(./gradlew printMacVersion --quiet | tail -1)
-          echo "versionNumberMac=$VERSION_MAC" >> $GITHUB_OUTPUT
-
-  build-portable:
-    needs: read_versions
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
-        run: ./gradlew clean createExe
-        env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Rename binaries
-        run: |
-          mkdir ./binaries
-          mv ./build/launch4j/Stirling-PDF.exe ./binaries/win-Stirling-PDF-portable-Server${{ matrix.file_suffix }}.exe
-          mv ./app/core/build/libs/stirling-pdf-${{ needs.read_versions.outputs.version }}.jar ./binaries/Stirling-PDF${{ matrix.file_suffix }}.jar
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          retention-days: 1
-          if-no-files-found: error
-          name: stirling${{ matrix.file_suffix }}-binaries
-          path: |
-            ./binaries/*
-
-  sign_verify-portable:
-    needs: [build-portable, read_versions]
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "with-login-"
-          - disable_security: true
-            file_suffix: ""
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Download build artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: stirling-${{ matrix.file_suffix }}binaries
-
-      - name: Display structure of downloaded files
-        run: ls -R
-
-      - name: Upload signed artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          retention-days: 1
-          if-no-files-found: error
-          name: stirling-${{ matrix.file_suffix }}signed
-          path: |
-            ./*
-            !cosign.*
-
-  build-installers:
-    needs: read_versions
-    strategy:
-      matrix:
-        include:
-          - os: windows-latest
-            platform: win-
-          - os: macos-latest
-            platform: mac-
-          # - os: ubuntu-latest
-          #   platform: linux-
-    runs-on: ${{ matrix.os }}
-    permissions:
-      contents: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      # Install Windows dependencies
-      - name: Install WiX Toolset
-        if: matrix.os == 'windows-latest'
-        run: |
-          curl -L -o wix.exe https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314.exe
-          .\wix.exe /install /quiet
-
-      # Build installer
-      - name: Build Installer
-        run: ./gradlew build jpackage -x test --info
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: true
-          BROWSER_OPEN: true
-
-      - name: Set up JDK (x86_64)
-        if: matrix.os == 'macos-latest'
-        run: |
-          curl -L -o jdk.tar.gz https://cdn.azul.com/zulu/bin/zulu17.56.15-ca-jdk17.0.14-macosx_x64.tar.gz
-          mkdir -p zulu17
-          tar -xzf jdk.tar.gz -C zulu17 --strip-components=1
-          echo "JAVA_HOME=$PWD/zulu17" >> $GITHUB_ENV
-          echo "$PWD/zulu17/bin" >> $GITHUB_PATH
-
-      -   name: Verify JDK architecture
-          if: matrix.os == 'macos-latest'
-          run: file $JAVA_HOME/bin/java
-
-      -   name: Build project and run jpackage (x86_64)
-          if: matrix.os == 'macos-latest'
-          run: arch -x86_64 ./gradlew jpackageMacX64
-
-      # Rename and collect artifacts based on OS
-      - name: Prepare artifacts
-        id: prepare
-        shell: bash
-        run: |
-          ls -lah ./build/jpackage/
-          mkdir ./binaries
-          if [ "${{ matrix.os }}" = "windows-latest" ]; then
-            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.version }}.exe" "./binaries/Stirling-PDF-win-installer.exe"
-          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
-            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-installer.dmg"
-            mv "./build/jpackage/x86_64/Stirling PDF (x86_64)-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-x86_64-installer.dmg"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
           else
-            mv "./build/jpackage/stirling-pdf_${{ needs.read_versions.outputs.version }}-1_amd64.deb" "./binaries/Stirling-PDF-linux-installer.deb"
+            # For push/release events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
           fi
 
-      - name: Display structure of downloaded files
-        run: ls -R ./binaries
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          retention-days: 1
-          if-no-files-found: error
-          name: ${{ matrix.platform }}binaries
-          path: |
-            ./binaries/*
-
-  sign_verify:
-    needs: [read_versions, build-installers]
+  build-jars:
+    needs: determine-matrix
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        include:
-          - os: windows-latest
-            platform: win-
-          - os: macos-latest
-            platform: mac-
-          # - os: ubuntu-latest
-          #   platform: linux-
-    runs-on: ubuntu-latest
+        variant:
+          - name: "default"
+            disable_security: true
+            build_frontend: true
+            file_suffix: ""
+          - name: "with-login"
+            disable_security: false
+            build_frontend: true
+            file_suffix: "-with-login"
+          - name: "server-only"
+            disable_security: true
+            build_frontend: false
+            file_suffix: "-server"
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download build artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          name: ${{ matrix.platform }}binaries
+          java-version: "21"
+          distribution: "temurin"
 
-      - name: Display structure of downloaded files
-        run: ls -R
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
 
-      - name: Install Cosign
-        if: matrix.os == 'windows-latest'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+      - name: Setup Node.js
+        if: matrix.variant.build_frontend == true
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
 
-      - name: Generate key pair
-        if: matrix.os == 'windows-latest'
-        run: cosign generate-key-pair
+      - name: Build JAR
+        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Sign and generate attestations
-        if: matrix.os == 'windows-latest'
+      - name: Rename JAR
         run: |
-          cosign sign-blob \
-            --key ./cosign.key \
-            --yes \
-            --output-signature ./Stirling-PDF-win-installer.exe.sig \
-            ./Stirling-PDF-win-installer.exe
+          echo "Version from determine-matrix: ${{ needs.determine-matrix.outputs.version }}"
+          echo "Looking for: app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar"
+          ls -la app/core/build/libs/
+          mkdir -p ./jar-dist
+          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
 
-          cosign attest-blob \
-            --predicate - \
-            --key ./cosign.key \
-            --yes \
-            --output-attestation ./Stirling-PDF-win-installer.exe.intoto.jsonl \
-            ./Stirling-PDF-win-installer.exe
-
-          cosign verify-blob \
-            --key ./cosign.pub \
-            --signature ./Stirling-PDF-win-installer.exe.sig \
-            ./Stirling-PDF-win-installer.exe
-
-      - name: Display structure of downloaded files
-        run: ls -R
-
-      - name: Upload signed artifacts
+      - name: Upload JAR artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
+          name: jar${{ matrix.variant.file_suffix }}
+          path: ./jar-dist/*.jar
+          retention-days: 1
+
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on release or V2-master
+          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
           retention-days: 1
-          if-no-files-found: error
-          name: ${{ matrix.platform }}signed
-          path: |
-            ./Stirling-PDF-${{ matrix.platform }}installer.*
-            ./Stirling-PDF-${{ matrix.platform }}x86_64-installer.*
-            !cosign.*
 
   create-release:
-    if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_mode != 'true'
-    needs: [read_versions, sign_verify, sign_verify-portable]
+    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+    needs: [determine-matrix, build, build-jars]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -305,14 +534,43 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Download signed artifacts
+      - name: Download all Tauri artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: Stirling-PDF-*
+          path: ./artifacts/tauri
+
+      - name: Download JAR artifact (default)
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: jar
+          path: ./artifacts/jars
+
+      - name: Download JAR artifact (with login)
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: jar-with-login
+          path: ./artifacts/jars
+
+      - name: Download JAR artifact (server only)
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: jar-server
+          path: ./artifacts/jars
+
       - name: Display structure of downloaded files
-        run: ls -R
-      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+        run: ls -R ./artifacts
+
+      - name: Upload binaries to Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.read_versions.outputs.version }}
+          tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
           files: |
-            ./*signed/*
+            ./artifacts/**/*.jar
+            ./artifacts/**/*.msi
+            ./artifacts/**/*.dmg
+            ./artifacts/**/*.deb
+            ./artifacts/**/*.AppImage
+          draft: false
+          prerelease: false

.github/workflows/push-docker-v2.yml

@@ -0,0 +1,246 @@
+name: Push Docker Image - V2 Branch
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - V2-master
+      - alljavadocker
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
+    runs-on: ubuntu-24.04-8core
+    permissions:
+      packages: write
+      id-token: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Get version number
+        id: versionNumber
+        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
+
+      - name: Install cosign
+        if: github.ref == 'refs/heads/V2-master'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        with:
+          cosign-release: "v2.4.1"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_API }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+
+      - name: Generate tags for latest (V2-master branch - production)
+        id: meta
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Generate tags for latest (alljavadocker branch - test)
+        id: meta-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
+            type=raw,value=latest
+
+      - name: Build and push Unified Dockerfile (latest variant)
+        id: build-push-latest
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign regular images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --yes \
+              --key env://COSIGN_PRIVATE_KEY \
+              "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for latest-fat (V2-master branch - production)
+        id: meta-fat
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Generate tags for latest-fat (alljavadocker branch - test)
+        id: meta-fat-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
+            type=raw,value=latest-fat
+
+      - name: Build and push Unified Dockerfile (fat variant)
+        id: build-push-fat
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.fat
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign fat images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
+          TAGS: ${{ steps.meta-fat.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done
+
+      - name: Generate tags for ultra-lite (V2-master branch - production)
+        id: meta-lite
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/V2-master'
+        with:
+          images: |
+            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
+            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
+            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Generate tags for ultra-lite (alljavadocker branch - test)
+        id: meta-lite-test
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
+        if: github.ref == 'refs/heads/alljavadocker'
+        with:
+          images: |
+            ghcr.io/stirling-tools/stirling-pdf-test
+          tags: |
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
+            type=raw,value=latest-ultra-lite
+
+      - name: Build and push Unified Dockerfile (ultra-lite variant)
+        id: build-push-lite
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./docker/embedded/Dockerfile.ultra-lite
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
+          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
+          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+          platforms: linux/amd64,linux/arm64/v8
+          provenance: true
+          sbom: true
+
+      - name: Sign ultra-lite images
+        if: github.ref == 'refs/heads/V2-master'
+        env:
+          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
+          TAGS: ${{ steps.meta-lite.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
+            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
+          done

.github/workflows/push-docker.yml

@@ -24,6 +24,7 @@ permissions:
 
 jobs:
   push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -107,7 +108,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -152,7 +153,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./Dockerfile.ultra-lite
+          file: ./docker/embedded/Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -183,7 +184,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./Dockerfile.fat
+          file: ./docker/embedded/Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/releaseArtifacts.yml

@@ -2,85 +2,445 @@ name: Release Artifacts
 
 on:
   workflow_dispatch:
-  release:
-    types: [created]
+    inputs:
+      platform:
+        description: "Platform to build (windows, macos, linux, or all)"
+        required: true
+        default: "all"
+        type: choice
+        options:
+          - all
+          - windows
+          - macos
+          - linux
+  push:
+    branches: [main, V2, V2-demo]
 
 permissions:
   contents: read
 
 jobs:
-  build:
+  determine-matrix:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
     outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "17"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
-        run: ./gradlew clean createExe
-        env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
-          STIRLING_PDF_DESKTOP_UI: false
-
       - name: Get version number
         id: versionNumber
         run: |
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Rename binaries
+      - name: Determine build matrix
+        id: set-matrix
         run: |
-          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
-          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            case "${{ github.event.inputs.platform }}" in
+              "windows")
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "macos")
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              "linux")
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+              *)
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+                ;;
+            esac
+          else
+            # For push events, build all platforms
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
+          fi
 
-      - name: Debug build artifacts
+  build:
+    needs: determine-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
+    runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
         run: |
-          echo "Current Directory: $(pwd)"
-          ls -R ./build/libs
-          ls -R ./build/launch4j
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Build Java backend with JLink
+        working-directory: ./
+        shell: bash
+        run: |
+          chmod +x ./gradlew
+          echo "🔧 Building Stirling-PDF JAR..."
+          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+
+          # Find the built JAR
+          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
+          echo "✅ Built JAR: $STIRLING_JAR"
+
+          # Create Tauri directories
+          mkdir -p ./frontend/src-tauri/libs
+          mkdir -p ./frontend/src-tauri/runtime
+
+          # Copy JAR to Tauri libs
+          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
+          echo "✅ JAR copied to Tauri libs"
+
+          # Analyze JAR dependencies for jlink modules
+          echo "🔍 Analyzing JAR dependencies..."
+          if command -v jdeps &> /dev/null; then
+            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
+            if [ -n "$DETECTED_MODULES" ]; then
+              echo "📋 jdeps detected modules: $DETECTED_MODULES"
+              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            else
+              echo "⚠️ jdeps analysis failed, using predefined modules"
+              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+            fi
+          else
+            echo "⚠️ jdeps not available, using predefined modules"
+            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+          fi
+
+          # Create custom JRE with jlink
+          echo "🔧 Creating custom JRE with jlink..."
+          echo "📋 Using modules: $MODULES"
+
+          # Remove any existing JRE
+          rm -rf ./frontend/src-tauri/runtime/jre
+
+          # Create the custom JRE
+          jlink \
+            --add-modules "$MODULES" \
+            --strip-debug \
+            --compress=2 \
+            --no-header-files \
+            --no-man-pages \
+            --output ./frontend/src-tauri/runtime/jre
+
+          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
+            echo "❌ Failed to create JLink runtime"
+            exit 1
+          fi
+
+          # Test the bundled runtime
+          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
+            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
+            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
+          else
+            echo "❌ Custom JRE executable not found"
+            exit 1
+          fi
+
+          # Calculate runtime size
+          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
+          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm install
+
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
+      - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "Importing Apple Developer Certificate..."
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          # Create temporary keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Import certificate
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          # Clean up
+          rm certificate.p12
+
+      - name: Verify Certificate
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
+        run: |
+          echo "Verifying Apple Developer Certificate..."
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
+          echo "Certificate Info: $CERT_INFO"
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "Certificate ID: $CERT_ID"
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported successfully."
+
+      - name: Build Tauri app
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          CI: true
+        with:
+          projectPath: ./frontend
+          tauriScript: npx tauri
+          args: ${{ matrix.args }}
+
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
+      - name: Rename artifacts
+        shell: bash
+        run: |
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target
+
+          # Find and rename artifacts based on platform
+          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
+            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          else
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+          fi
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: binaries${{ matrix.file_suffix }}
-          path: |
-            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
-            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
+          name: Stirling-PDF-${{ matrix.name }}
+          path: ./dist/*
+          retention-days: 30
 
   sign_verify:
     needs: build
     runs-on: ubuntu-latest
+    if: success()
     strategy:
+      fail-fast: false
       matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
+        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -90,7 +450,8 @@ jobs:
       - name: Download build artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: binaries${{ matrix.file_suffix }}
+          name: Stirling-PDF-${{ matrix.name }}
+
       - name: Display structure of downloaded files
         run: ls -R
 
@@ -101,80 +462,74 @@ jobs:
         run: cosign generate-key-pair
 
       - name: Sign and generate attestations
+        shell: bash
         run: |
-          cosign sign-blob \
-            --key ./cosign.key \
-            --yes \
-            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+          # Sign all artifacts for this platform
+          for file in *; do
+            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
+              echo "Signing: $file"
 
-          cosign attest-blob \
-            --predicate - \
-            --key ./cosign.key \
-            --yes \
-            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+              # Sign the artifact
+              cosign sign-blob \
+                --key ./cosign.key \
+                --yes \
+                --output-signature "${file}.sig" \
+                "$file"
 
-          cosign verify-blob \
-            --key ./cosign.pub \
-            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+              # Generate attestation
+              cosign attest-blob \
+                --predicate - \
+                --key ./cosign.key \
+                --yes \
+                --output-attestation "${file}.intoto.jsonl" \
+                "$file"
 
-          cosign sign-blob \
-            --key ./cosign.key \
-            --yes \
-            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+              # Verify the signature
+              cosign verify-blob \
+                --key ./cosign.pub \
+                --signature "${file}.sig" \
+                "$file"
 
-          cosign attest-blob \
-            --predicate - \
-            --key ./cosign.key \
-            --yes \
-            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
-
-          cosign verify-blob \
-            --key ./cosign.pub \
-            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+              echo "✅ Signed and verified: $file"
+            fi
+          done
 
       - name: Upload signed artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: signed${{ matrix.file_suffix }}
+          name: Stirling-PDF-${{ matrix.name }}-signed
           path: |
-            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
-            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            *
+            !cosign.key
+            !cosign.pub
+          retention-days: 30
 
   release:
-    needs: [build, sign_verify]
+    needs: [determine-matrix, build, sign_verify]
     runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     permissions:
       contents: write
-    strategy:
-      matrix:
-        disable_security: [true, false]
-        include:
-          - disable_security: false
-            file_suffix: "-with-login"
-          - disable_security: true
-            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download signed artifacts
+      - name: Download all signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: signed${{ matrix.file_suffix }}
+          pattern: Stirling-PDF-*-signed
+          path: ./artifacts
 
-      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+      - name: Display structure of downloaded files
+        run: ls -R ./artifacts
+
+      - name: Create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.build.outputs.version }}
+          tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
-          files: |
-            ./libs/Stirling-PDF*
-            ./launch4j/Stirling-PDF-Server*
+          files: ./artifacts/**/*
+          draft: false
+          prerelease: false

.github/workflows/scorecards.yml

@@ -17,6 +17,7 @@ permissions: read-all
 
 jobs:
   analysis:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:

.github/workflows/sonarqube.yml

@@ -27,6 +27,7 @@ permissions:
 
 jobs:
   sonarqube:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/stale.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   stale:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/swagger.yml

@@ -23,6 +23,7 @@ permissions:
 
 jobs:
   push:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/sync_files.yml

@@ -1,122 +0,0 @@
-name: Sync Files
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - "build.gradle"
-      - "README.md"
-      - "app/core/src/main/resources/messages_*.properties"
-      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
-      - "scripts/ignore_translation.toml"
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  sync-files:
-    runs-on: ubuntu-latest
-    env:
-      # Prevents sdist builds → no tar extraction
-      PIP_ONLY_BINARY: ":all:"
-      PIP_DISABLE_PIP_VERSION_CHECK: "1"
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-
-      - name: Sync translation property files
-        run: |
-          python .github/scripts/check_language_properties.py --reference-file "app/core/src/main/resources/messages_en_GB.properties" --branch main
-
-      - name: Commit translation files
-        run: |
-          git add app/core/src/main/resources/messages_*.properties
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
-
-      - name: Install dependencies
-        # Wheels-only + Hash-Pinning
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Sync README.md
-        run: |
-          python scripts/counter_translation.py
-
-      - name: Run git add
-        run: |
-          git add README.md scripts/ignore_translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
-
-      - name: Create Pull Request
-        if: always()
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: Update files
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: sync_readme
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
-          body: |
-            ### Description of Changes
-
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
-
-            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
-            - Ensured consistency and synchronization across all supported language files.
-            - Highlighted any missing or incomplete translations.
-
-            #### **2. Update README.md**
-            - Generated the translation progress table in `README.md`.
-            - Added a summary of the current translation status for all supported languages.
-            - Included up-to-date statistics on translation coverage.
-
-            #### **Why these changes are necessary**
-            - Keeps translation files aligned with the latest reference updates.
-            - Ensures the documentation reflects the current translation progress.
-
-            ---
-
-            Auto-generated by [create-pull-request][1].
-
-            [1]: https://github.com/peter-evans/create-pull-request
-          draft: false
-          delete-branch: true
-          labels: github-actions
-          sign-commits: true
-          add-paths: |
-            README.md
-            app/core/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,15 +1,15 @@
-name: Sync Files V2
+name: Sync Files (TOML)
 
 on:
   workflow_dispatch:
   push:
     branches:
-      - V2
+      - main
       - syncLangTest
     paths:
       - "build.gradle"
       - "README.md"
-      - "frontend/public/locales/*/translation.json"
+      - "frontend/public/locales/*/translation.toml"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
       - "scripts/ignore_translation.toml"
 
@@ -52,21 +52,25 @@ jobs:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
-      - name: Sync translation JSON files
+      - name: Install Python dependencies
         run: |
-          python .github/scripts/check_language_json.py --reference-file "frontend/public/locales/en-GB/translation.json" --branch V2
+          pip install tomli-w
+
+      - name: Sync translation TOML files
+        run: |
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
 
       - name: Commit translation files
         run: |
-          git add frontend/public/locales/*/translation.json
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+          git add frontend/public/locales/*/translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
 
-      - name: Install dependencies
+      - name: Install README dependencies
         run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Sync README.md
         run: |
-          python scripts/counter_translation_v2.py
+          python scripts/counter_translation_v3.py
 
       - name: Run git add
         run: |
@@ -82,21 +86,22 @@ jobs:
           committer: ${{ steps.setup-bot.outputs.committer }}
           author: ${{ steps.setup-bot.outputs.committer }}
           signoff: true
-          branch: sync_readme_v2
-          base: V2
-          title: ":globe_with_meridians: [V2] Sync Translations + Update README Progress Table"
+          branch: sync_readme_v3
+          base: main
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
           body: |
             ### Description of Changes
 
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation for the **V2 branch**. Below are the details of the changes made:
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.json`) to reflect changes in the reference file `en-GB/translation.json`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
+            - **Format**: TOML
 
             #### **2. Update README.md**
-            - Generated the translation progress table in `README.md`.
+            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
             - Added a summary of the current translation status for all supported languages.
             - Included up-to-date statistics on translation coverage.
 
@@ -115,4 +120,5 @@ jobs:
           sign-commits: true
           add-paths: |
             README.md
-            frontend/public/locales/*/translation.json
+            frontend/public/locales/*/translation.toml
+            scripts/ignore_translation.toml

.github/workflows/tauri-build.yml

@@ -14,27 +14,21 @@ on:
           - macos
           - linux
   pull_request:
-    branches: [main, V2]
+    branches: [main, V2, V2-tauri-windows]
     paths:
       - 'frontend/src-tauri/**'
-      - 'frontend/src/**'
-      - 'frontend/package.json'
-      - 'frontend/package-lock.json'
+      - 'frontend/src/desktop/**'
+      - 'frontend/tsconfig.desktop.json'
       - '.github/workflows/tauri-build.yml'
   push:
     branches: [main, V2]
-    paths:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src/**'
-      - 'frontend/package.json'
-      - 'frontend/package-lock.json'
-      - '.github/workflows/tauri-build.yml'
 
 permissions:
   contents: read
 
 jobs:
   determine-matrix:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -68,6 +62,9 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
     runs-on: ${{ matrix.platform }}
+    env:
+      SM_API_KEY: ${{ secrets.SM_API_KEY }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
@@ -96,8 +93,6 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
-
-
       - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
@@ -181,6 +176,84 @@ jobs:
         working-directory: ./frontend
         run: npm install
 
+      # DigiCert KeyLocker Setup (Cloud HSM)
+      - name: Setup DigiCert KeyLocker
+        id: digicert-setup
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        uses: digicert/ssm-code-signing@v1.1.0
+        env:
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+
+      - name: Setup DigiCert KeyLocker Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "Setting up DigiCert KeyLocker environment..."
+
+          # Decode client certificate
+          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certPath = "D:\Certificate_pkcs12.p12"
+          [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+          # Set environment variables
+          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
+          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+
+          # Get PKCS11 config path from DigiCert action
+          $pkcs11Config = $env:PKCS11_CONFIG
+          if ($pkcs11Config) {
+            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
+            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
+          } else {
+            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
+            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
+            if (Test-Path $defaultPath) {
+              Write-Host "Found config at default path: $defaultPath"
+              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
+            } else {
+              Write-Host "Warning: Could not find PKCS11 config file"
+            }
+          }
+
+      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
+      - name: Import Windows Code Signing Certificate
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        shell: powershell
+        run: |
+          if ($env:WINDOWS_CERTIFICATE) {
+            Write-Host "Importing Windows Code Signing Certificate..."
+
+            # Decode base64 certificate and save to file
+            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
+            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
+            [IO.File]::WriteAllBytes($certPath, $certBytes)
+
+            # Import certificate to CurrentUser\My store
+            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
+
+            # Extract and set thumbprint as environment variable
+            $thumbprint = $cert.Thumbprint
+            Write-Host "Certificate imported with thumbprint: $thumbprint"
+            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
+
+            # Clean up certificate file
+            Remove-Item $certPath
+
+            Write-Host "Windows certificate import completed."
+          } else {
+            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
+          }
+
       - name: Import Apple Developer Certificate
         if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         env:
@@ -236,13 +309,177 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          SIGN: 1
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
+          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
+          # Only enable Windows signing in Tauri when on main
+          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
           args: ${{ matrix.args }}
 
+      # Sign with DigiCert KeyLocker (post-build)
+      - name: Sign Windows binaries with DigiCert KeyLocker
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        run: |
+          Write-Host "=== DigiCert KeyLocker Signing ==="
+
+          # Test smctl connectivity first
+          Write-Host "Testing smctl connection..."
+          $healthCheck = & smctl healthcheck 2>&1
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
+          } else {
+            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
+            Write-Host $healthCheck
+            exit 1
+          }
+          Write-Host ""
+
+          # Sync certificates to Windows certificate store
+          Write-Host "Syncing certificates to Windows certificate store..."
+          $syncOutput = & smctl windows certsync 2>&1
+          Write-Host "Cert sync result: $syncOutput"
+          Write-Host ""
+
+          # List available certificates and check if they have certificates attached
+          Write-Host "Checking for available certificates..."
+          $certList = & smctl keypair ls 2>&1
+          Write-Host "Keypair list output:"
+          Write-Host $certList
+          Write-Host ""
+
+          # Parse the output to check certificate status
+          $lines = $certList -split "`n"
+          $foundKeypair = $false
+          $hasCertificate = $false
+
+          foreach ($line in $lines) {
+            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
+              $foundKeypair = $true
+              Write-Host "[SUCCESS] Found keypair in list"
+
+              # Check if this line has certificate info (not just empty spaces after alias)
+              $parts = $line -split "\s+"
+              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
+                $hasCertificate = $true
+                Write-Host "[SUCCESS] Certificate is associated with keypair"
+              }
+            }
+          }
+
+          if (-not $foundKeypair) {
+            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
+            Write-Host "Available keypairs are listed above"
+            Write-Host ""
+            Write-Host "Please verify:"
+            Write-Host "  1. Keypair alias is correct in GitHub secret"
+            Write-Host "  2. API key has access to this keypair"
+            exit 1
+          }
+
+          if (-not $hasCertificate) {
+            Write-Host "[ERROR] No certificate associated with keypair"
+            Write-Host "This usually means:"
+            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
+            Write-Host "  2. Certificate is pending approval"
+            Write-Host "  3. Certificate needs to be attached to the keypair"
+            Write-Host ""
+            Write-Host "Try running in DigiCert ONE portal:"
+            Write-Host "  smctl keypair sync"
+            exit 1
+          }
+
+          Write-Host "[SUCCESS] Certificate check passed"
+          Write-Host ""
+
+          # Find only the files we need to sign (not build scripts)
+          $filesToSign = @()
+
+          # Main application executable
+          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
+          if ($mainExe) { $filesToSign += $mainExe }
+
+          # MSI installer
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $filesToSign += $msiFiles
+
+          if ($filesToSign.Count -eq 0) {
+            Write-Host "[ERROR] No files found to sign"
+            exit 1
+          }
+
+          Write-Host "Found $($filesToSign.Count) files to sign:"
+          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
+          Write-Host ""
+
+          $signedCount = 0
+          foreach ($file in $filesToSign) {
+            Write-Host "Signing: $($file.Name)"
+
+            # Get PKCS11 config file path (set by DigiCert action)
+            $pkcs11Config = $env:PKCS11_CONFIG
+            if (-not $pkcs11Config) {
+              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
+              Write-Host "DigiCert KeyLocker action may not have run correctly"
+              exit 1
+            }
+
+            Write-Host "Using PKCS11 config: $pkcs11Config"
+
+            # Try signing with certificate fingerprint first (if available)
+            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
+            if ($fingerprint -and $fingerprint -ne "") {
+              Write-Host "Attempting to sign with certificate fingerprint..."
+              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            } else {
+              Write-Host "No fingerprint provided, using keypair alias..."
+              # Use smctl to sign with keypair alias
+              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
+              $exitCode = $LASTEXITCODE
+            }
+
+            Write-Host "Exit code: $exitCode"
+            Write-Host "Output: $output"
+
+            # Check if output contains "FAILED" even with exit code 0
+            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
+              Write-Host ""
+              Write-Host "[ERROR] Signing failed for $($file.Name)"
+              Write-Host "[ERROR] smctl returned success but output indicates failure"
+              Write-Host ""
+              Write-Host "Possible issues:"
+              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
+              Write-Host "  2. Incorrect keypair alias"
+              Write-Host "  3. API key lacks signing permissions"
+              Write-Host ""
+              Write-Host "Please verify in DigiCert ONE portal:"
+              Write-Host "  - Certificate status is 'Issued' (not Pending)"
+              Write-Host "  - Keypair status is 'Online'"
+              Write-Host "  - 'Can sign' is set to 'Yes'"
+              exit 1
+            }
+
+            if ($exitCode -ne 0) {
+              Write-Host "[ERROR] Failed to sign $($file.Name)"
+              Write-Host "Full error output:"
+              Write-Host $output
+              exit 1
+            }
+
+            $signedCount++
+            Write-Host "[SUCCESS] Signed: $($file.Name)"
+            Write-Host ""
+          }
+
+          Write-Host "=== Summary ==="
+          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+
       - name: Verify notarization (macOS only)
         if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         run: |
@@ -276,6 +513,66 @@ jobs:
             find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
+      - name: Verify Windows Code Signature
+        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
+        shell: pwsh
+        run: |
+          Write-Host "Verifying Windows code signatures..."
+
+          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
+          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
+
+          $allSigned = $true
+          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
+          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
+
+          # Check EXE signature
+          if (Test-Path $exePath) {
+            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
+            Write-Host "EXE Signature Status: $($exeSig.Status)"
+            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
+            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
+
+            if ($exeSig.Status -ne "Valid") {
+              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] EXE is properly signed"
+            }
+          }
+
+          # Check MSI signature
+          if (Test-Path $msiPath) {
+            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI Signature Status: $($msiSig.Status)"
+            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
+            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+
+            if ($msiSig.Status -ne "Valid") {
+              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
+              if ($usingKeyLocker -or $usingPfx) {
+                Write-Host "[ERROR] Certificate was provided but signing failed"
+                $allSigned = $false
+              } else {
+                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+              }
+            } else {
+              Write-Host "[SUCCESS] MSI is properly signed"
+            }
+          }
+
+          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
+            Write-Host "[ERROR] Code signing verification failed"
+            exit 1
+          } else {
+            Write-Host "[SUCCESS] Code signature verification completed"
+          }
+
       - name: Upload artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -340,8 +637,10 @@ jobs:
           if [ "${{ needs.build.result }}" = "success" ]; then
             echo "✅ All Tauri builds completed successfully!"
             echo "Artifacts are ready for distribution."
+          elif [ "${{ needs.build.result }}" = "skipped" ]; then
+            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
           else
             echo "❌ Some Tauri builds failed."
             echo "Please check the logs and fix any issues."
             exit 1
-          fi
+          fi

.github/workflows/testdriver.yml

@@ -21,6 +21,7 @@ permissions:
 
 jobs:
   deploy:
+    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -66,7 +67,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./Dockerfile
+          file: ./docker/embedded/Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

.gitignore

@@ -17,8 +17,8 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/watchedFolders/
-pipeline/finishedFolders/
+pipeline/
+!pipeline/.gitkeep
 customFiles/
 configs/
 watchedFolders/
@@ -31,8 +31,23 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json
 
+# Frontend build artifacts copied to backend static resources
+# These are generated by npm build and should not be committed
+app/core/src/main/resources/static/assets/
+app/core/src/main/resources/static/index.html
+app/core/src/main/resources/static/locales/
+app/core/src/main/resources/static/Login/
+app/core/src/main/resources/static/classic-logo/
+app/core/src/main/resources/static/modern-logo/
+app/core/src/main/resources/static/og_images/
+app/core/src/main/resources/static/samples/
+app/core/src/main/resources/static/manifest-classic.json
+app/core/src/main/resources/static/robots.txt
+# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
+
 # Gradle
 .gradle
+.gradle-home
 .lock
 
 # External tool builders
@@ -213,3 +228,17 @@ node_modules/
 test_batch.json
 *.backup.*.json
 frontend/public/locales/*/translation.backup*.json
+
+# Development/build artifacts
+.gradle-cache/
+scripts/pdf-collection/
+**/tmp/
+*.backup
+
+# Type3 development data
+docs/type3/signatures/
+
+
+# Type3 sample PDFs (development only)
+**/type3/samples/
+

ADDING_TOOLS.md

@@ -202,10 +202,10 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-GB/translation.json`
+**File to update:** `frontend/public/locales/en-GB/translation.toml`
 
 **Required Translation Keys**:
-```json
+```toml
 {
   "home": {
     "[toolName]": {
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-GB/translation.json`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

LICENSE

@@ -6,6 +6,10 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
+* All content that resides under the "frontend/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
+* All content that resides under the "frontend/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

README.md

@@ -1,173 +1,69 @@
-<p align="center"><img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80"></p>
-<h1 align="center">Stirling-PDF</h1>
+<p align="center">
+  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
+</p>
 
-[![Docker Pulls](https://img.shields.io/docker/pulls/frooodle/s-pdf)](https://hub.docker.com/r/frooodle/s-pdf)
-[![Discord](https://img.shields.io/discord/1068636748814483718?label=Discord)](https://discord.gg/HYmhKj45pU)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge)](https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF)
-[![GitHub Repo stars](https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social)](https://github.com/Stirling-Tools/stirling-pdf)
+<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
 
-<a href="https://www.producthunt.com/posts/stirling-pdf?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-stirling&#0045;pdf" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=641239&theme=light" alt="Stirling&#0032;PDF - Open&#0032;source&#0032;locally&#0032;hosted&#0032;web&#0032;PDF&#0032;editor | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
-[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/apps/new?repo=https://github.com/Stirling-Tools/Stirling-PDF/tree/digitalOcean&refcode=c3210994b1af)
+Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
 
-[Stirling-PDF](https://www.stirlingpdf.com) is a robust, locally hosted web-based PDF manipulation tool using Docker. It enables you to carry out various operations on PDF files, including splitting, merging, converting, reorganizing, adding images, rotating, compressing, and more. This locally hosted web application has evolved to encompass a comprehensive set of features, addressing all your PDF requirements.
+<p align="center">
+  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
+    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
+  </a>
+  <a href="https://discord.gg/HYmhKj45pU">
+    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
+  </a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
+    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
+  </a>
+  <a href="https://github.com/Stirling-Tools/stirling-pdf">
+    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
+  </a>
+</p>
 
-All files and PDFs exist either exclusively on the client side, reside in server memory only during task execution, or temporarily reside in a file solely for the execution of the task. Any file downloaded by the user will have been deleted from the server by that point.
+![Stirling PDF - Dashboard](images/home-light.png)
 
-Homepage: [https://stirlingpdf.com](https://stirlingpdf.com)
+## Key Capabilities
 
-All documentation available at [https://docs.stirlingpdf.com/](https://docs.stirlingpdf.com/)
+- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
+- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
+- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
+- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
+- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
+- **Global UI** - Interface available in 40+ languages.
 
-![stirling-home](images/stirling-home.jpg)
+For a full feature list, see the docs: **https://docs.stirlingpdf.com**
 
-## Features
+## Quick Start
 
-- 50+ PDF Operations
-- Parallel file processing and downloads
-- Dark mode support
-- Custom download options
-- Custom 'Pipelines' to run multiple features in a automated queue
-- API for integration with external scripts
-- Optional Login and Authentication support (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/System%20and%20Security) for documentation)
-- Database Backup and Import (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/DATABASE) for documentation)
-- Enterprise features like SSO (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/Single%20Sign-On%20Configuration) for documentation)
+```bash
+docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
+```
 
-## PDF Features
+Then open: http://localhost:8080
 
-### Page Operations
+For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
 
-- View and modify PDFs - View multi-page PDFs with custom viewing, sorting, and searching. Plus, on-page edit features like annotating, drawing, and adding text and images. (Using PDF.js with Joxit and Liberation fonts)
-- Full interactive GUI for merging/splitting/rotating/moving PDFs and their pages
-- Merge multiple PDFs into a single resultant file
-- Split PDFs into multiple files at specified page numbers or extract all pages as individual files
-- Reorganize PDF pages into different orders
-- Rotate PDFs in 90-degree increments
-- Remove pages
-- Multi-page layout (format PDFs into a multi-paged page)
-- Scale page contents size by set percentage
-- Adjust contrast
-- Crop PDF
-- Auto-split PDF (with physically scanned page dividers)
-- Extract page(s)
-- Convert PDF to a single page
-- Overlay PDFs on top of each other
-- PDF to a single page
-- Split PDF by sections
+## Resources
 
-### Conversion Operations
+- [**Documentation**](https://docs.stirlingpdf.com)
+- [**Homepage**](https://stirling.com)
+- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
+- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
 
-- Convert PDFs to and from images
-- Convert any common file to PDF (using LibreOffice)
-- Convert PDF to Word/PowerPoint/others (using LibreOffice)
-- Convert HTML to PDF
-- Convert PDF to XML
-- Convert PDF to CSV
-- URL to PDF
-- Markdown to PDF
+## Support
 
-### Security & Permissions
+- **Community** [Discord](https://discord.gg/HYmhKj45pU)
+- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
 
-- Add and remove passwords
-- Change/set PDF permissions
-- Add watermark(s)
-- Certify/sign PDFs
-- Sanitize PDFs
-- Auto-redact text
+## Contributing
 
-### Other Operations
+We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
-- Add/generate/write signatures
-- Split by Size or PDF
-- Repair PDFs
-- Detect and remove blank pages
-- Compare two PDFs and show differences in text
-- Add images to PDFs
-- Compress PDFs to decrease their filesize (using qpdf)
-- Extract images from PDF
-- Remove images from PDF
-- Extract images from scans
-- Remove annotations
-- Add page numbers
-- Auto-rename files by detecting PDF header text
-- OCR on PDF (using Tesseract OCR)
-- PDF/A conversion (using LibreOffice)
-- Edit metadata
-- Flatten PDFs
-- Get all information on a PDF to view or export as JSON
-- Show/detect embedded JavaScript
+For development setup, see the [Developer Guide](DeveloperGuide.md).
 
+For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
 
+## License
 
-# 📖 Get Started
-
-Visit our comprehensive documentation at [docs.stirlingpdf.com](https://docs.stirlingpdf.com) for:
-
-- Installation guides for all platforms
-- Configuration options
-- Feature documentation
-- API reference
-- Security setup
-- Enterprise features
-
-
-## Supported Languages
-
-Stirling-PDF currently supports 40 languages!
-
-| Language                                     | Progress                               |
-| -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![64%](https://geps.dev/progress/64)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![24%](https://geps.dev/progress/24)   |
-| Basque (Euskara) (eu_ES)                     | ![14%](https://geps.dev/progress/14)   |
-| Bulgarian (Български) (bg_BG)                | ![26%](https://geps.dev/progress/26)   |
-| Catalan (Català) (ca_CA)                     | ![26%](https://geps.dev/progress/26)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![24%](https://geps.dev/progress/24)   |
-| Czech (Česky) (cs_CZ)                        | ![26%](https://geps.dev/progress/26)   |
-| Danish (Dansk) (da_DK)                       | ![23%](https://geps.dev/progress/23)   |
-| Dutch (Nederlands) (nl_NL)                   | ![23%](https://geps.dev/progress/23)   |
-| English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
-| English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![63%](https://geps.dev/progress/63)   |
-| German (Deutsch) (de_DE)                     | ![64%](https://geps.dev/progress/64)   |
-| Greek (Ελληνικά) (el_GR)                     | ![26%](https://geps.dev/progress/26)   |
-| Hindi (हिंदी) (hi_IN)                          | ![26%](https://geps.dev/progress/26)   |
-| Hungarian (Magyar) (hu_HU)                   | ![29%](https://geps.dev/progress/29)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![24%](https://geps.dev/progress/24)   |
-| Irish (Gaeilge) (ga_IE)                      | ![26%](https://geps.dev/progress/26)   |
-| Italian (Italiano) (it_IT)                   | ![64%](https://geps.dev/progress/64)   |
-| Japanese (日本語) (ja_JP)                    | ![47%](https://geps.dev/progress/47)   |
-| Korean (한국어) (ko_KR)                      | ![26%](https://geps.dev/progress/26)   |
-| Norwegian (Norsk) (no_NB)                    | ![24%](https://geps.dev/progress/24)   |
-| Persian (فارسی) (fa_IR)                      | ![26%](https://geps.dev/progress/26)   |
-| Polish (Polski) (pl_PL)                      | ![27%](https://geps.dev/progress/27)   |
-| Portuguese (Português) (pt_PT)               | ![26%](https://geps.dev/progress/26)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![64%](https://geps.dev/progress/64)   |
-| Romanian (Română) (ro_RO)                    | ![22%](https://geps.dev/progress/22)   |
-| Russian (Русский) (ru_RU)                    | ![63%](https://geps.dev/progress/63)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![28%](https://geps.dev/progress/28)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![65%](https://geps.dev/progress/65)   |
-| Slovakian (Slovensky) (sk_SK)                | ![19%](https://geps.dev/progress/19)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![27%](https://geps.dev/progress/27)   |
-| Spanish (Español) (es_ES)                    | ![64%](https://geps.dev/progress/64)   |
-| Swedish (Svenska) (sv_SE)                    | ![25%](https://geps.dev/progress/25)   |
-| Thai (ไทย) (th_TH)                           | ![23%](https://geps.dev/progress/23)   |
-| Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![29%](https://geps.dev/progress/29)   |
-| Turkish (Türkçe) (tr_TR)                     | ![28%](https://geps.dev/progress/28)   |
-| Ukrainian (Українська) (uk_UA)               | ![28%](https://geps.dev/progress/28)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![21%](https://geps.dev/progress/21)   |
-| Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
-
-## Stirling PDF Enterprise
-
-Stirling PDF offers an Enterprise edition of its software. This is the same great software but with added features, support and comforts.
-Check out our [Enterprise docs](https://docs.stirlingpdf.com/Pro)
-
-
-## 🤝 Looking to contribute?
-
-Join our community:
-- [Contribution Guidelines](CONTRIBUTING.md)
-- [Translation Guide (How to add custom languages)](devGuide/HowToAddNewLanguage.md)
-- [Developer Guide](devGuide/DeveloperGuide.md)
-- [Issue Tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues)
-- [Discord Community](https://discord.gg/HYmhKj45pU)
+Stirling PDF is open-core. See [LICENSE](LICENSE) for details.

WINDOWS_SIGNING.md

@@ -0,0 +1,258 @@
+# Windows Code Signing Setup Guide
+
+This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
+
+## Overview
+
+Windows code signing is essential for:
+- Preventing Windows SmartScreen warnings
+- Building trust with users
+- Enabling Microsoft Store distribution
+- Professional application distribution
+
+## Certificate Types
+
+### OV Certificate (Organization Validated)
+- More affordable option
+- Requires business verification
+- May trigger SmartScreen warnings initially until reputation builds
+- Suitable for most independent software vendors
+
+### EV Certificate (Extended Validation)
+- Premium option with immediate SmartScreen reputation
+- Requires hardware security module (HSM) or cloud-based signing
+- Higher cost but provides immediate trust
+- Required since June 2023 for new certificates
+
+## Obtaining a Certificate
+
+### Certificate Authorities
+Popular certificate authorities for Windows code signing:
+- DigiCert
+- Sectigo (formerly Comodo)
+- GlobalSign
+- SSL.com
+
+### Certificate Format
+You'll receive a certificate in one of these formats:
+- `.pfx` or `.p12` (preferred - contains both certificate and private key)
+- `.cer` + private key (needs conversion to .pfx)
+
+### Converting to PFX (if needed)
+If you have separate certificate and private key files:
+
+```bash
+openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
+```
+
+## Setting Up GitHub Secrets
+
+### Required Secrets
+
+Navigate to your GitHub repository → Settings → Secrets and variables → Actions
+
+Add the following secrets:
+
+#### 1. `WINDOWS_CERTIFICATE`
+- **Description**: Base64-encoded .pfx certificate file
+- **How to create**:
+
+**On macOS/Linux:**
+```bash
+base64 -i certificate.pfx | pbcopy  # Copies to clipboard
+```
+
+**On Windows (PowerShell):**
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
+```
+
+Paste the entire base64 string into the GitHub secret.
+
+#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
+- **Description**: Password for the .pfx certificate
+- **Value**: The password you set when creating/exporting the .pfx file
+
+### Optional Secrets for Tauri Updater
+
+If you're using Tauri's built-in updater feature:
+
+#### `TAURI_SIGNING_PRIVATE_KEY`
+- Generated using Tauri CLI: `npm run tauri signer generate`
+- Used for update package verification
+
+#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
+- Password for the Tauri signing key
+
+## Configuration Files
+
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
+
+The Windows signing configuration is already set up:
+
+```json
+"windows": {
+  "certificateThumbprint": null,
+  "digestAlgorithm": "sha256",
+  "timestampUrl": "http://timestamp.digicert.com"
+}
+```
+
+**Configuration Options:**
+- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
+- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
+- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
+
+**Alternative Timestamp Servers:**
+- DigiCert: `http://timestamp.digicert.com`
+- Sectigo: `http://timestamp.sectigo.com`
+- GlobalSign: `http://timestamp.globalsign.com`
+
+### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
+
+The workflow includes three Windows signing steps:
+
+1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
+2. **Build Tauri App**: Builds and signs the application using the imported certificate
+3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
+
+## Testing the Setup
+
+### 1. Local Testing (Windows Only)
+
+Before pushing to GitHub, test locally:
+
+```powershell
+# Set environment variables
+$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
+$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
+
+# Build the application
+cd frontend
+npm run tauri build
+
+# Verify the signature
+Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
+```
+
+### 2. GitHub Actions Testing
+
+1. Push your changes to a branch
+2. Manually trigger the workflow:
+   - Go to Actions → Build Tauri Applications
+   - Click "Run workflow"
+   - Select "windows" platform
+3. Check the build logs for:
+   - ✅ Certificate import success
+   - ✅ Build completion
+   - ✅ Signature verification
+
+### 3. Verifying Signed Binaries
+
+After downloading the built artifacts:
+
+**Windows (PowerShell):**
+```powershell
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
+Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
+```
+
+Look for:
+- Status: `Valid`
+- Signer: Your organization name
+- Timestamp: Recent date/time
+
+**Windows (GUI):**
+1. Right-click the .exe or .msi file
+2. Select "Properties"
+3. Go to "Digital Signatures" tab
+4. Verify signature details
+
+## Troubleshooting
+
+### "HashMismatch" Status
+- Certificate doesn't match the binary
+- Possible file corruption during download
+- Re-download and verify
+
+### "NotSigned" Status
+- Certificate wasn't imported correctly
+- Check GitHub secrets are set correctly
+- Verify base64 encoding is complete (no truncation)
+
+### "UnknownError" Status
+- Timestamp server unreachable
+- Try alternative timestamp URL in tauri.conf.json
+- Check network connectivity in GitHub Actions
+
+### SmartScreen Still Shows Warnings
+- Normal for OV certificates initially
+- Reputation builds over time with user downloads
+- Consider EV certificate for immediate reputation
+
+### Certificate Not Found During Build
+- Verify `WINDOWS_CERTIFICATE` secret is set
+- Check base64 encoding is correct (no extra whitespace)
+- Ensure password is correct
+
+## Security Best Practices
+
+1. **Never commit certificates to version control**
+   - Keep .pfx files secure and backed up
+   - Use GitHub secrets for CI/CD
+
+2. **Rotate certificates before expiration**
+   - Set calendar reminders
+   - Update GitHub secrets with new certificate
+
+3. **Use strong passwords**
+   - Certificate password should be complex
+   - Store securely (password manager)
+
+4. **Monitor certificate usage**
+   - Review GitHub Actions logs
+   - Set up notifications for failed builds
+
+5. **Limit access to secrets**
+   - Only repository admins should access secrets
+   - Audit secret access regularly
+
+## Certificate Lifecycle
+
+### Before Expiration
+1. Obtain new certificate from CA (typically annual renewal)
+2. Convert to .pfx format if needed
+3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
+4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
+5. Test build to verify new certificate works
+
+### Expired Certificates
+- Signed binaries remain valid (timestamp proves signing time)
+- New builds will fail until certificate is renewed
+- Users can still install previously signed versions
+
+## Cost Considerations
+
+### Certificate Costs (Annual, as of 2024)
+- **OV Certificate**: $100-400/year
+- **EV Certificate**: $400-1000/year
+
+### Choosing the Right Certificate
+- **Open source / early stage**: Start with OV
+- **Commercial / enterprise**: Consider EV for better trust
+- **Microsoft Store**: EV certificate required
+
+## Additional Resources
+
+- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
+- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
+- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
+- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
+
+## Support
+
+If you encounter issues with Windows code signing:
+1. Check GitHub Actions logs for detailed error messages
+2. Verify all secrets are set correctly
+3. Test certificate locally first (Windows environment required)
+4. Open an issue in the repository with relevant logs (remove sensitive data)

app/common/build.gradle

@@ -37,6 +37,8 @@ dependencies {
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
+    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
+    api "org.apache.pdfbox:preflight:$pdfboxVersion"
     api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:2.10'

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -18,11 +18,37 @@ import stirling.software.common.model.ApplicationProperties;
 @Slf4j
 public class EndpointConfiguration {
 
+    public enum DisableReason {
+        CONFIG,
+        DEPENDENCY,
+        UNKNOWN
+    }
+
+    public static class EndpointAvailability {
+        private final boolean enabled;
+        private final DisableReason reason;
+
+        public EndpointAvailability(boolean enabled, DisableReason reason) {
+            this.enabled = enabled;
+            this.reason = reason;
+        }
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public DisableReason getReason() {
+            return reason;
+        }
+    }
+
     private static final String REMOVE_BLANKS = "remove-blanks";
     private final ApplicationProperties applicationProperties;
     @Getter private Map<String, Boolean> endpointStatuses = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointGroups = new ConcurrentHashMap<>();
     private Set<String> disabledGroups = new HashSet<>();
+    private Map<String, DisableReason> endpointDisableReasons = new ConcurrentHashMap<>();
+    private Map<String, DisableReason> groupDisableReasons = new ConcurrentHashMap<>();
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
@@ -35,16 +61,31 @@ public class EndpointConfiguration {
         processEnvironmentConfigs();
     }
 
+    private String normalizeEndpoint(String endpoint) {
+        if (endpoint == null) {
+            return null;
+        }
+        return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
+    }
+
     public void enableEndpoint(String endpoint) {
-        endpointStatuses.put(endpoint, true);
-        log.debug("Enabled endpoint: {}", endpoint);
+        String normalized = normalizeEndpoint(endpoint);
+        endpointStatuses.put(normalized, true);
+        endpointDisableReasons.remove(normalized);
+        log.debug("Enabled endpoint: {}", normalized);
     }
 
     public void disableEndpoint(String endpoint) {
-        if (!Boolean.FALSE.equals(endpointStatuses.get(endpoint))) {
-            log.debug("Disabling endpoint: {}", endpoint);
+        disableEndpoint(endpoint, DisableReason.CONFIG);
+    }
+
+    public void disableEndpoint(String endpoint, DisableReason reason) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (!Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            log.debug("Disabling endpoint: {}", normalized);
         }
-        endpointStatuses.put(endpoint, false);
+        endpointStatuses.put(normalized, false);
+        endpointDisableReasons.put(normalized, reason);
     }
 
     public boolean isEndpointEnabled(String endpoint) {
@@ -150,6 +191,10 @@ public class EndpointConfiguration {
     }
 
     public void disableGroup(String group) {
+        disableGroup(group, DisableReason.CONFIG);
+    }
+
+    public void disableGroup(String group, DisableReason reason) {
         if (disabledGroups.add(group)) {
             if (isToolGroup(group)) {
                 log.debug(
@@ -161,11 +206,12 @@ public class EndpointConfiguration {
                         group);
             }
         }
+        groupDisableReasons.put(group, reason);
         // Only cascade to endpoints for *functional* groups
         if (!isToolGroup(group)) {
             Set<String> endpoints = endpointGroups.get(group);
             if (endpoints != null) {
-                endpoints.forEach(this::disableEndpoint);
+                endpoints.forEach(endpoint -> disableEndpoint(endpoint, reason));
             }
         }
     }
@@ -174,12 +220,39 @@ public class EndpointConfiguration {
         if (disabledGroups.remove(group)) {
             log.debug("Enabling group: {}", group);
         }
+        groupDisableReasons.remove(group);
         Set<String> endpoints = endpointGroups.get(group);
         if (endpoints != null) {
             endpoints.forEach(this::enableEndpoint);
         }
     }
 
+    public EndpointAvailability getEndpointAvailability(String endpoint) {
+        boolean enabled = isEndpointEnabled(endpoint);
+        DisableReason reason = enabled ? null : determineDisableReason(endpoint);
+        return new EndpointAvailability(enabled, reason);
+    }
+
+    private DisableReason determineDisableReason(String endpoint) {
+        String normalized = normalizeEndpoint(endpoint);
+        if (Boolean.FALSE.equals(endpointStatuses.get(normalized))) {
+            return endpointDisableReasons.getOrDefault(normalized, DisableReason.CONFIG);
+        }
+
+        for (Map.Entry<String, Set<String>> entry : endpointGroups.entrySet()) {
+            String group = entry.getKey();
+            Set<String> endpoints = entry.getValue();
+            if (!disabledGroups.contains(group) || endpoints == null) {
+                continue;
+            }
+            if (endpoints.contains(normalized)) {
+                return groupDisableReasons.getOrDefault(group, DisableReason.CONFIG);
+            }
+        }
+
+        return DisableReason.UNKNOWN;
+    }
+
     public Set<String> getDisabledGroups() {
         return new HashSet<>(disabledGroups);
     }
@@ -261,6 +334,10 @@ public class EndpointConfiguration {
         addEndpointToGroup("Convert", "pdf-to-csv");
         addEndpointToGroup("Convert", "pdf-to-markdown");
         addEndpointToGroup("Convert", "eml-to-pdf");
+        addEndpointToGroup("Convert", "cbz-to-pdf");
+        addEndpointToGroup("Convert", "pdf-to-cbz");
+        addEndpointToGroup("Convert", "pdf-to-json");
+        addEndpointToGroup("Convert", "json-to-pdf");
 
         // Adding endpoints to "Security" group
         addEndpointToGroup("Security", "add-password");
@@ -394,6 +471,10 @@ public class EndpointConfiguration {
         addEndpointToGroup("Java", "pdf-to-markdown");
         addEndpointToGroup("Java", "add-attachments");
         addEndpointToGroup("Java", "compress-pdf");
+        addEndpointToGroup("Java", "cbz-to-pdf");
+        addEndpointToGroup("Java", "pdf-to-cbz");
+        addEndpointToGroup("Java", "pdf-to-json");
+        addEndpointToGroup("Java", "json-to-pdf");
         addEndpointToGroup("rar", "pdf-to-cbr");
 
         // Javascript

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Document analysis and information extraction services for content intelligence and insights.
+                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
+                Use these endpoints to understand what's inside a document without changing it.
 
-                This endpoint group provides analytical capabilities to understand document structure,
-                extract information, and generate insights from PDF content for automated processing.
-
-                Common use cases:
-                • Document inventory management and content audit for compliance verification
-                • Quality assurance workflows and business intelligence analytics
-                • Migration planning, accessibility evaluation, and document forensics
-
-                Business applications:
-                • Legal discovery, financial document review, and healthcare records analysis
-                • Academic research, government processing, and publishing optimization
-
-                Operational scenarios:
-                • Large-scale profiling, migration assessment, and performance optimization
-                • Automated quality control and content strategy development
-
-                Target users: Data analysts, QA teams, administrators, and business intelligence
-                professionals requiring detailed document insights.
+                Typical uses:
+                • Get page counts and dimensions for layout or print rules
+                • List fonts and annotations to spot compatibility issues
+                • Inspect form fields before deciding how to fill or modify them
+                • Pull metadata and security settings for audits or reports
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Document format transformation services for cross-platform compatibility and workflow integration.
+                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
+                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
 
-                This endpoint group enables transformation between various formats, supporting
-                diverse business workflows and system integrations for mixed document ecosystems.
-
-                Common use cases:
-                • Legacy system integration, document migration, and cross-platform sharing
-                • Archive standardization, publishing preparation, and content adaptation
-                • Accessibility compliance and mobile-friendly document preparation
-
-                Business applications:
-                • Enterprise content management, digital publishing, and educational platforms
-                • Legal document processing, healthcare interoperability, and government standardization
-
-                Integration scenarios:
-                • API-driven pipelines, automated workflow preparation, and batch conversions
-                • Real-time format adaptation for user requests
-
-                Target users: System integrators, content managers, digital archivists, and
-                organizations requiring flexible document format interoperability.
+                Typical uses:
+                • Turn PDFs into Word or text for editing
+                • Convert office files, images, HTML, or email (EML) into PDFs
+                • Create PDF/A for long-term archiving
+                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Document content filtering and search operations for information discovery and organization.
+                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
+                Use these endpoints as a "pre-check" step to decide what to do with a file next.
 
-                This endpoint group enables intelligent content discovery and organization within
-                document collections for content-based processing and information extraction.
-
-                Common use cases:
-                • Legal discovery, research organization, and compliance auditing
-                • Content moderation, academic research, and business intelligence
-                • Quality assurance and content validation workflows
-
-                Business applications:
-                • Contract analysis, financial review, and healthcare records organization
-                • Government processing, educational curation, and IP protection
-
-                Workflow scenarios:
-                • Large-scale processing, automated classification, and information extraction
-                • Document preparation for further processing or analysis
-
-                Target users: Legal professionals, researchers, compliance officers, and
-                organizations requiring intelligent document content discovery and organization.
+                Typical uses:
+                • Reject files that are too big or too small
+                • Detect image-only PDFs that should go through OCR
+                • Ensure a document has enough pages before it enters a workflow
+                • Check orientation of pages before printing or merging
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,21 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Core PDF processing operations for fundamental document manipulation workflows.
+                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
+                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
 
-                This endpoint group provides essential PDF functionality that forms the foundation
-                of most document processing workflows across various industries.
-
-                Common use cases:
-                • Document preparation for archival systems and content organization
-                • File preparation for distribution, accessibility compliance, and batch processing
-                • Document consolidation for reporting and legal compliance workflows
-
-                Typical applications:
-                • Content management, publishing workflows, and educational content distribution
-                • Business process automation and archive management
-
-                Target users: Content managers, document processors, and organizations requiring
-                reliable foundational PDF manipulation capabilities.
+                Typical uses:
+                • Split a large PDF into smaller files (by pages, chapters, or size)
+                • Merge several PDFs into one report or pack
+                • Rotate or reorder pages before sending or archiving
+                • Turn a multi-page document into one long scrolling page
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -0,0 +1,37 @@
+package stirling.software.common.annotations.api;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+/**
+ * Combined annotation for Invite management controllers.
+ * Includes @RestController, @RequestMapping("/api/v1/invite"), and OpenAPI @Tag.
+ */
+@Target(ElementType.TYPE)
+@Retention(RetentionPolicy.RUNTIME)
+@RestController
+@RequestMapping("/api/v1/invite")
+@Tag(
+        name = "Invite",
+        description =
+                """
+                Invite-link generation and acceptance endpoints for onboarding new users.
+
+                Provides the ability to issue invitation tokens, send optional email invites,
+                validate and accept invite links, and manage pending invitations for teams.
+
+                Typical use cases include:
+                • Admin workflows for issuing time-limited invitations to external users
+                • Self-service invite acceptance and team assignment
+                • License limit enforcement when provisioning new accounts
+
+                Target users: administrators and automation scripts orchestrating user onboarding.
+                """)
+public @interface InviteApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,25 +22,15 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Specialized utilities and supplementary tools for enhanced document processing workflows.
+                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
+                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
 
-                This endpoint group provides utility operations that support core document processing
-                tasks and address specific workflow needs in real-world scenarios.
-
-                Common use cases:
-                • Document optimization for bandwidth-limited environments and storage cost management
-                • Document repair, content extraction, and validation for quality assurance
-                • Accessibility improvement and custom processing for specialized needs
-
-                Business applications:
-                • Web publishing optimization, email attachment management, and archive efficiency
-                • Mobile compatibility, print production, and legacy document recovery
-
-                Operational scenarios:
-                • Batch processing, quality control, and performance optimization
-                • Troubleshooting and recovery of problematic documents
-
-                Target users: System administrators, document specialists, and organizations requiring
-                specialized document processing and optimization tools.
+                Typical uses:
+                • Repair a damaged PDF or remove blank pages
+                • Run OCR on scanned PDFs so they become searchable
+                • Compress large PDFs for email or web download
+                • Extract embedded images or scans
+                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
+                • Update PDF metadata (title, author, etc.)
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,25 +22,12 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Automated document processing workflows for complex multi-stage business operations.
+                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
+                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
 
-                This endpoint group enables organizations to create sophisticated document processing
-                workflows that combine multiple operations into streamlined, repeatable processes.
-
-                Common use cases:
-                • Invoice processing, legal document review, and healthcare records standardization
-                • Government processing, educational content preparation, and publishing automation
-                • Contract lifecycle management and approval processes
-
-                Business applications:
-                • Automated compliance reporting, large-scale migration, and quality assurance
-                • Archive preparation, content delivery, and document approval workflows
-
-                Operational scenarios:
-                • Scheduled batch processing and event-driven document processing
-                • Multi-department coordination and business system integration
-
-                Target users: Business process managers, IT automation specialists, and organizations
-                requiring consistent, repeatable document processing workflows.
+                Typical uses:
+                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
+                • Normalise documents before they enter an archive
+                • Wrap a complex document flow behind a single API call for your own apps
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,25 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Document security and protection services for confidential and sensitive content.
+                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
+                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
 
-                This endpoint group provides essential security operations for organizations handling
-                sensitive documents and materials requiring controlled access.
-
-                Common use cases:
-                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
-                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
-                • Contract security for business transactions
-
-                Business applications:
-                • Document authentication, confidential sharing, and secure archiving
-                • Content watermarking, access control, and privacy protection through redaction
-
-                Industry scenarios:
-                • Legal discovery, medical records exchange, financial audit documentation
-                • Enterprise policy enforcement and data governance
-
-                Target users: Legal professionals, healthcare administrators, compliance officers,
-                government agencies, and enterprises handling sensitive content.
+                Typical uses:
+                • Add or remove a password on a PDF
+                • Redact personal or confidential information (manually or automatically)
+                • Validate or remove digital signatures
+                • Sanitize a PDF to strip scripts and embedded content
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -112,7 +112,6 @@ public class ApplicationProperties {
     @Data
     public static class Security {
         private Boolean enableLogin;
-        private Boolean csrfDisabled;
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
@@ -575,6 +574,16 @@ public class ApplicationProperties {
         private String username;
         @ToString.Exclude private String password;
         private String from;
+        // STARTTLS upgrades a plain SMTP connection to TLS after connecting (RFC 3207)
+        private Boolean startTlsEnable = true;
+        private Boolean startTlsRequired;
+        // SSL/TLS wrapper for implicit TLS (typically port 465)
+        private Boolean sslEnable;
+        // Hostnames or patterns (e.g., "smtp.example.com" or "*") to trust for TLS certificates;
+        // defaults to "*" (trust all) when not set
+        private String sslTrust;
+        // Enables hostname verification for TLS connections
+        private Boolean sslCheckServerIdentity;
     }
 
     @Data

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -41,7 +41,7 @@ public class CustomPDFDocumentFactory {
 
     // Memory thresholds and limits
 
-    private static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
+    public static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
     // Files smaller than this threshold are loaded entirely in memory for better performance.
     // These files use IOUtils.createMemoryOnlyStreamCache() which keeps all document data in RAM.
     // No temp files are created for document data, reducing I/O operations but consuming more

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -9,6 +9,7 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;
 
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -37,6 +38,9 @@ public class JobExecutorService {
     private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
     private final long effectiveTimeoutMs;
 
+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
+
     public JobExecutorService(
             TaskManager taskManager,
             FileStorage fileStorage,
@@ -98,11 +102,17 @@ public class JobExecutorService {
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
-        String jobId = UUID.randomUUID().toString();
+        // Generate base UUID
+        String baseJobId = UUID.randomUUID().toString();
 
-        // Store the job ID in the request for potential use by other components
+        // Scope job to authenticated user if security is enabled
+        String scopedJobKey = getScopedJobKey(baseJobId);
+
+        log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
+
+        // Store the scoped job ID in the request for potential use by other components
         if (request != null) {
-            request.setAttribute("jobId", jobId);
+            request.setAttribute("jobId", scopedJobKey);
 
             // Also track this job ID in the user's session for authorization purposes
             // This ensures users can only cancel their own jobs
@@ -116,11 +126,13 @@ public class JobExecutorService {
                     request.getSession().setAttribute("userJobIds", userJobIds);
                 }
 
-                userJobIds.add(jobId);
-                log.debug("Added job ID {} to user session", jobId);
+                userJobIds.add(scopedJobKey);
+                log.debug("Added scoped job ID {} to user session", scopedJobKey);
             }
         }
 
+        String jobId = scopedJobKey;
+
         // Determine which timeout to use
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
@@ -149,17 +161,31 @@ public class JobExecutorService {
             taskManager.createTask(jobId);
 
             // Create a specialized wrapper that updates the TaskManager
+            final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
+                            // Set jobId in ThreadLocal context for the queued job
+                            stirling.software.common.util.JobContext.setJobId(
+                                    capturedJobIdForQueue);
+                            log.debug(
+                                    "Set jobId {} in JobContext for queued job execution",
+                                    capturedJobIdForQueue);
+
                             Object result = work.get();
-                            processJobResult(jobId, result);
+                            processJobResult(capturedJobIdForQueue, result);
                             return result;
                         } catch (Exception e) {
                             log.error(
-                                    "Error executing queued job {}: {}", jobId, e.getMessage(), e);
-                            taskManager.setError(jobId, e.getMessage());
+                                    "Error executing queued job {}: {}",
+                                    capturedJobIdForQueue,
+                                    e.getMessage(),
+                                    e);
+                            taskManager.setError(capturedJobIdForQueue, e.getMessage());
                             throw e;
+                        } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
+                            stirling.software.common.util.JobContext.clear();
                         }
                     };
 
@@ -171,21 +197,36 @@ public class JobExecutorService {
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
+
+            // Capture the jobId for the async thread
+            final String capturedJobId = jobId;
+
             executor.execute(
                     () -> {
                         try {
                             log.debug(
-                                    "Running async job {} with timeout {} ms", jobId, timeoutToUse);
+                                    "Running async job {} with timeout {} ms",
+                                    capturedJobId,
+                                    timeoutToUse);
+
+                            // Set jobId in ThreadLocal context for the async thread
+                            stirling.software.common.util.JobContext.setJobId(capturedJobId);
+                            log.debug(
+                                    "Set jobId {} in JobContext for async execution",
+                                    capturedJobId);
 
                             // Execute with timeout
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
-                            processJobResult(jobId, result);
+                            processJobResult(capturedJobId, result);
                         } catch (TimeoutException te) {
                             log.error("Job {} timed out after {} ms", jobId, timeoutToUse);
                             taskManager.setError(jobId, "Job timed out");
                         } catch (Exception e) {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
+                        } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
+                            stirling.software.common.util.JobContext.clear();
                         }
                     });
 
@@ -194,6 +235,10 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
+                // Make jobId available to downstream components on the worker thread
+                stirling.software.common.util.JobContext.setJobId(jobId);
+                log.debug("Set jobId {} in JobContext for sync execution", jobId);
+
                 // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
@@ -213,6 +258,8 @@ public class JobExecutorService {
                 // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
+            } finally {
+                stirling.software.common.util.JobContext.clear();
             }
         }
     }
@@ -466,8 +513,23 @@ public class JobExecutorService {
             throws TimeoutException, Exception {
         // Use the same executor as other async jobs for consistency
         // This ensures all operations run on the same thread pool
+        String currentJobId = stirling.software.common.util.JobContext.getJobId();
+
         java.util.concurrent.CompletableFuture<T> future =
-                java.util.concurrent.CompletableFuture.supplyAsync(supplier, executor);
+                java.util.concurrent.CompletableFuture.supplyAsync(
+                        () -> {
+                            if (currentJobId != null) {
+                                stirling.software.common.util.JobContext.setJobId(currentJobId);
+                            }
+                            try {
+                                return supplier.get();
+                            } finally {
+                                if (currentJobId != null) {
+                                    stirling.software.common.util.JobContext.clear();
+                                }
+                            }
+                        },
+                        executor);
 
         try {
             return future.get(timeoutMs, TimeUnit.MILLISECONDS);
@@ -483,4 +545,18 @@ public class JobExecutorService {
             throw new Exception("Execution was interrupted", e);
         }
     }
+
+    /**
+     * Get a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param baseJobId the base job identifier
+     * @return scoped job key, or just baseJobId if no ownership service available
+     */
+    private String getScopedJobKey(String baseJobId) {
+        if (jobOwnershipService != null) {
+            return jobOwnershipService.createScopedJobKey(baseJobId);
+        }
+        // Security disabled, return unsecured job key
+        return baseJobId;
+    }
 }

app/common/src/main/java/stirling/software/common/service/JobOwnershipService.java

@@ -0,0 +1,42 @@
+package stirling.software.common.service;
+
+import java.util.Optional;
+
+/**
+ * Service interface for managing job ownership and access control. Implementations can provide
+ * user-scoped job isolation when security is enabled, or no-op behavior when security is disabled.
+ */
+public interface JobOwnershipService {
+
+    /**
+     * Get the current authenticated user's identifier.
+     *
+     * @return Optional containing user identifier, or empty if not authenticated
+     */
+    Optional<String> getCurrentUserId();
+
+    /**
+     * Create a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param jobId the base job identifier
+     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
+     */
+    String createScopedJobKey(String jobId);
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param scopedJobKey the scoped job key to validate
+     * @return true if current user owns the job or no authentication is required
+     * @throws SecurityException if current user does not own the job
+     */
+    boolean validateJobAccess(String scopedJobKey);
+
+    /**
+     * Extract the base job ID from a scoped job key.
+     *
+     * @param scopedJobKey the scoped job key
+     * @return the base job ID without user prefix
+     */
+    String extractJobId(String scopedJobKey);
+}

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -0,0 +1,21 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+
+/**
+ * Interface for personal signature access (proprietary feature). Implemented only in proprietary
+ * module to provide authenticated users access to their personal signatures.
+ */
+public interface PersonalSignatureServiceInterface {
+
+    /**
+     * Get a personal signature from the user's folder. Only checks personal folder, not shared
+     * folder.
+     *
+     * @param username Username of the signature owner
+     * @param fileName Signature filename
+     * @return Personal signature image bytes
+     * @throws IOException If file not found or read error
+     */
+    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
+}

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -254,10 +254,7 @@ public class PostHogService {
                 properties,
                 "security_enableLogin",
                 applicationProperties.getSecurity().getEnableLogin());
-        addIfNotEmpty(
-                properties,
-                "security_csrfDisabled",
-                applicationProperties.getSecurity().getCsrfDisabled());
+        addIfNotEmpty(properties, "security_csrfDisabled", true);
         addIfNotEmpty(
                 properties,
                 "security_loginAttemptCount",

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -38,6 +38,7 @@ public class GeneralUtils {
             Set.of(
                     "OCR images.json",
                     "Prepare-pdfs-for-email.json",
+                    "Pre-publish-sanitization.json",
                     "split-rotate-auto-rename.json");
 
     private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -0,0 +1,18 @@
+package stirling.software.common.util;
+
+/** Thread-local context for passing job ID across async boundaries */
+public class JobContext {
+    private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
+
+    public static void setJobId(String jobId) {
+        CURRENT_JOB_ID.set(jobId);
+    }
+
+    public static String getJobId() {
+        return CURRENT_JOB_ID.get();
+    }
+
+    public static void clear() {
+        CURRENT_JOB_ID.remove();
+    }
+}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -96,6 +96,7 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getOcrMyPdfSessionLimit();
+                                case CFF_CONVERTER -> 1;
                             };
 
                     long timeoutMinutes =
@@ -150,6 +151,7 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getOcrMyPdfTimeoutMinutes();
+                                case CFF_CONVERTER -> 5L;
                             };
                     return new ProcessExecutor(semaphoreLimit, liveUpdates, timeoutMinutes);
                 });
@@ -302,7 +304,8 @@ public class ProcessExecutor {
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,
-        OCR_MY_PDF
+        OCR_MY_PDF,
+        CFF_CONVERTER
     }
 
     @Setter

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -7,23 +7,104 @@ public class RequestUriUtils {
     }
 
     public static boolean isStaticResource(String contextPath, String requestURI) {
-        return requestURI.startsWith(contextPath + "/css/")
-                || requestURI.startsWith(contextPath + "/fonts/")
-                || requestURI.startsWith(contextPath + "/js/")
-                || requestURI.endsWith(contextPath + "robots.txt")
-                || requestURI.startsWith(contextPath + "/images/")
-                || requestURI.startsWith(contextPath + "/public/")
-                || requestURI.startsWith(contextPath + "/pdfjs/")
-                || requestURI.startsWith(contextPath + "/pdfjs-legacy/")
-                || requestURI.startsWith(contextPath + "/login")
-                || requestURI.startsWith(contextPath + "/error")
-                || requestURI.startsWith(contextPath + "/favicon")
-                || requestURI.endsWith(".svg")
-                || requestURI.endsWith(".png")
-                || requestURI.endsWith(".ico")
-                || requestURI.endsWith(".txt")
-                || requestURI.endsWith(".webmanifest")
-                || requestURI.startsWith(contextPath + "/api/v1/info/status");
+        if (requestURI == null) {
+            return false;
+        }
+
+        String normalizedUri = stripContextPath(contextPath, requestURI);
+
+        // API routes are never static except for the public status endpoint
+        if (normalizedUri.startsWith("/api/")) {
+            return normalizedUri.startsWith("/api/v1/info/status");
+        }
+
+        // Well-known static asset directories (backend + React build artifacts)
+        if (normalizedUri.startsWith("/css/")
+                || normalizedUri.startsWith("/fonts/")
+                || normalizedUri.startsWith("/js/")
+                || normalizedUri.startsWith("/images/")
+                || normalizedUri.startsWith("/public/")
+                || normalizedUri.startsWith("/pdfjs/")
+                || normalizedUri.startsWith("/pdfjs-legacy/")
+                || normalizedUri.startsWith("/assets/")
+                || normalizedUri.startsWith("/locales/")
+                || normalizedUri.startsWith("/Login/")
+                || normalizedUri.startsWith("/samples/")
+                || normalizedUri.startsWith("/classic-logo/")
+                || normalizedUri.startsWith("/modern-logo/")
+                || normalizedUri.startsWith("/og_images/")) {
+            return true;
+        }
+
+        // Specific static files bundled with the frontend
+        if (normalizedUri.equals("/robots.txt")
+                || normalizedUri.equals("/favicon.ico")
+                || normalizedUri.equals("/manifest.json")
+                || normalizedUri.equals("/site.webmanifest")
+                || normalizedUri.equals("/manifest-classic.json")
+                || normalizedUri.equals("/index.html")) {
+            return true;
+        }
+
+        // Login/error pages remain public
+        if (normalizedUri.startsWith("/login") || normalizedUri.startsWith("/error")) {
+            return true;
+        }
+
+        // Treat common static file extensions as static resources
+        return normalizedUri.endsWith(".svg")
+                || normalizedUri.endsWith(".png")
+                || normalizedUri.endsWith(".ico")
+                || normalizedUri.endsWith(".txt")
+                || normalizedUri.endsWith(".webmanifest")
+                || normalizedUri.endsWith(".js")
+                || normalizedUri.endsWith(".css")
+                || normalizedUri.endsWith(".mjs")
+                || normalizedUri.endsWith(".html")
+                || normalizedUri.endsWith(".toml");
+    }
+
+    public static boolean isFrontendRoute(String contextPath, String requestURI) {
+        if (requestURI == null) {
+            return false;
+        }
+
+        String normalizedUri = stripContextPath(contextPath, requestURI);
+
+        // APIs are never treated as frontend routes
+        if (normalizedUri.startsWith("/api/")) {
+            return false;
+        }
+
+        // Blocklist of backend/non-frontend paths that should still go through filters
+        String[] backendOnlyPrefixes = {
+            "/register",
+            "/invite",
+            "/pipeline",
+            "/pdfjs",
+            "/pdfjs-legacy",
+            "/fonts",
+            "/images",
+            "/files",
+            "/css",
+            "/js",
+            "/swagger",
+            "/v1/api-docs",
+            "/actuator"
+        };
+
+        for (String prefix : backendOnlyPrefixes) {
+            if (normalizedUri.equals(prefix) || normalizedUri.startsWith(prefix + "/")) {
+                return false;
+            }
+        }
+
+        if (normalizedUri.isBlank()) {
+            return false;
+        }
+
+        // Allow root and any extensionless path (React Router will handle these)
+        return !normalizedUri.contains(".");
     }
 
     public static boolean isTrackableResource(String requestURI) {
@@ -43,6 +124,7 @@ public class RequestUriUtils {
                 || requestURI.endsWith(".svg")
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
+                || requestURI.endsWith(".toml")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
@@ -78,9 +160,17 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith(
                         "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
                 // enableLogin)
-                || trimmedUri.startsWith("/v1/api-docs")
+                || trimmedUri.startsWith(
+                        "/api/v1/ui-data/footer-info") // Public footer configuration
                 || trimmedUri.startsWith("/api/v1/invite/validate")
                 || trimmedUri.startsWith("/api/v1/invite/accept")
-                || trimmedUri.contains("/v1/api-docs");
+                || trimmedUri.startsWith("/v1/api-docs");
+    }
+
+    private static String stripContextPath(String contextPath, String requestURI) {
+        if (contextPath != null && !contextPath.isBlank() && requestURI.startsWith(contextPath)) {
+            return requestURI.substring(contextPath.length());
+        }
+        return requestURI;
     }
 }

app/common/src/test/java/stirling/software/common/service/JobExecutorServiceTest.java

@@ -78,6 +78,23 @@ class JobExecutorServiceTest {
         verify(request).setAttribute(eq("jobId"), anyString());
     }
 
+    @Test
+    void shouldExposeJobIdInJobContextDuringSyncExecution() throws Exception {
+        // Given
+        Supplier<Object> work = stirling.software.common.util.JobContext::getJobId;
+
+        // When
+        ResponseEntity<?> response = jobExecutorService.runJobGeneric(false, work);
+
+        // Then
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertNotNull(response.getBody());
+
+        var requestJobIdCaptor = ArgumentCaptor.forClass(String.class);
+        verify(request).setAttribute(eq("jobId"), requestJobIdCaptor.capture());
+        assertEquals(requestJobIdCaptor.getValue(), response.getBody());
+    }
+
     @Test
     void shouldRunAsyncJobSuccessfully() throws Exception {
         // Given

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -49,6 +49,27 @@ public class RequestUriUtilsTest {
                 "API products should not be static");
     }
 
+    @Test
+    void testIsFrontendRoute() {
+        assertTrue(
+                RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
+        assertTrue(
+                RequestUriUtils.isFrontendRoute("", "/app/dashboard"),
+                "React routes without extensions should be frontend routes");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/api/v1/users"),
+                "API routes should not be frontend routes");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/register"),
+                "Register should not be treated as a frontend route");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/pipeline/jobs"),
+                "Pipeline should not be treated as a frontend route");
+        assertFalse(
+                RequestUriUtils.isFrontendRoute("", "/files/download"),
+                "Files path should not be treated as a frontend route");
+    }
+
     @Test
     void testIsStaticResourceWithContextPath() {
         String contextPath = "/myapp";
@@ -83,6 +104,7 @@ public class RequestUriUtilsTest {
                 "/favicon.ico",
                 "/icon.svg",
                 "/image.png",
+                "/locales/en/translation.toml",
                 "/site.webmanifest",
                 "/app/logo.svg",
                 "/downloads/document.png",

app/core/build.gradle

@@ -1,5 +1,7 @@
 apply plugin: 'org.springframework.boot'
 
+import org.apache.tools.ant.taskdefs.condition.Os
+
 repositories {
     maven { url = 'https://build.shibboleth.net/maven/releases' }
     maven { url = 'https://maven.pkg.github.com/jcefmaven/jcefmaven' }
@@ -15,6 +17,7 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
+        targetExclude 'src/main/resources/static/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
@@ -25,12 +28,14 @@ spotless {
     }
     yaml {
         target '**/*.yml', '**/*.yaml'
+        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
     }
     format 'gradle', {
         target '**/gradle/*.gradle', '**/*.gradle'
+        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -157,5 +162,125 @@ springBoot {
     mainClass = 'stirling.software.SPDF.SPDFApplication'
 }
 
+// Frontend build tasks - only enabled with -PbuildWithFrontend=true
+def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
+def frontendDir = file('../../frontend')
+def frontendDistDir = file('../../frontend/dist')
+def resourcesStaticDir = file('src/main/resources/static')
+def generatedFrontendPaths = [
+    'assets',
+    'index.html',
+    'locales',
+    'Login',
+    'classic-logo',
+    'modern-logo',
+    'og_images',
+    'samples',
+    'manifest-classic.json'
+]
+
+tasks.register('npmInstall', Exec) {
+    enabled = buildWithFrontend
+    group = 'frontend'
+    description = 'Install frontend dependencies'
+    workingDir frontendDir
+    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
+    inputs.file(new File(frontendDir, 'package.json'))
+    inputs.file(new File(frontendDir, 'package-lock.json'))
+    outputs.dir(new File(frontendDir, 'node_modules'))
+
+    // Show live output
+    standardOutput = System.out
+    errorOutput = System.err
+
+    // Skip if node_modules exists and is up-to-date
+    onlyIf {
+        def nodeModules = new File(frontendDir, 'node_modules')
+        if (!nodeModules.exists()) {
+            println "node_modules not found, will install..."
+            return true
+        }
+        def packageJson = new File(frontendDir, 'package.json')
+        def packageLock = new File(frontendDir, 'package-lock.json')
+        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
+                        nodeModules.lastModified() < packageLock.lastModified()
+        if (isOutdated) {
+            println "package.json or package-lock.json changed, will reinstall..."
+        } else {
+            println "node_modules is up-to-date, skipping npm install"
+        }
+        return isOutdated
+    }
+
+    doFirst {
+        println "Installing npm dependencies in ${frontendDir}..."
+    }
+}
+
+tasks.register('npmBuild', Exec) {
+    enabled = buildWithFrontend
+    group = 'frontend'
+    description = 'Build frontend application'
+    workingDir frontendDir
+    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
+    dependsOn npmInstall
+    inputs.dir(new File(frontendDir, 'src'))
+    inputs.file(new File(frontendDir, 'package.json'))
+    outputs.dir(frontendDistDir)
+
+    // Show live output
+    standardOutput = System.out
+    errorOutput = System.err
+
+    // Override VITE_API_BASE_URL to use relative paths for production builds
+    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
+    environment 'VITE_API_BASE_URL', '/'
+
+    doFirst {
+        println "Building frontend application for production (VITE_API_BASE_URL=/)"
+    }
+}
+
+tasks.register('copyFrontendAssets', Copy) {
+    enabled = buildWithFrontend
+    group = 'frontend'
+    description = 'Copy frontend build to static resources'
+    dependsOn npmBuild
+    from(frontendDistDir) {
+        // Exclude files that conflict with backend static resources
+        exclude 'robots.txt'  // Backend already has this
+        exclude 'favicon.ico' // Backend already has this
+    }
+    into resourcesStaticDir
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
+    doFirst {
+        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
+        println "Backend static resources will be preserved"
+    }
+    doLast {
+        println "Frontend assets copied successfully!"
+    }
+}
+
+tasks.register('cleanFrontendAssets', Delete) {
+    group = 'frontend'
+    description = 'Remove previously generated frontend assets from static resources'
+    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
+}
+
+// Ensure copyFrontendAssets runs after spotless tasks
+tasks.named('copyFrontendAssets').configure {
+    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
+}
+
+if (buildWithFrontend) {
+    println "Frontend build enabled - JAR will include React frontend"
+    processResources.dependsOn copyFrontendAssets
+} else {
+    println "Frontend build disabled - JAR will be backend-only"
+    // When not building the UI, ensure any stale frontend assets are removed
+    processResources.dependsOn cleanFrontendAssets
+}
+
 bootJar.dependsOn ':common:jar'
 bootJar.dependsOn ':proprietary:jar'

app/core/src/main/java/stirling/software/SPDF/SPDFApplication.java

@@ -12,6 +12,8 @@ import java.util.Properties;
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.web.context.WebServerInitializedEvent;
+import org.springframework.context.event.EventListener;
 import org.springframework.core.env.Environment;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
@@ -198,6 +200,14 @@ public class SPDFApplication {
         // }
     }
 
+    @EventListener
+    public void onWebServerInitialized(WebServerInitializedEvent event) {
+        int actualPort = event.getWebServer().getPort();
+        serverPortStatic = String.valueOf(actualPort);
+        // Log the actual runtime port for Tauri to parse
+        log.info("Stirling-PDF running on port: {}", actualPort);
+    }
+
     private static void printStartupLogs() {
         log.info("Stirling-PDF Started.");
         String url = baseUrlStatic + ":" + getStaticPort() + contextPathStatic;

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -12,6 +12,7 @@ import jakarta.annotation.PostConstruct;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.RegexPatternUtils;
 
@@ -24,6 +25,7 @@ public class ExternalAppDepConfig {
     private final String weasyprintPath;
     private final String unoconvPath;
     private final Map<String, List<String>> commandToGroupMapping;
+    private volatile boolean dependenciesChecked = false;
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -97,7 +99,7 @@ public class ExternalAppDepConfig {
             if (affectedGroups != null) {
                 for (String group : affectedGroups) {
                     List<String> affectedFeatures = getAffectedFeatures(group);
-                    endpointConfiguration.disableGroup(group);
+                    endpointConfiguration.disableGroup(group, DisableReason.DEPENDENCY);
                     log.warn(
                             "Missing dependency: {} - Disabling group: {} (Affected features: {})",
                             command,
@@ -110,6 +112,10 @@ public class ExternalAppDepConfig {
         }
     }
 
+    public boolean isDependenciesChecked() {
+        return dependenciesChecked;
+    }
+
     @PostConstruct
     public void checkDependencies() {
         // Check core dependencies
@@ -127,8 +133,8 @@ public class ExternalAppDepConfig {
         if (!pythonAvailable) {
             List<String> pythonFeatures = getAffectedFeatures("Python");
             List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-            endpointConfiguration.disableGroup("Python");
-            endpointConfiguration.disableGroup("OpenCV");
+            endpointConfiguration.disableGroup("Python", DisableReason.DEPENDENCY);
+            endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
             log.warn(
                     "Missing dependency: Python - Disabling Python features: {} and OpenCV features: {}",
                     String.join(", ", pythonFeatures),
@@ -146,14 +152,14 @@ public class ExternalAppDepConfig {
                 int exitCode = process.waitFor();
                 if (exitCode != 0) {
                     List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                    endpointConfiguration.disableGroup("OpenCV");
+                    endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                     log.warn(
                             "OpenCV not available in Python - Disabling OpenCV features: {}",
                             String.join(", ", openCVFeatures));
                 }
             } catch (Exception e) {
                 List<String> openCVFeatures = getAffectedFeatures("OpenCV");
-                endpointConfiguration.disableGroup("OpenCV");
+                endpointConfiguration.disableGroup("OpenCV", DisableReason.DEPENDENCY);
                 log.warn(
                         "Error checking OpenCV: {} - Disabling OpenCV features: {}",
                         e.getMessage(),
@@ -161,5 +167,7 @@ public class ExternalAppDepConfig {
             }
         }
         endpointConfiguration.logDisabledEndpointsSummary();
+        dependenciesChecked = true;
+        log.info("Dependency checks completed");
     }
 }

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -34,7 +34,6 @@ public class InitialSetup {
     public void init() throws IOException {
         initUUIDKey();
         initSecretKey();
-        initEnableCSRFSecurity();
         initLegalUrls();
         initSetAppVersion();
         GeneralUtils.extractPipeline();
@@ -60,18 +59,6 @@ public class InitialSetup {
         }
     }
 
-    public void initEnableCSRFSecurity() throws IOException {
-        if (GeneralUtils.isVersionHigher(
-                "0.46.0", applicationProperties.getAutomaticallyGenerated().getAppVersion())) {
-            Boolean csrf = applicationProperties.getSecurity().getCsrfDisabled();
-            if (!csrf) {
-                GeneralUtils.saveKeyToSettings("security.csrfDisabled", false);
-                GeneralUtils.saveKeyToSettings("system.enableAnalytics", true);
-                applicationProperties.getSecurity().setCsrfDisabled(false);
-            }
-        }
-    }
-
     public void initLegalUrls() throws IOException {
         // Initialize Terms and Conditions
         String termsUrl = applicationProperties.getLegal().getTermsAndConditions();
@@ -95,7 +82,7 @@ public class InitialSetup {
         isNewServer =
                 existingVersion == null
                         || existingVersion.isEmpty()
-                        || existingVersion.equals("0.0.0");
+                        || "0.0.0".equals(existingVersion);
 
         String appVersion = "0.0.0";
         Resource resource = new ClassPathResource("version.properties");

app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java

@@ -62,10 +62,15 @@ public class OpenApiConfig {
 
         // Add server configuration from environment variable
         String swaggerServerUrl = System.getenv("SWAGGER_SERVER_URL");
+        Server server;
         if (swaggerServerUrl != null && !swaggerServerUrl.trim().isEmpty()) {
-            Server server = new Server().url(swaggerServerUrl).description("API Server");
-            openAPI.addServersItem(server);
+            server = new Server().url(swaggerServerUrl).description("API Server");
+        } else {
+            // Use relative path so Swagger uses the current browser origin to avoid CORS issues
+            // when accessing via different ports
+            server = new Server().url("/").description("Current Server");
         }
+        openAPI.addServersItem(server);
 
         // Add ErrorResponse schema to components
         Schema<?> errorResponseSchema =

app/core/src/main/java/stirling/software/SPDF/config/SpringDocConfig.java

@@ -21,6 +21,9 @@ public class SpringDocConfig {
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
                         "/api/v1/team/**",
+                        "/api/v1/auth/**",
+                        "/api/v1/invite/**",
+                        "/api/v1/audit/**",
                         "/api/v1/ui-data/**",
                         "/api/v1/proprietary/ui-data/**",
                         "/api/v1/info/**",
@@ -33,7 +36,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - Processing API")
                                             .description(
-                                                    "API documentation for PDF processing operations including conversion, manipulation, security, and utilities."));
+                                                    "APIs for converting, editing, securing, and analysing PDF documents. Use these endpoints to automate common PDF tasks (like split, merge, convert, OCR) and plug them into your own apps and backend jobs."));
                         })
                 .build();
     }
@@ -47,14 +50,17 @@ public class SpringDocConfig {
                         "/api/v1/admin/**",
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
-                        "/api/v1/team/**")
+                        "/api/v1/team/**",
+                        "/api/v1/auth/**",
+                        "/api/v1/invite/**",
+                        "/api/v1/audit/**")
                 .addOpenApiCustomizer(
                         openApi -> {
                             openApi.info(
                                     openApi.getInfo()
-                                            .title("Stirling PDF - Admin API")
+                                            .title("Stirling PDF - Management API")
                                             .description(
-                                                    "API documentation for administrative functions, user management, and system configuration."));
+                                                    "Endpoints for authentication, user management, invitations, audit logging, and system configuration."));
                         })
                 .build();
     }
@@ -76,7 +82,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - System API")
                                             .description(
-                                                    "API documentation for system information, UI data, and utility endpoints."));
+                                                    "System information, UI metadata, job status, and file management endpoints."));
                         })
                 .build();
     }

app/core/src/main/java/stirling/software/SPDF/config/WAUTrackingFilter.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.config;
+
+import java.io.IOException;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
+
+/**
+ * Filter to track browser IDs for Weekly Active Users (WAU) counting. Only active when security is
+ * disabled (no-login mode).
+ */
+@Component
+@ConditionalOnProperty(name = "security.enableLogin", havingValue = "false")
+@RequiredArgsConstructor
+@Slf4j
+public class WAUTrackingFilter implements Filter {
+
+    private final WeeklyActiveUsersService wauService;
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        if (request instanceof HttpServletRequest httpRequest) {
+            // Extract browser ID from header
+            String browserId = httpRequest.getHeader("X-Browser-Id");
+
+            if (browserId != null && !browserId.trim().isEmpty()) {
+                // Record browser access
+                wauService.recordBrowserAccess(browserId);
+            }
+        }
+
+        // Continue the filter chain
+        chain.doFilter(request, response);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -1,10 +1,14 @@
 package stirling.software.SPDF.config;
 
+import java.util.concurrent.TimeUnit;
+
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.CacheControl;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import lombok.RequiredArgsConstructor;
@@ -25,6 +29,20 @@ public class WebMvcConfig implements WebMvcConfigurer {
         registry.addInterceptor(endpointInterceptor);
     }
 
+    @Override
+    public void addResourceHandlers(ResourceHandlerRegistry registry) {
+        // Cache hashed assets (JS/CSS with content hashes) for 1 year
+        // These files have names like index-ChAS4tCC.js that change when content changes
+        registry.addResourceHandler("/assets/**")
+                .addResourceLocations("classpath:/static/assets/")
+                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS).cachePublic());
+
+        // Don't cache index.html - it needs to be fresh to reference latest hashed assets
+        registry.addResourceHandler("/index.html")
+                .addResourceLocations("classpath:/static/")
+                .setCacheControl(CacheControl.noCache().mustRevalidate());
+    }
+
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         // Check if running in Tauri mode
@@ -42,12 +60,28 @@ public class WebMvcConfig implements WebMvcConfigurer {
             // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
             logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
             registry.addMapping("/**")
-                    .allowedOrigins(
+                    .allowedOriginPatterns(
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         } else if (hasConfiguredOrigins) {
@@ -63,13 +97,53 @@ public class WebMvcConfig implements WebMvcConfigurer {
                             .toArray(new String[0]);
 
             registry.addMapping("/**")
-                    .allowedOrigins(allowedOrigins)
-                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
-                    .allowedHeaders("*")
+                    .allowedOriginPatterns(allowedOrigins)
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
+                    .allowCredentials(true)
+                    .maxAge(3600);
+        } else {
+            // Default to allowing all origins when nothing is configured
+            logger.info(
+                    "No CORS allowed origins configured in settings.yml (system.corsAllowedOrigins); allowing all origins.");
+            registry.addMapping("/**")
+                    .allowedOriginPatterns("*")
+                    .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+                    .allowedHeaders(
+                            "Authorization",
+                            "Content-Type",
+                            "X-Requested-With",
+                            "Accept",
+                            "Origin",
+                            "X-API-KEY",
+                            "X-CSRF-TOKEN",
+                            "X-XSRF-TOKEN",
+                            "X-Browser-Id")
+                    .exposedHeaders(
+                            "WWW-Authenticate",
+                            "X-Total-Count",
+                            "X-Page-Number",
+                            "X-Page-Size",
+                            "Content-Disposition",
+                            "Content-Type")
                     .allowCredentials(true)
                     .maxAge(3600);
         }
-        // If no origins are configured and not in Tauri mode, CORS is not enabled (secure by
-        // default)
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/EditTableOfContentsController.java

@@ -29,7 +29,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.SPDF.config.swagger.JsonDataResponse;
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.EditTableOfContentsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
@@ -49,13 +48,12 @@ public class EditTableOfContentsController {
     @AutoJobPostMapping(
             value = "/extract-bookmarks",
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
-    @JsonDataResponse
     @Operation(
             summary = "Extract PDF Bookmarks",
             description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
     @ResponseBody
-    public List<Map<String, Object>> extractBookmarks(@RequestParam("file") MultipartFile file)
-            throws Exception {
+    public ResponseEntity<List<Map<String, Object>>> extractBookmarks(
+            @RequestParam("file") MultipartFile file) throws Exception {
         PDDocument document = null;
         try {
             document = pdfDocumentFactory.load(file);
@@ -63,10 +61,10 @@ public class EditTableOfContentsController {
 
             if (outline == null) {
                 log.info("No outline/bookmarks found in PDF");
-                return new ArrayList<>();
+                return ResponseEntity.ok(new ArrayList<>());
             }
 
-            return extractBookmarkItems(document, outline);
+            return ResponseEntity.ok(extractBookmarkItems(document, outline));
         } finally {
             if (document != null) {
                 document.close();

app/core/src/main/java/stirling/software/SPDF/controller/api/SettingsController.java

@@ -124,7 +124,6 @@ public class SettingsController {
         ApplicationProperties.Security security = applicationProperties.getSecurity();
 
         settings.put("enableLogin", security.getEnableLogin());
-        settings.put("csrfDisabled", security.getCsrfDisabled());
         settings.put("loginMethod", security.getLoginMethod());
         settings.put("loginAttemptCount", security.getLoginAttemptCount());
         settings.put("loginResetTimeMinutes", security.getLoginResetTimeMinutes());
@@ -159,12 +158,6 @@ public class SettingsController {
                     .getSecurity()
                     .setEnableLogin((Boolean) settings.get("enableLogin"));
         }
-        if (settings.containsKey("csrfDisabled")) {
-            GeneralUtils.saveKeyToSettings("security.csrfDisabled", settings.get("csrfDisabled"));
-            applicationProperties
-                    .getSecurity()
-                    .setCsrfDisabled((Boolean) settings.get("csrfDisabled"));
-        }
         if (settings.containsKey("loginMethod")) {
             GeneralUtils.saveKeyToSettings("security.loginMethod", settings.get("loginMethod"));
             applicationProperties

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -26,7 +26,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.Dependency;
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SignatureService;
+import stirling.software.SPDF.service.SharedSignatureService;
 import stirling.software.common.annotations.api.UiDataApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
@@ -40,14 +40,14 @@ import stirling.software.common.util.GeneralUtils;
 public class UIDataController {
 
     private final ApplicationProperties applicationProperties;
-    private final SignatureService signatureService;
+    private final SharedSignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
-            SignatureService signatureService,
+            SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {
@@ -58,6 +58,21 @@ public class UIDataController {
         this.runtimePathConfig = runtimePathConfig;
     }
 
+    @GetMapping("/footer-info")
+    @Operation(summary = "Get public footer configuration data")
+    public ResponseEntity<FooterData> getFooterData() {
+        FooterData data = new FooterData();
+        data.setAnalyticsEnabled(applicationProperties.getSystem().getEnableAnalytics());
+        data.setTermsAndConditions(applicationProperties.getLegal().getTermsAndConditions());
+        data.setPrivacyPolicy(applicationProperties.getLegal().getPrivacyPolicy());
+        data.setAccessibilityStatement(
+                applicationProperties.getLegal().getAccessibilityStatement());
+        data.setCookiePolicy(applicationProperties.getLegal().getCookiePolicy());
+        data.setImpressum(applicationProperties.getLegal().getImpressum());
+
+        return ResponseEntity.ok(data);
+    }
+
     @GetMapping("/home")
     @Operation(summary = "Get home page data")
     public ResponseEntity<HomeData> getHomeData() {
@@ -237,6 +252,16 @@ public class UIDataController {
     }
 
     // Data classes
+    @Data
+    public static class FooterData {
+        private Boolean analyticsEnabled;
+        private String termsAndConditions;
+        private String privacyPolicy;
+        private String accessibilityStatement;
+        private String cookiePolicy;
+        private String impressum;
+    }
+
     @Data
     public static class HomeData {
         private boolean showSurveyFromDocker;

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -0,0 +1,225 @@
+package stirling.software.SPDF.controller.api.converters;
+
+import java.util.Optional;
+import java.util.UUID;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.multipart.MultipartFile;
+
+import io.github.pixee.security.Filenames;
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.config.swagger.StandardPdfResponse;
+import stirling.software.SPDF.model.json.PdfJsonDocument;
+import stirling.software.SPDF.model.json.PdfJsonMetadata;
+import stirling.software.SPDF.service.PdfJsonConversionService;
+import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.common.annotations.api.ConvertApi;
+import stirling.software.common.model.api.GeneralFile;
+import stirling.software.common.model.api.PDFFile;
+import stirling.software.common.service.JobOwnershipService;
+import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.WebResponseUtils;
+
+@Slf4j
+@ConvertApi
+@RequiredArgsConstructor
+public class ConvertPdfJsonController {
+
+    private final PdfJsonConversionService pdfJsonConversionService;
+
+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
+
+    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor")
+    @Operation(
+            summary = "Convert PDF to Text Editor Format",
+            description =
+                    "Extracts PDF text, fonts, and metadata into an editable JSON structure for the text editor tool. Input:PDF Output:JSON Type:SISO")
+    public ResponseEntity<byte[]> convertPdfToJson(
+            @ModelAttribute PDFFile request,
+            @RequestParam(value = "lightweight", defaultValue = "false") boolean lightweight)
+            throws Exception {
+        MultipartFile inputFile = request.getFileInput();
+        if (inputFile == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        byte[] jsonBytes = pdfJsonConversionService.convertPdfToJson(inputFile, lightweight);
+        String originalName = inputFile.getOriginalFilename();
+        String baseName =
+                (originalName != null && !originalName.isBlank())
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        : "document";
+        String docName = baseName + ".json";
+        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+    }
+
+    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/text-editor/pdf")
+    @StandardPdfResponse
+    @Operation(
+            summary = "Convert Text Editor Format to PDF",
+            description =
+                    "Rebuilds a PDF from the editable JSON structure generated by the text editor tool. Input:JSON Output:PDF Type:SISO")
+    public ResponseEntity<byte[]> convertJsonToPdf(@ModelAttribute GeneralFile request)
+            throws Exception {
+        MultipartFile jsonFile = request.getFileInput();
+        if (jsonFile == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        byte[] pdfBytes = pdfJsonConversionService.convertJsonToPdf(jsonFile);
+        String originalName = jsonFile.getOriginalFilename();
+        String baseName =
+                (originalName != null && !originalName.isBlank())
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        : "document";
+        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
+        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
+    }
+
+    @PostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor/metadata")
+    @Operation(
+            summary = "Extract PDF metadata for text editor lazy loading",
+            description =
+                    "Extracts document metadata, fonts, and page dimensions for the text editor tool. Caches the document for"
+                            + " subsequent page requests. Returns a server-generated jobId scoped to the"
+                            + " authenticated user. Input:PDF Output:JSON Type:SISO")
+    public ResponseEntity<byte[]> extractPdfMetadata(@ModelAttribute PDFFile request)
+            throws Exception {
+        MultipartFile inputFile = request.getFileInput();
+        if (inputFile == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        // Generate server-side UUID for job
+        String baseJobId = UUID.randomUUID().toString();
+
+        // Scope job to authenticated user if security is enabled
+        String scopedJobKey = getScopedJobKey(baseJobId);
+
+        log.info("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);
+
+        byte[] jsonBytes =
+                pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey);
+        String originalName = inputFile.getOriginalFilename();
+        String baseName =
+                (originalName != null && !originalName.isBlank())
+                        ? Filenames.toSimpleFileName(originalName).replaceFirst("[.][^.]+$", "")
+                        : "document";
+        String docName = baseName + "_metadata.json";
+
+        // Return jobId in response header for client
+        return ResponseEntity.ok()
+                .header("X-Job-Id", scopedJobKey)
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(jsonBytes);
+    }
+
+    @PostMapping(
+            value = "/pdf/text-editor/partial/{jobId}",
+            consumes = MediaType.APPLICATION_JSON_VALUE)
+    @StandardPdfResponse
+    @Operation(
+            summary = "Apply incremental edits from text editor to a cached PDF",
+            description =
+                    "Applies edits for the specified pages of a cached PDF and returns an updated PDF."
+                            + " Requires the PDF to have been previously cached via the text editor metadata endpoint."
+                            + " The jobId must be obtained from the metadata extraction endpoint.")
+    public ResponseEntity<byte[]> exportPartialPdf(
+            @PathVariable String jobId,
+            @RequestBody PdfJsonDocument document,
+            @RequestParam(value = "filename", required = false) String filename)
+            throws Exception {
+        if (document == null) {
+            throw ExceptionUtils.createNullArgumentException("document");
+        }
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        byte[] pdfBytes = pdfJsonConversionService.exportUpdatedPages(jobId, document);
+
+        String baseName =
+                (filename != null && !filename.isBlank())
+                        ? Filenames.toSimpleFileName(filename).replaceFirst("[.][^.]+$", "")
+                        : Optional.ofNullable(document.getMetadata())
+                                .map(PdfJsonMetadata::getTitle)
+                                .filter(title -> title != null && !title.isBlank())
+                                .orElse("document");
+        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
+        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
+    }
+
+    @GetMapping(value = "/pdf/text-editor/page/{jobId}/{pageNumber}")
+    @Operation(
+            summary = "Extract single page from cached PDF for text editor",
+            description =
+                    "Retrieves a single page's content from a previously cached PDF document for the text editor tool."
+                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
+                            + " authenticated user. Output:JSON")
+    public ResponseEntity<byte[]> extractSinglePage(
+            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        byte[] jsonBytes = pdfJsonConversionService.extractSinglePage(jobId, pageNumber);
+        String docName = "page_" + pageNumber + ".json";
+        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+    }
+
+    @PostMapping(value = "/pdf/text-editor/clear-cache/{jobId}")
+    @Operation(
+            summary = "Clear cached PDF document for text editor",
+            description =
+                    "Manually clears a cached PDF document used by the text editor to free up server resources."
+                            + " Called automatically after 30 minutes. The jobId must belong to the"
+                            + " authenticated user.")
+    public ResponseEntity<Void> clearCache(@PathVariable String jobId) {
+
+        // Validate job ownership
+        validateJobAccess(jobId);
+
+        pdfJsonConversionService.clearCachedDocument(jobId);
+        return ResponseEntity.ok().build();
+    }
+
+    /**
+     * Get a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param baseJobId the base job identifier
+     * @return scoped job key, or just baseJobId if no ownership service available
+     */
+    private String getScopedJobKey(String baseJobId) {
+        if (jobOwnershipService != null) {
+            return jobOwnershipService.createScopedJobKey(baseJobId);
+        }
+        // Security disabled, return unsecured job key
+        return baseJobId;
+    }
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param jobId the job identifier to validate
+     * @throws SecurityException if current user does not own the job
+     */
+    private void validateJobAccess(String jobId) {
+        if (jobOwnershipService != null) {
+            jobOwnershipService.validateJobAccess(jobId);
+        }
+        // If jobOwnershipService is null (security disabled), allow all access
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -1,6 +1,7 @@
 package stirling.software.SPDF.controller.api.misc;
 
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.springframework.context.ApplicationContext;
@@ -10,9 +11,13 @@ import org.springframework.web.bind.annotation.RequestParam;
 
 import io.swagger.v3.oas.annotations.Hidden;
 
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointConfiguration;
+import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
 import stirling.software.SPDF.config.InitialSetup;
 import stirling.software.common.annotations.api.ConfigApi;
 import stirling.software.common.configuration.AppConfig;
@@ -30,6 +35,7 @@ public class ConfigController {
     private final EndpointConfiguration endpointConfiguration;
     private final ServerCertificateServiceInterface serverCertificateService;
     private final UserServiceInterface userService;
+    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;
 
     public ConfigController(
             ApplicationProperties applicationProperties,
@@ -38,12 +44,14 @@ public class ConfigController {
             @org.springframework.beans.factory.annotation.Autowired(required = false)
                     ServerCertificateServiceInterface serverCertificateService,
             @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    UserServiceInterface userService) {
+                    UserServiceInterface userService,
+            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
         this.applicationProperties = applicationProperties;
         this.applicationContext = applicationContext;
         this.endpointConfiguration = endpointConfiguration;
         this.serverCertificateService = serverCertificateService;
         this.userService = userService;
+        this.externalAppDepConfig = externalAppDepConfig;
     }
 
     @GetMapping("/app-config")
@@ -51,6 +59,9 @@ public class ConfigController {
         Map<String, Object> configData = new HashMap<>();
 
         try {
+            // Add dependency check status
+            configData.put("dependenciesReady", externalAppDepConfig.isDependenciesChecked());
+
             // Get AppConfig bean
             AppConfig appConfig = applicationContext.getBean(AppConfig.class);
 
@@ -63,6 +74,7 @@ public class ConfigController {
             configData.put("appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
             configData.put("languages", applicationProperties.getUi().getLanguages());
             configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
+            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());
 
             // Security settings
             // enableLogin requires both the config flag AND proprietary features to be loaded
@@ -154,6 +166,25 @@ public class ConfigController {
                 // EE features not available, continue without them
             }
 
+            // Add version and machine info for update checking
+            try {
+                if (applicationContext.containsBean("appVersion")) {
+                    configData.put(
+                            "appVersion", applicationContext.getBean("appVersion", String.class));
+                }
+                if (applicationContext.containsBean("machineType")) {
+                    configData.put(
+                            "machineType", applicationContext.getBean("machineType", String.class));
+                }
+                if (applicationContext.containsBean("activeSecurity")) {
+                    configData.put(
+                            "activeSecurity",
+                            applicationContext.getBean("activeSecurity", Boolean.class));
+                }
+            } catch (Exception e) {
+                // Version/machine info not available
+            }
+
             return ResponseEntity.ok(configData);
 
         } catch (Exception e) {
@@ -181,4 +212,19 @@ public class ConfigController {
         }
         return ResponseEntity.ok(result);
     }
+
+    @GetMapping("/endpoints-availability")
+    public ResponseEntity<Map<String, EndpointAvailability>> getEndpointAvailability(
+            @RequestParam(name = "endpoints")
+                    @Size(min = 1, max = 100, message = "Must provide between 1 and 100 endpoints")
+                    List<@NotBlank String> endpoints) {
+        Map<String, EndpointAvailability> result = new HashMap<>();
+        for (String endpoint : endpoints) {
+            String trimmedEndpoint = endpoint.trim();
+            result.put(
+                    trimmedEndpoint,
+                    endpointConfiguration.getEndpointAvailability(trimmedEndpoint));
+        }
+        return ResponseEntity.ok(result);
+    }
 }

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java

@@ -196,9 +196,9 @@ public class StampController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/Meiryo.ttf";
-                    case "korean" -> "static/fonts/malgun.ttf";
-                    case "chinese" -> "static/fonts/SimSun.ttf";
+                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
+                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
+                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     case "roman" -> "static/fonts/NotoSans-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";

app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java

@@ -171,9 +171,9 @@ public class WatermarkController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/Meiryo.ttf";
-                    case "korean" -> "static/fonts/malgun.ttf";
-                    case "chinese" -> "static/fonts/SimSun.ttf";
+                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
+                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
+                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";
                 };

app/core/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java

@@ -25,7 +25,7 @@ import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SignatureService;
+import stirling.software.SPDF.service.SharedSignatureService;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.UserServiceInterface;
@@ -37,13 +37,13 @@ import stirling.software.common.util.GeneralUtils;
 @Slf4j
 public class GeneralWebController {
 
-    private final SignatureService signatureService;
+    private final SharedSignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public GeneralWebController(
-            SignatureService signatureService,
+            SharedSignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java

@@ -23,6 +23,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.EndpointInspector;
 import stirling.software.SPDF.config.StartupApplicationListener;
+import stirling.software.SPDF.service.WeeklyActiveUsersService;
 import stirling.software.common.annotations.api.InfoApi;
 import stirling.software.common.model.ApplicationProperties;
 
@@ -34,6 +35,7 @@ public class MetricsController {
     private final ApplicationProperties applicationProperties;
     private final MeterRegistry meterRegistry;
     private final EndpointInspector endpointInspector;
+    private final Optional<WeeklyActiveUsersService> wauService;
     private boolean metricsEnabled;
 
     @PostConstruct
@@ -352,6 +354,36 @@ public class MetricsController {
         return ResponseEntity.ok(formatDuration(uptime));
     }
 
+    @GetMapping("/wau")
+    @Operation(
+            summary = "Weekly Active Users statistics",
+            description =
+                    "Returns WAU (Weekly Active Users) count and total unique browsers. "
+                            + "Only available when security is disabled (no-login mode). "
+                            + "Tracks unique browsers via client-generated UUID in localStorage.")
+    public ResponseEntity<?> getWeeklyActiveUsers() {
+        if (!metricsEnabled) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("This endpoint is disabled.");
+        }
+
+        // Check if WAU service is available (only when security.enableLogin=false)
+        if (wauService.isEmpty()) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                    .body(
+                            "WAU tracking is only available when security is disabled (no-login mode)");
+        }
+
+        WeeklyActiveUsersService service = wauService.get();
+
+        Map<String, Object> wauStats = new HashMap<>();
+        wauStats.put("weeklyActiveUsers", service.getWeeklyActiveUsers());
+        wauStats.put("totalUniqueBrowsers", service.getTotalUniqueBrowsers());
+        wauStats.put("daysOnline", service.getDaysOnline());
+        wauStats.put("trackingSince", service.getStartTime().toString());
+
+        return ResponseEntity.ok(wauStats);
+    }
+
     private String formatDuration(Duration duration) {
         long days = duration.toDays();
         long hours = duration.toHoursPart();

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,17 +1,88 @@
 package stirling.software.SPDF.controller.web;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
+import jakarta.annotation.PostConstruct;
+import jakarta.servlet.http.HttpServletRequest;
+
+@Controller
 public class ReactRoutingController {
 
-    @GetMapping("/{path:^(?!api|static|robots\\.txt|favicon\\.ico)[^\\.]*$}")
-    public String forwardRootPaths() {
-        return "forward:/index.html";
+    @Value("${server.servlet.context-path:/}")
+    private String contextPath;
+
+    private String cachedIndexHtml;
+    private boolean indexHtmlExists = false;
+
+    @PostConstruct
+    public void init() {
+        // Only cache if index.html exists (production builds)
+        ClassPathResource resource = new ClassPathResource("static/index.html");
+        if (resource.exists()) {
+            try {
+                this.cachedIndexHtml = processIndexHtml();
+                this.indexHtmlExists = true;
+            } catch (IOException e) {
+                // Failed to cache, will process on each request
+                this.indexHtmlExists = false;
+            }
+        }
     }
 
-    @GetMapping("/{path:^(?!api|static)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
-    public String forwardNestedPaths() {
-        return "forward:/index.html";
+    private String processIndexHtml() throws IOException {
+        ClassPathResource resource = new ClassPathResource("static/index.html");
+
+        try (InputStream inputStream = resource.getInputStream()) {
+            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
+
+            // Replace %BASE_URL% with the actual context path for base href
+            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
+            html = html.replace("%BASE_URL%", baseUrl);
+            // Also rewrite any existing <base> tag (Vite may have baked one in)
+            html =
+                    html.replaceFirst(
+                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
+                            "<base href=\\\"" + baseUrl + "\\\" />");
+
+            // Inject context path as a global variable for API calls
+            String contextPathScript =
+                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
+            html = html.replace("</head>", contextPathScript + "</head>");
+
+            return html;
+        }
+    }
+
+    @GetMapping(
+            value = {"/", "/index.html"},
+            produces = MediaType.TEXT_HTML_VALUE)
+    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
+        if (indexHtmlExists && cachedIndexHtml != null) {
+            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
+        }
+        // Fallback: process on each request (dev mode or cache failed)
+        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
+    }
+
+    @GetMapping(
+            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
+    public ResponseEntity<String> forwardRootPaths(HttpServletRequest request) throws IOException {
+        return serveIndexHtml(request);
+    }
+
+    @GetMapping(
+            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
+            throws IOException {
+        return serveIndexHtml(request);
     }
 }

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java

@@ -1,48 +0,0 @@
-package stirling.software.SPDF.controller.web;
-
-import java.io.IOException;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-
-import stirling.software.SPDF.service.SignatureService;
-import stirling.software.common.service.UserServiceInterface;
-
-// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
-@RequestMapping("/api/v1/general")
-public class SignatureController {
-
-    private final SignatureService signatureService;
-
-    private final UserServiceInterface userService;
-
-    public SignatureController(
-            SignatureService signatureService,
-            @Autowired(required = false) UserServiceInterface userService) {
-        this.signatureService = signatureService;
-        this.userService = userService;
-    }
-
-    @GetMapping("/sign/{fileName}")
-    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
-            throws IOException {
-        String username = "NON_SECURITY_USER";
-        if (userService != null) {
-            username = userService.getCurrentUsername();
-        }
-        // Verify access permission
-        if (!signatureService.hasAccessToFile(username, fileName)) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-        }
-        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
-        return ResponseEntity.ok()
-                .contentType( // Adjust based on file type
-                        MediaType.IMAGE_JPEG)
-                .body(imageBytes);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureImageController.java

@@ -0,0 +1,84 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.common.service.PersonalSignatureServiceInterface;
+import stirling.software.common.service.UserServiceInterface;
+
+/**
+ * Unified signature image controller that works for both authenticated and unauthenticated users.
+ * Uses composition pattern: - Core SharedSignatureService (always available): reads shared
+ * signatures - PersonalSignatureService (proprietary, optional): reads personal signatures For
+ * authenticated signature management (save/delete), see proprietary SignatureController.
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/general")
+public class SignatureImageController {
+
+    private final SharedSignatureService sharedSignatureService;
+    private final PersonalSignatureServiceInterface personalSignatureService;
+    private final UserServiceInterface userService;
+
+    public SignatureImageController(
+            SharedSignatureService sharedSignatureService,
+            @Autowired(required = false) PersonalSignatureServiceInterface personalSignatureService,
+            @Autowired(required = false) UserServiceInterface userService) {
+        this.sharedSignatureService = sharedSignatureService;
+        this.personalSignatureService = personalSignatureService;
+        this.userService = userService;
+    }
+
+    /**
+     * Get a signature image (works for both authenticated and unauthenticated users). -
+     * Authenticated with proprietary: tries personal first, then shared - Unauthenticated or
+     * community: tries shared only
+     */
+    @GetMapping("/signatures/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName) {
+        try {
+            byte[] imageBytes = null;
+
+            // If proprietary service available and user authenticated, try personal folder first
+            if (personalSignatureService != null && userService != null) {
+                try {
+                    String username = userService.getCurrentUsername();
+                    imageBytes =
+                            personalSignatureService.getPersonalSignatureBytes(username, fileName);
+                } catch (Exception e) {
+                    // Not found in personal folder or not authenticated, will try shared
+                    log.debug("Personal signature not found, trying shared: {}", e.getMessage());
+                }
+            }
+
+            // If not found in personal (or no personal service), try shared
+            if (imageBytes == null) {
+                imageBytes = sharedSignatureService.getSharedSignatureBytes(fileName);
+            }
+
+            // Determine content type from file extension
+            MediaType contentType = MediaType.IMAGE_PNG; // Default
+            String lowerFileName = fileName.toLowerCase();
+            if (lowerFileName.endsWith(".jpg") || lowerFileName.endsWith(".jpeg")) {
+                contentType = MediaType.IMAGE_JPEG;
+            }
+
+            return ResponseEntity.ok().contentType(contentType).body(imageBytes);
+        } catch (IOException e) {
+            log.debug("Signature not found: {}", fileName);
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/model/api/PdfJsonConversionProgress.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.model.api;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class PdfJsonConversionProgress {
+    private int percent;
+    private String stage;
+    private String message;
+    private boolean complete;
+    private Integer current; // Current item being processed (e.g., page number)
+    private Integer total; // Total items to process (e.g., total pages)
+
+    public static PdfJsonConversionProgress of(int percent, String stage, String message) {
+        return PdfJsonConversionProgress.builder()
+                .percent(percent)
+                .stage(stage)
+                .message(message)
+                .complete(false)
+                .build();
+    }
+
+    public static PdfJsonConversionProgress of(
+            int percent, String stage, String message, int current, int total) {
+        return PdfJsonConversionProgress.builder()
+                .percent(percent)
+                .stage(stage)
+                .message(message)
+                .current(current)
+                .total(total)
+                .complete(false)
+                .build();
+    }
+
+    public static PdfJsonConversionProgress complete() {
+        return PdfJsonConversionProgress.builder()
+                .percent(100)
+                .stage("complete")
+                .message("Conversion complete")
+                .complete(true)
+                .build();
+    }
+}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureRequest.java

@@ -0,0 +1,18 @@
+package stirling.software.SPDF.model.api.signature;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+public class SavedSignatureRequest {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureResponse.java

@@ -0,0 +1,22 @@
+package stirling.software.SPDF.model.api.signature;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SavedSignatureResponse {
+    private String id;
+    private String label;
+    private String type; // "canvas", "image", "text"
+    private String scope; // "personal", "shared"
+    private String dataUrl; // For canvas and image types (or URL to fetch image)
+    private String signerName; // For text type
+    private String fontFamily; // For text type
+    private Integer fontSize; // For text type
+    private String textColor; // For text type
+    private Long createdAt;
+    private Long updatedAt;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonAnnotation.java

@@ -0,0 +1,61 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * Represents a PDF annotation (comments, highlights, stamps, etc.). Annotations often contain OCR
+ * text layers or other metadata not visible in content streams.
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonAnnotation {
+
+    /** Annotation subtype (Text, Highlight, Link, Stamp, Widget, etc.) */
+    private String subtype;
+
+    /** Human-readable text content of the annotation */
+    private String contents;
+
+    /** Annotation rectangle [x1, y1, x2, y2] */
+    private List<Float> rect;
+
+    /** Annotation appearance characteristics */
+    private String appearanceState;
+
+    /** Color components (e.g., [r, g, b] for RGB) */
+    private List<Float> color;
+
+    /** Annotation flags (print, hidden, etc.) */
+    private Integer flags;
+
+    /** For link annotations: destination or action */
+    private String destination;
+
+    /** For text annotations: icon name */
+    private String iconName;
+
+    /** Subject/title of the annotation */
+    private String subject;
+
+    /** Author of the annotation */
+    private String author;
+
+    /** Creation date (ISO 8601 format) */
+    private String creationDate;
+
+    /** Modification date (ISO 8601 format) */
+    private String modificationDate;
+
+    /** Full annotation dictionary for lossless round-tripping */
+    private PdfJsonCosValue rawData;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonCosValue.java

@@ -0,0 +1,49 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonCosValue {
+
+    public enum Type {
+        NULL,
+        BOOLEAN,
+        INTEGER,
+        FLOAT,
+        NAME,
+        STRING,
+        ARRAY,
+        DICTIONARY,
+        STREAM
+    }
+
+    private Type type;
+
+    /**
+     * Holds the decoded value for primitives (boolean, integer, float, name, string). For name
+     * values the stored value is the PDF name literal. For string values the content is Base64
+     * encoded to safely transport arbitrary binaries.
+     */
+    private Object value;
+
+    /** Reference to nested values for arrays. */
+    private List<PdfJsonCosValue> items;
+
+    /** Reference to nested values for dictionaries. */
+    private Map<String, PdfJsonCosValue> entries;
+
+    /** Stream payload when {@code type == STREAM}. */
+    private PdfJsonStream stream;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocument.java

@@ -0,0 +1,34 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonDocument {
+
+    private PdfJsonMetadata metadata;
+
+    /** Optional XMP metadata packet stored as Base64. */
+    private String xmpMetadata;
+
+    /** Indicates that images should be loaded lazily via API rather than embedded in the JSON. */
+    private Boolean lazyImages;
+
+    @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
+
+    @Builder.Default private List<PdfJsonPage> pages = new ArrayList<>();
+
+    /** Form fields (AcroForm) at document level */
+    @Builder.Default private List<PdfJsonFormField> formFields = new ArrayList<>();
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonDocumentMetadata.java

@@ -0,0 +1,34 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonDocumentMetadata {
+
+    private PdfJsonMetadata metadata;
+
+    /** Optional XMP metadata packet stored as Base64. */
+    private String xmpMetadata;
+
+    /** Indicates that images should be requested lazily via the page endpoint. */
+    private Boolean lazyImages;
+
+    @Builder.Default private List<PdfJsonFont> fonts = new ArrayList<>();
+
+    @Builder.Default private List<PdfJsonPageDimension> pageDimensions = new ArrayList<>();
+
+    /** Form fields (AcroForm) at document level */
+    @Builder.Default private List<PdfJsonFormField> formFields = new ArrayList<>();
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFont.java

@@ -0,0 +1,96 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFont {
+
+    /** PDF resource name (e.g. F1) used as the primary identifier. */
+    private String id;
+
+    /** Logical page number that owns this font resource. */
+    private Integer pageNumber;
+
+    /** Stable UID combining page number and resource for diagnostics. */
+    private String uid;
+
+    /** Reported PostScript/Base font name. */
+    private String baseName;
+
+    /** Declared subtype in the COS dictionary. */
+    private String subtype;
+
+    /** Encoding dictionary or name. */
+    private String encoding;
+
+    /** CID system info for Type0 fonts. */
+    private PdfJsonFontCidSystemInfo cidSystemInfo;
+
+    /** True when the original PDF embedded the font program. */
+    private Boolean embedded;
+
+    /** Font program bytes (TTF/OTF/CFF/PFB) encoded as Base64. */
+    private String program;
+
+    /** Hint describing the font program type (ttf, otf, cff, pfb, etc.). */
+    private String programFormat;
+
+    /** Web-optimized font program (e.g. converted TrueType) encoded as Base64. */
+    private String webProgram;
+
+    /** Format hint for the webProgram payload. */
+    private String webProgramFormat;
+
+    /** PDF-friendly font program (e.g. converted TrueType) encoded as Base64. */
+    private String pdfProgram;
+
+    /** Format hint for the pdfProgram payload. */
+    private String pdfProgramFormat;
+
+    /** Glyph metadata for Type3 fonts to enable precise text rewrites. */
+    private List<PdfJsonFontType3Glyph> type3Glyphs;
+
+    /** Per-strategy synthesized font payloads for Type3 normalization. */
+    private List<PdfJsonFontConversionCandidate> conversionCandidates;
+
+    /** ToUnicode stream encoded as Base64 when present. */
+    private String toUnicode;
+
+    /** Mapped Standard 14 font name when available. */
+    private String standard14Name;
+
+    /** Font descriptor flags copied from the source document. */
+    private Integer fontDescriptorFlags;
+
+    /** Font ascent in glyph units (typically 1/1000). */
+    private Float ascent;
+
+    /** Font descent in glyph units (typically negative). */
+    private Float descent;
+
+    /** Capital height when available. */
+    private Float capHeight;
+
+    /** x-height when available. */
+    private Float xHeight;
+
+    /** Italic angle reported by the font descriptor. */
+    private Float italicAngle;
+
+    /** Units per em extracted from the font matrix. */
+    private Integer unitsPerEm;
+
+    /** Serialized COS dictionary describing the original font resource. */
+    private PdfJsonCosValue cosDictionary;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontCidSystemInfo.java

@@ -0,0 +1,20 @@
+package stirling.software.SPDF.model.json;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFontCidSystemInfo {
+
+    private String registry;
+    private String ordering;
+    private Integer supplement;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionCandidate.java

@@ -0,0 +1,69 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFontConversionCandidate {
+
+    /** Stable identifier for the strategy that produced this candidate. */
+    private String strategyId;
+
+    /** Human-readable label for diagnostics and UI toggles. */
+    private String strategyLabel;
+
+    /** Outcome of the conversion attempt. */
+    private PdfJsonFontConversionStatus status;
+
+    /** Summary diagnostics or error details. */
+    private String message;
+
+    /** Count of glyphs successfully synthesized. */
+    private Integer synthesizedGlyphs;
+
+    /** Count of glyphs that could not be reproduced accurately. */
+    private Integer missingGlyphs;
+
+    /** Approximate width delta (in glyph units) across the test sample. */
+    private Double widthDelta;
+
+    /** Approximate bounding box delta (in glyph units). */
+    private Double bboxDelta;
+
+    /** Base64-encoded font program (typically TTF/OTF) produced by the strategy. */
+    private String program;
+
+    /** Format hint for {@link #program}. */
+    private String programFormat;
+
+    /** Web-optimized payload (e.g. TTF) for browser preview. */
+    private String webProgram;
+
+    /** Format for the web payload. */
+    private String webProgramFormat;
+
+    /** PDF-friendly payload for re-embedding during export. */
+    private String pdfProgram;
+
+    /** Format for the PDF payload. */
+    private String pdfProgramFormat;
+
+    /** Optional PNG preview of rendered glyphs (Base64). */
+    private String previewImage;
+
+    /** Additional structured diagnostics (JSON string). */
+    private String diagnostics;
+
+    /** Known unicode/codepoint coverage derived from the conversion strategy. */
+    private List<Integer> glyphCoverage;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontConversionStatus.java

@@ -0,0 +1,9 @@
+package stirling.software.SPDF.model.json;
+
+public enum PdfJsonFontConversionStatus {
+    SUCCESS,
+    WARNING,
+    FAILURE,
+    SKIPPED,
+    UNSUPPORTED
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFontType3Glyph.java

@@ -0,0 +1,27 @@
+package stirling.software.SPDF.model.json;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFontType3Glyph {
+    /** Character code used in the content stream to reference this glyph. */
+    private Integer charCode;
+
+    /** PostScript glyph name, when available. */
+    private String glyphName;
+
+    /** Unicode code point represented by this glyph, if it can be resolved. */
+    private Integer unicode;
+
+    /** Raw char code used in the Type3 font encoding (0-255). */
+    private Integer charCodeRaw;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonFormField.java

@@ -0,0 +1,66 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/** Represents a PDF form field (AcroForm). */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonFormField {
+
+    /** Fully qualified field name (e.g., "form1.textfield1") */
+    private String name;
+
+    /** Partial field name (last component) */
+    private String partialName;
+
+    /** Field type (Tx=text, Btn=button, Ch=choice, Sig=signature) */
+    private String fieldType;
+
+    /** Field value as string */
+    private String value;
+
+    /** Default value */
+    private String defaultValue;
+
+    /** Field flags (readonly, required, multiline, etc.) */
+    private Integer flags;
+
+    /** Alternative field name (for accessibility) */
+    private String alternateFieldName;
+
+    /** Mapping name (for export) */
+    private String mappingName;
+
+    /** Page number where field appears (1-indexed) */
+    private Integer pageNumber;
+
+    /** Field rectangle [x1, y1, x2, y2] on the page */
+    private List<Float> rect;
+
+    /** For choice fields: list of options */
+    private List<String> options;
+
+    /** For choice fields: selected indices */
+    private List<Integer> selectedIndices;
+
+    /** For button fields: whether it's checked */
+    private Boolean checked;
+
+    /** Font information for text fields */
+    private String fontName;
+
+    private Float fontSize;
+
+    /** Full field dictionary for lossless round-tripping */
+    private PdfJsonCosValue rawData;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonImageElement.java

@@ -0,0 +1,37 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonImageElement {
+
+    private String id;
+    private String objectName;
+    private Boolean inlineImage;
+    private Integer nativeWidth;
+    private Integer nativeHeight;
+    private Float x;
+    private Float y;
+    private Float width;
+    private Float height;
+    private Float left;
+    private Float right;
+    private Float top;
+    private Float bottom;
+    @Builder.Default private List<Float> transform = new ArrayList<>();
+    private Integer zOrder;
+    private String imageData;
+    private String imageFormat;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonMetadata.java

@@ -0,0 +1,27 @@
+package stirling.software.SPDF.model.json;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonMetadata {
+
+    private String title;
+    private String author;
+    private String subject;
+    private String keywords;
+    private String creator;
+    private String producer;
+    private String creationDate;
+    private String modificationDate;
+    private String trapped;
+    private Integer numberOfPages;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonPage.java

@@ -0,0 +1,34 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonPage {
+
+    private Integer pageNumber;
+    private Float width;
+    private Float height;
+    private Integer rotation;
+
+    @Builder.Default private List<PdfJsonTextElement> textElements = new ArrayList<>();
+    @Builder.Default private List<PdfJsonImageElement> imageElements = new ArrayList<>();
+    @Builder.Default private List<PdfJsonAnnotation> annotations = new ArrayList<>();
+
+    /** Serialized representation of the page resources dictionary. */
+    private PdfJsonCosValue resources;
+
+    /** Raw content streams associated with the page, preserved for lossless round-tripping. */
+    @Builder.Default private List<PdfJsonStream> contentStreams = new ArrayList<>();
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonPageDimension.java

@@ -0,0 +1,20 @@
+package stirling.software.SPDF.model.json;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonPageDimension {
+    private Integer pageNumber;
+    private Float width;
+    private Float height;
+    private Integer rotation;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonStream.java

@@ -0,0 +1,27 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonStream {
+
+    /**
+     * A dictionary of entries that describe the stream metadata (Filter, DecodeParms, etc). Each
+     * entry is represented using {@link PdfJsonCosValue} so nested structures are supported.
+     */
+    private Map<String, PdfJsonCosValue> dictionary;
+
+    /** Raw stream bytes in Base64 form. Data is stored exactly as it appeared in the source PDF. */
+    private String rawData;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonTextColor.java

@@ -0,0 +1,21 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonTextColor {
+
+    private String colorSpace;
+    private List<Float> components;
+}

app/core/src/main/java/stirling/software/SPDF/model/json/PdfJsonTextElement.java

@@ -0,0 +1,41 @@
+package stirling.software.SPDF.model.json;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class PdfJsonTextElement {
+
+    private String text;
+    private String fontId;
+    private Float fontSize;
+    private Float fontMatrixSize;
+    private Float fontSizeInPt;
+    private Float characterSpacing;
+    private Float wordSpacing;
+    private Float spaceWidth;
+    private Integer zOrder;
+    private Float horizontalScaling;
+    private Float leading;
+    private Float rise;
+    private Float x;
+    private Float y;
+    private Float width;
+    private Float height;
+    private List<Float> textMatrix;
+    private PdfJsonTextColor fillColor;
+    private PdfJsonTextColor strokeColor;
+    private Integer renderingMode;
+    private Boolean fallbackUsed;
+    private List<Integer> charCodes;
+}

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonCosMapper.java

@@ -0,0 +1,274 @@
+package stirling.software.SPDF.service;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.IdentityHashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.pdfbox.cos.COSArray;
+import org.apache.pdfbox.cos.COSBase;
+import org.apache.pdfbox.cos.COSBoolean;
+import org.apache.pdfbox.cos.COSDictionary;
+import org.apache.pdfbox.cos.COSFloat;
+import org.apache.pdfbox.cos.COSInteger;
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.cos.COSNull;
+import org.apache.pdfbox.cos.COSObject;
+import org.apache.pdfbox.cos.COSStream;
+import org.apache.pdfbox.cos.COSString;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.common.PDStream;
+import org.springframework.stereotype.Component;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.json.PdfJsonCosValue;
+import stirling.software.SPDF.model.json.PdfJsonStream;
+
+@Slf4j
+@Component
+public class PdfJsonCosMapper {
+
+    public PdfJsonStream serializeStream(PDStream stream) throws IOException {
+        if (stream == null) {
+            return null;
+        }
+        return serializeStream(
+                stream.getCOSObject(), Collections.newSetFromMap(new IdentityHashMap<>()));
+    }
+
+    public PdfJsonStream serializeStream(COSStream cosStream) throws IOException {
+        if (cosStream == null) {
+            return null;
+        }
+        return serializeStream(cosStream, Collections.newSetFromMap(new IdentityHashMap<>()));
+    }
+
+    public PdfJsonCosValue serializeCosValue(COSBase base) throws IOException {
+        return serializeCosValue(base, Collections.newSetFromMap(new IdentityHashMap<>()));
+    }
+
+    public COSBase deserializeCosValue(PdfJsonCosValue value, PDDocument document)
+            throws IOException {
+        if (value == null || value.getType() == null) {
+            return null;
+        }
+        switch (value.getType()) {
+            case NULL:
+                return COSNull.NULL;
+            case BOOLEAN:
+                if (value.getValue() instanceof Boolean bool) {
+                    return COSBoolean.getBoolean(bool);
+                }
+                return null;
+            case INTEGER:
+                if (value.getValue() instanceof Number number) {
+                    return COSInteger.get(number.longValue());
+                }
+                return null;
+            case FLOAT:
+                if (value.getValue() instanceof Number number) {
+                    return new COSFloat(number.floatValue());
+                }
+                return null;
+            case NAME:
+                if (value.getValue() instanceof String name) {
+                    return COSName.getPDFName(name);
+                }
+                return null;
+            case STRING:
+                if (value.getValue() instanceof String encoded) {
+                    try {
+                        byte[] bytes = Base64.getDecoder().decode(encoded);
+                        return new COSString(bytes);
+                    } catch (IllegalArgumentException ex) {
+                        log.debug("Failed to decode COSString value: {}", ex.getMessage());
+                    }
+                }
+                return null;
+            case ARRAY:
+                COSArray array = new COSArray();
+                if (value.getItems() != null) {
+                    for (PdfJsonCosValue item : value.getItems()) {
+                        COSBase entry = deserializeCosValue(item, document);
+                        if (entry != null) {
+                            array.add(entry);
+                        } else {
+                            array.add(COSNull.NULL);
+                        }
+                    }
+                }
+                return array;
+            case DICTIONARY:
+                COSDictionary dictionary = new COSDictionary();
+                if (value.getEntries() != null) {
+                    for (Map.Entry<String, PdfJsonCosValue> entry : value.getEntries().entrySet()) {
+                        COSName key = COSName.getPDFName(entry.getKey());
+                        COSBase entryValue = deserializeCosValue(entry.getValue(), document);
+                        if (entryValue != null) {
+                            dictionary.setItem(key, entryValue);
+                        }
+                    }
+                }
+                return dictionary;
+            case STREAM:
+                if (value.getStream() != null) {
+                    return buildStreamFromModel(value.getStream(), document);
+                }
+                return null;
+            default:
+                return null;
+        }
+    }
+
+    public COSStream buildStreamFromModel(PdfJsonStream streamModel, PDDocument document)
+            throws IOException {
+        if (streamModel == null) {
+            return null;
+        }
+        COSStream cosStream = document.getDocument().createCOSStream();
+        if (streamModel.getDictionary() != null) {
+            for (Map.Entry<String, PdfJsonCosValue> entry :
+                    streamModel.getDictionary().entrySet()) {
+                COSName key = COSName.getPDFName(entry.getKey());
+                COSBase value = deserializeCosValue(entry.getValue(), document);
+                if (value != null) {
+                    cosStream.setItem(key, value);
+                }
+            }
+        }
+
+        String rawData = streamModel.getRawData();
+        if (rawData != null && !rawData.isBlank()) {
+            byte[] data;
+            try {
+                data = Base64.getDecoder().decode(rawData);
+            } catch (IllegalArgumentException ex) {
+                log.debug("Invalid base64 content stream data: {}", ex.getMessage());
+                data = new byte[0];
+            }
+            try (OutputStream outputStream = cosStream.createRawOutputStream()) {
+                outputStream.write(data);
+            }
+            cosStream.setItem(COSName.LENGTH, COSInteger.get(data.length));
+        } else {
+            cosStream.setItem(COSName.LENGTH, COSInteger.get(0));
+        }
+        return cosStream;
+    }
+
+    private PdfJsonCosValue serializeCosValue(COSBase base, Set<COSBase> visited)
+            throws IOException {
+        if (base == null) {
+            return null;
+        }
+        if (base instanceof COSObject cosObject) {
+            base = cosObject.getObject();
+            if (base == null) {
+                return null;
+            }
+        }
+
+        boolean complex =
+                base instanceof COSDictionary
+                        || base instanceof COSArray
+                        || base instanceof COSStream;
+        if (complex) {
+            if (!visited.add(base)) {
+                return PdfJsonCosValue.builder()
+                        .type(PdfJsonCosValue.Type.NAME)
+                        .value("__circular__")
+                        .build();
+            }
+        }
+
+        try {
+            PdfJsonCosValue.PdfJsonCosValueBuilder builder = PdfJsonCosValue.builder();
+            if (base instanceof COSNull) {
+                builder.type(PdfJsonCosValue.Type.NULL);
+                return builder.build();
+            }
+            if (base instanceof COSBoolean booleanValue) {
+                builder.type(PdfJsonCosValue.Type.BOOLEAN).value(booleanValue.getValue());
+                return builder.build();
+            }
+            if (base instanceof COSInteger integer) {
+                builder.type(PdfJsonCosValue.Type.INTEGER).value(integer.longValue());
+                return builder.build();
+            }
+            if (base instanceof COSFloat floatValue) {
+                builder.type(PdfJsonCosValue.Type.FLOAT).value(floatValue.floatValue());
+                return builder.build();
+            }
+            if (base instanceof COSName name) {
+                builder.type(PdfJsonCosValue.Type.NAME).value(name.getName());
+                return builder.build();
+            }
+            if (base instanceof COSString cosString) {
+                builder.type(PdfJsonCosValue.Type.STRING)
+                        .value(Base64.getEncoder().encodeToString(cosString.getBytes()));
+                return builder.build();
+            }
+            if (base instanceof COSArray array) {
+                List<PdfJsonCosValue> items = new ArrayList<>(array.size());
+                for (COSBase item : array) {
+                    PdfJsonCosValue serialized = serializeCosValue(item, visited);
+                    items.add(serialized);
+                }
+                builder.type(PdfJsonCosValue.Type.ARRAY).items(items);
+                return builder.build();
+            }
+            if (base instanceof COSStream stream) {
+                builder.type(PdfJsonCosValue.Type.STREAM).stream(serializeStream(stream, visited));
+                return builder.build();
+            }
+            if (base instanceof COSDictionary dictionary) {
+                Map<String, PdfJsonCosValue> entries = new LinkedHashMap<>();
+                for (COSName key : dictionary.keySet()) {
+                    PdfJsonCosValue serialized =
+                            serializeCosValue(dictionary.getDictionaryObject(key), visited);
+                    entries.put(key.getName(), serialized);
+                }
+                builder.type(PdfJsonCosValue.Type.DICTIONARY).entries(entries);
+                return builder.build();
+            }
+            return null;
+        } finally {
+            if (complex) {
+                visited.remove(base);
+            }
+        }
+    }
+
+    private PdfJsonStream serializeStream(COSStream cosStream, Set<COSBase> visited)
+            throws IOException {
+        Map<String, PdfJsonCosValue> dictionary = new LinkedHashMap<>();
+        for (COSName key : cosStream.keySet()) {
+            COSBase value = cosStream.getDictionaryObject(key);
+            PdfJsonCosValue serialized = serializeCosValue(value, visited);
+            if (serialized != null) {
+                dictionary.put(key.getName(), serialized);
+            }
+        }
+        String rawData = null;
+        try (InputStream inputStream = cosStream.createRawInputStream();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            if (inputStream != null) {
+                inputStream.transferTo(baos);
+            }
+            byte[] data = baos.toByteArray();
+            if (data.length > 0) {
+                rawData = Base64.getEncoder().encodeToString(data);
+            }
+        }
+        return PdfJsonStream.builder().dictionary(dictionary).rawData(rawData).build();
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonFallbackFontService.java

@@ -0,0 +1,638 @@
+package stirling.software.SPDF.service;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Locale;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
+import org.apache.pdfbox.pdmodel.font.PDType3Font;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.Resource;
+import org.springframework.core.io.ResourceLoader;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.json.PdfJsonFont;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class PdfJsonFallbackFontService {
+
+    public static final String FALLBACK_FONT_ID = "fallback-noto-sans";
+    public static final String DEFAULT_FALLBACK_FONT_LOCATION =
+            "classpath:/static/fonts/NotoSans-Regular.ttf";
+    public static final String FALLBACK_FONT_CJK_ID = "fallback-noto-cjk";
+    public static final String FALLBACK_FONT_JP_ID = "fallback-noto-jp";
+    public static final String FALLBACK_FONT_KR_ID = "fallback-noto-korean";
+    public static final String FALLBACK_FONT_TC_ID = "fallback-noto-tc";
+    public static final String FALLBACK_FONT_AR_ID = "fallback-noto-arabic";
+    public static final String FALLBACK_FONT_TH_ID = "fallback-noto-thai";
+    public static final String FALLBACK_FONT_DEVANAGARI_ID = "fallback-noto-devanagari";
+    public static final String FALLBACK_FONT_MALAYALAM_ID = "fallback-noto-malayalam";
+    public static final String FALLBACK_FONT_TIBETAN_ID = "fallback-noto-tibetan";
+
+    // Font name aliases map PDF font names to available fallback fonts
+    // This provides better visual consistency when editing PDFs
+    private static final Map<String, String> FONT_NAME_ALIASES =
+            Map.ofEntries(
+                    // Liberation fonts are metric-compatible with Microsoft core fonts
+                    Map.entry("arial", "fallback-liberation-sans"),
+                    Map.entry("helvetica", "fallback-liberation-sans"),
+                    Map.entry("arimo", "fallback-liberation-sans"),
+                    Map.entry("liberationsans", "fallback-liberation-sans"),
+                    Map.entry("times", "fallback-liberation-serif"),
+                    Map.entry("timesnewroman", "fallback-liberation-serif"),
+                    Map.entry("tinos", "fallback-liberation-serif"),
+                    Map.entry("liberationserif", "fallback-liberation-serif"),
+                    Map.entry("courier", "fallback-liberation-mono"),
+                    Map.entry("couriernew", "fallback-liberation-mono"),
+                    Map.entry("cousine", "fallback-liberation-mono"),
+                    Map.entry("liberationmono", "fallback-liberation-mono"),
+                    // DejaVu fonts - widely used open source fonts
+                    Map.entry("dejavu", "fallback-dejavu-sans"),
+                    Map.entry("dejavusans", "fallback-dejavu-sans"),
+                    Map.entry("dejavuserif", "fallback-dejavu-serif"),
+                    Map.entry("dejavumono", "fallback-dejavu-mono"),
+                    Map.entry("dejavusansmono", "fallback-dejavu-mono"),
+                    // Traditional Chinese fonts (Taiwan, Hong Kong, Macau)
+                    Map.entry("mingliu", "fallback-noto-tc"),
+                    Map.entry("pmingliu", "fallback-noto-tc"),
+                    Map.entry("microsoftjhenghei", "fallback-noto-tc"),
+                    Map.entry("jhenghei", "fallback-noto-tc"),
+                    Map.entry("kaiti", "fallback-noto-tc"),
+                    Map.entry("kaiu", "fallback-noto-tc"),
+                    Map.entry("dfkaib5", "fallback-noto-tc"),
+                    Map.entry("dfkai", "fallback-noto-tc"),
+                    // Simplified Chinese fonts (Mainland China) - more common
+                    Map.entry("simsun", "fallback-noto-cjk"),
+                    Map.entry("simhei", "fallback-noto-cjk"),
+                    Map.entry("microsoftyahei", "fallback-noto-cjk"),
+                    Map.entry("yahei", "fallback-noto-cjk"),
+                    Map.entry("songti", "fallback-noto-cjk"),
+                    Map.entry("heiti", "fallback-noto-cjk"),
+                    // Noto Sans - Google's universal font (use as last resort generic fallback)
+                    Map.entry("noto", "fallback-noto-sans"),
+                    Map.entry("notosans", "fallback-noto-sans"));
+
+    private static final Map<String, FallbackFontSpec> BUILT_IN_FALLBACK_FONTS =
+            Map.ofEntries(
+                    Map.entry(
+                            FALLBACK_FONT_CJK_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansSC-Regular.ttf",
+                                    "NotoSansSC-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_JP_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansJP-Regular.ttf",
+                                    "NotoSansJP-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_KR_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansKR-Regular.ttf",
+                                    "NotoSansKR-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_TC_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansTC-Regular.ttf",
+                                    "NotoSansTC-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_AR_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansArabic-Regular.ttf",
+                                    "NotoSansArabic-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_TH_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansThai-Regular.ttf",
+                                    "NotoSansThai-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_DEVANAGARI_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansDevanagari-Regular.ttf",
+                                    "NotoSansDevanagari-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_MALAYALAM_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSansMalayalam-Regular.ttf",
+                                    "NotoSansMalayalam-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            FALLBACK_FONT_TIBETAN_ID,
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSerifTibetan-Regular.ttf",
+                                    "NotoSerifTibetan-Regular",
+                                    "ttf")),
+                    // Liberation Sans family
+                    Map.entry(
+                            "fallback-liberation-sans",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSans-Regular.ttf",
+                                    "LiberationSans-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-sans-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSans-Bold.ttf",
+                                    "LiberationSans-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-sans-italic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSans-Italic.ttf",
+                                    "LiberationSans-Italic",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-sans-bolditalic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSans-BoldItalic.ttf",
+                                    "LiberationSans-BoldItalic",
+                                    "ttf")),
+                    // Liberation Serif family
+                    Map.entry(
+                            "fallback-liberation-serif",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSerif-Regular.ttf",
+                                    "LiberationSerif-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-serif-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSerif-Bold.ttf",
+                                    "LiberationSerif-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-serif-italic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSerif-Italic.ttf",
+                                    "LiberationSerif-Italic",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-serif-bolditalic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationSerif-BoldItalic.ttf",
+                                    "LiberationSerif-BoldItalic",
+                                    "ttf")),
+                    // Liberation Mono family
+                    Map.entry(
+                            "fallback-liberation-mono",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationMono-Regular.ttf",
+                                    "LiberationMono-Regular",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-mono-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationMono-Bold.ttf",
+                                    "LiberationMono-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-mono-italic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationMono-Italic.ttf",
+                                    "LiberationMono-Italic",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-liberation-mono-bolditalic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/LiberationMono-BoldItalic.ttf",
+                                    "LiberationMono-BoldItalic",
+                                    "ttf")),
+                    // Noto Sans family (enhanced with weight variants)
+                    Map.entry(
+                            FALLBACK_FONT_ID,
+                            new FallbackFontSpec(
+                                    DEFAULT_FALLBACK_FONT_LOCATION, "NotoSans-Regular", "ttf")),
+                    Map.entry(
+                            "fallback-noto-sans-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSans-Bold.ttf",
+                                    "NotoSans-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-noto-sans-italic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSans-Italic.ttf",
+                                    "NotoSans-Italic",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-noto-sans-bolditalic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/NotoSans-BoldItalic.ttf",
+                                    "NotoSans-BoldItalic",
+                                    "ttf")),
+                    // DejaVu Sans family
+                    Map.entry(
+                            "fallback-dejavu-sans",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSans.ttf", "DejaVuSans", "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-sans-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSans-Bold.ttf",
+                                    "DejaVuSans-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-sans-oblique",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSans-Oblique.ttf",
+                                    "DejaVuSans-Oblique",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-sans-boldoblique",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSans-BoldOblique.ttf",
+                                    "DejaVuSans-BoldOblique",
+                                    "ttf")),
+                    // DejaVu Serif family
+                    Map.entry(
+                            "fallback-dejavu-serif",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSerif.ttf",
+                                    "DejaVuSerif",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-serif-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSerif-Bold.ttf",
+                                    "DejaVuSerif-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-serif-italic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSerif-Italic.ttf",
+                                    "DejaVuSerif-Italic",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-serif-bolditalic",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSerif-BoldItalic.ttf",
+                                    "DejaVuSerif-BoldItalic",
+                                    "ttf")),
+                    // DejaVu Mono family
+                    Map.entry(
+                            "fallback-dejavu-mono",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSansMono.ttf",
+                                    "DejaVuSansMono",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-mono-bold",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSansMono-Bold.ttf",
+                                    "DejaVuSansMono-Bold",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-mono-oblique",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSansMono-Oblique.ttf",
+                                    "DejaVuSansMono-Oblique",
+                                    "ttf")),
+                    Map.entry(
+                            "fallback-dejavu-mono-boldoblique",
+                            new FallbackFontSpec(
+                                    "classpath:/static/fonts/DejaVuSansMono-BoldOblique.ttf",
+                                    "DejaVuSansMono-BoldOblique",
+                                    "ttf")));
+
+    private final ResourceLoader resourceLoader;
+
+    @Value("${stirling.pdf.fallback-font:" + DEFAULT_FALLBACK_FONT_LOCATION + "}")
+    private String fallbackFontLocation;
+
+    private final Map<String, byte[]> fallbackFontCache = new ConcurrentHashMap<>();
+
+    public PdfJsonFont buildFallbackFontModel() throws IOException {
+        return buildFallbackFontModel(FALLBACK_FONT_ID);
+    }
+
+    public PdfJsonFont buildFallbackFontModel(String fallbackId) throws IOException {
+        FallbackFontSpec spec = getFallbackFontSpec(fallbackId);
+        if (spec == null) {
+            throw new IOException("Unknown fallback font id " + fallbackId);
+        }
+        byte[] bytes = loadFallbackFontBytes(fallbackId, spec);
+        String base64 = java.util.Base64.getEncoder().encodeToString(bytes);
+        return PdfJsonFont.builder()
+                .id(fallbackId)
+                .uid(fallbackId)
+                .baseName(spec.baseName())
+                .subtype("TrueType")
+                .embedded(true)
+                .program(base64)
+                .programFormat(spec.format())
+                .build();
+    }
+
+    public PDFont loadFallbackPdfFont(PDDocument document) throws IOException {
+        return loadFallbackPdfFont(document, FALLBACK_FONT_ID);
+    }
+
+    public PDFont loadFallbackPdfFont(PDDocument document, String fallbackId) throws IOException {
+        FallbackFontSpec spec = getFallbackFontSpec(fallbackId);
+        if (spec == null) {
+            throw new IOException("Unknown fallback font id " + fallbackId);
+        }
+        byte[] bytes = loadFallbackFontBytes(fallbackId, spec);
+        try (InputStream stream = new ByteArrayInputStream(bytes)) {
+            // Load with embedSubset=false to ensure full glyph coverage
+            // Fallback fonts need all glyphs available for substituting missing characters
+            return PDType0Font.load(document, stream, false);
+        }
+    }
+
+    public boolean canEncodeFully(PDFont font, String text) {
+        return canEncode(font, text);
+    }
+
+    public boolean canEncode(PDFont font, int codePoint) {
+        return canEncode(font, new String(Character.toChars(codePoint)));
+    }
+
+    public boolean canEncode(PDFont font, String text) {
+        if (font == null || text == null || text.isEmpty()) {
+            return false;
+        }
+        if (font instanceof PDType3Font) {
+            return false;
+        }
+        try {
+            font.encode(text);
+            return true;
+        } catch (IOException | IllegalArgumentException | UnsupportedOperationException ex) {
+            // Only log at debug level to reduce verbosity - summary is logged elsewhere
+            log.debug(
+                    "[FONT-DEBUG] Font {} cannot encode text '{}' ({}): {}",
+                    font != null ? font.getName() : "null",
+                    text,
+                    font != null ? font.getClass().getSimpleName() : "null",
+                    ex.getMessage());
+            return false;
+        }
+    }
+
+    /**
+     * Resolve fallback font ID based on the original font name and code point. Attempts to match
+     * font family and weight/style for visual consistency.
+     *
+     * @param originalFontName the name of the original font (may be null)
+     * @param codePoint the Unicode code point that needs to be rendered
+     * @return fallback font ID
+     */
+    public String resolveFallbackFontId(String originalFontName, int codePoint) {
+        // First try to match based on original font name for visual consistency
+        if (originalFontName != null && !originalFontName.isEmpty()) {
+            // Normalize font name: remove subset prefix (e.g. "PXAAAC+"), convert to lowercase,
+            // remove spaces
+            String normalized =
+                    originalFontName
+                            .replaceAll("^[A-Z]{6}\\+", "") // Remove subset prefix
+                            .toLowerCase()
+                            .replaceAll("\\s+", ""); // Remove spaces (e.g. "Times New Roman" ->
+            // "timesnewroman")
+
+            // Extract base name without weight/style suffixes
+            // Split on common delimiters: hyphen, underscore, comma, plus
+            // Handles: "Arimo_700wght" -> "arimo", "Arial-Bold" -> "arial", "Arial,Bold" -> "arial"
+            String baseName = normalized.split("[-_,+]")[0];
+
+            String aliasedFontId = FONT_NAME_ALIASES.get(baseName);
+            if (aliasedFontId != null) {
+                // Detect weight and style from the normalized font name
+                boolean isBold = detectBold(normalized);
+                boolean isItalic = detectItalic(normalized);
+
+                // Apply weight/style suffix to fallback font ID
+                String styledFontId = applyWeightStyle(aliasedFontId, isBold, isItalic);
+
+                log.debug(
+                        "Matched font '{}' (normalized: '{}', base: '{}', bold: {}, italic: {}) to fallback '{}'",
+                        originalFontName,
+                        normalized,
+                        baseName,
+                        isBold,
+                        isItalic,
+                        styledFontId);
+                return styledFontId;
+            }
+        }
+
+        // Fall back to Unicode-based selection
+        return resolveFallbackFontId(codePoint);
+    }
+
+    /**
+     * Detect if font name indicates bold weight.
+     *
+     * @param normalizedFontName lowercase font name without subset prefix or spaces
+     * @return true if bold weight is detected
+     */
+    private boolean detectBold(String normalizedFontName) {
+        // Check for explicit bold indicators
+        if (normalizedFontName.contains("bold")
+                || normalizedFontName.contains("heavy")
+                || normalizedFontName.contains("black")) {
+            return true;
+        }
+
+        // Check for numeric weight indicators (600-900 = bold)
+        // Handles: "Arimo_700wght", "Arial-700", "Font-w700"
+        if (normalizedFontName.matches(".*[_-]?[6-9]00(wght)?.*")) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Detect if font name indicates italic/oblique style.
+     *
+     * @param normalizedFontName lowercase font name without subset prefix or spaces
+     * @return true if italic style is detected
+     */
+    private boolean detectItalic(String normalizedFontName) {
+        return normalizedFontName.contains("italic") || normalizedFontName.contains("oblique");
+    }
+
+    /**
+     * Apply weight/style suffix to fallback font ID.
+     *
+     * <p>Weight/style variants are only applied to font families where we have the actual font
+     * files available. Currently supported: - Liberation Sans: Regular, Bold, Italic, BoldItalic
+     * (full support) - Liberation Serif: Regular, Bold, Italic, BoldItalic (full support) -
+     * Liberation Mono: Regular, Bold, Italic, BoldItalic (full support) - Noto Sans: Regular, Bold,
+     * Italic, BoldItalic (full support) - DejaVu Sans: Regular, Bold, Oblique, BoldOblique (full
+     * support) - DejaVu Serif: Regular, Bold, Italic, BoldItalic (full support) - DejaVu Mono:
+     * Regular, Bold, Oblique, BoldOblique (full support)
+     *
+     * <p>To add weight/style support for additional font families: 1. Download the font files
+     * (Bold, Italic, BoldItalic) to: app/core/src/main/resources/static/fonts/ 2. Register the
+     * variants in BUILT_IN_FALLBACK_FONTS map (see lines 63-267) 3. Update the check below to
+     * include the font family prefix
+     *
+     * @param baseFontId base fallback font ID (e.g., "fallback-liberation-sans")
+     * @param isBold true if bold weight needed
+     * @param isItalic true if italic style needed
+     * @return styled font ID (e.g., "fallback-liberation-sans-bold"), or base ID if variants not
+     *     available
+     */
+    private String applyWeightStyle(String baseFontId, boolean isBold, boolean isItalic) {
+        // Only apply weight/style to font families where we have the font files available
+        // Supported: Liberation (Sans/Serif/Mono), Noto Sans, DejaVu (Sans/Serif/Mono)
+        boolean isSupported =
+                baseFontId.startsWith("fallback-liberation-")
+                        || baseFontId.equals("fallback-noto-sans")
+                        || baseFontId.startsWith("fallback-dejavu-");
+
+        if (!isSupported) {
+            return baseFontId;
+        }
+
+        // DejaVu Sans and Mono use "oblique" instead of "italic"
+        boolean useOblique =
+                baseFontId.equals("fallback-dejavu-sans")
+                        || baseFontId.equals("fallback-dejavu-mono");
+
+        if (isBold && isItalic) {
+            return baseFontId + (useOblique ? "-boldoblique" : "-bolditalic");
+        } else if (isBold) {
+            return baseFontId + "-bold";
+        } else if (isItalic) {
+            return baseFontId + (useOblique ? "-oblique" : "-italic");
+        }
+
+        return baseFontId;
+    }
+
+    /**
+     * Resolve fallback font ID based on Unicode code point properties.
+     *
+     * @param codePoint the Unicode code point
+     * @return fallback font ID
+     */
+    public String resolveFallbackFontId(int codePoint) {
+        Character.UnicodeBlock block = Character.UnicodeBlock.of(codePoint);
+
+        // Bopomofo is primarily used in Taiwan for Traditional Chinese phonetic annotation
+        if (block == Character.UnicodeBlock.BOPOMOFO
+                || block == Character.UnicodeBlock.BOPOMOFO_EXTENDED) {
+            return FALLBACK_FONT_TC_ID;
+        }
+
+        // Compatibility ideographs are primarily used by Traditional Chinese encodings (e.g., Big5,
+        // HKSCS) so prefer the Traditional Chinese fallback here.
+        if (block == Character.UnicodeBlock.CJK_COMPATIBILITY_IDEOGRAPHS
+                || block == Character.UnicodeBlock.CJK_COMPATIBILITY_IDEOGRAPHS_SUPPLEMENT) {
+            return FALLBACK_FONT_TC_ID;
+        }
+
+        if (block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS
+                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_A
+                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_B
+                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_C
+                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_D
+                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_E
+                || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_F
+                || block == Character.UnicodeBlock.CJK_SYMBOLS_AND_PUNCTUATION
+                || block == Character.UnicodeBlock.HALFWIDTH_AND_FULLWIDTH_FORMS) {
+            return FALLBACK_FONT_CJK_ID;
+        }
+
+        Character.UnicodeScript script = Character.UnicodeScript.of(codePoint);
+        return switch (script) {
+            // HAN script is used by both Simplified and Traditional Chinese
+            // Default to Simplified (mainland China, 1.4B speakers) as it's more common
+            // Traditional Chinese PDFs are detected via font name aliases (MingLiU, PMingLiU, etc.)
+            case HAN -> FALLBACK_FONT_CJK_ID;
+            case HIRAGANA, KATAKANA -> FALLBACK_FONT_JP_ID;
+            case HANGUL -> FALLBACK_FONT_KR_ID;
+            case ARABIC -> FALLBACK_FONT_AR_ID;
+            case THAI -> FALLBACK_FONT_TH_ID;
+            case DEVANAGARI -> FALLBACK_FONT_DEVANAGARI_ID;
+            case MALAYALAM -> FALLBACK_FONT_MALAYALAM_ID;
+            case TIBETAN -> FALLBACK_FONT_TIBETAN_ID;
+            default -> FALLBACK_FONT_ID;
+        };
+    }
+
+    public String mapUnsupportedGlyph(int codePoint) {
+        return switch (codePoint) {
+            case 0x276E -> "<";
+            case 0x276F -> ">";
+            default -> null;
+        };
+    }
+
+    private FallbackFontSpec getFallbackFontSpec(String fallbackId) {
+        if (FALLBACK_FONT_ID.equals(fallbackId)) {
+            String baseName = inferBaseName(fallbackFontLocation, "NotoSans-Regular");
+            String format = inferFormat(fallbackFontLocation, "ttf");
+            return new FallbackFontSpec(fallbackFontLocation, baseName, format);
+        }
+        return BUILT_IN_FALLBACK_FONTS.get(fallbackId);
+    }
+
+    private byte[] loadFallbackFontBytes(String fallbackId, FallbackFontSpec spec)
+            throws IOException {
+        if (spec == null) {
+            throw new IOException("No fallback font specification for " + fallbackId);
+        }
+        byte[] cached = fallbackFontCache.get(fallbackId);
+        if (cached != null) {
+            return cached;
+        }
+        Resource resource = resourceLoader.getResource(spec.resourceLocation());
+        if (!resource.exists()) {
+            throw new IOException("Fallback font resource not found at " + spec.resourceLocation());
+        }
+        try (InputStream inputStream = resource.getInputStream();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            inputStream.transferTo(baos);
+            byte[] bytes = baos.toByteArray();
+            fallbackFontCache.put(fallbackId, bytes);
+            return bytes;
+        }
+    }
+
+    private String inferBaseName(String location, String defaultName) {
+        if (location == null || location.isBlank()) {
+            return defaultName;
+        }
+        int slash = location.lastIndexOf('/');
+        String fileName = slash >= 0 ? location.substring(slash + 1) : location;
+        int dot = fileName.lastIndexOf('.');
+        if (dot > 0) {
+            fileName = fileName.substring(0, dot);
+        }
+        return fileName.isEmpty() ? defaultName : fileName;
+    }
+
+    private String inferFormat(String location, String defaultFormat) {
+        if (location == null || location.isBlank()) {
+            return defaultFormat;
+        }
+        int dot = location.lastIndexOf('.');
+        if (dot >= 0 && dot < location.length() - 1) {
+            return location.substring(dot + 1).toLowerCase(Locale.ROOT);
+        }
+        return defaultFormat;
+    }
+
+    private record FallbackFontSpec(String resourceLocation, String baseName, String format) {}
+}

app/core/src/main/java/stirling/software/SPDF/service/SharedSignatureService.java

@@ -0,0 +1,308 @@
+package stirling.software.SPDF.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardOpenOption;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.SignatureFile;
+import stirling.software.SPDF.model.api.signature.SavedSignatureRequest;
+import stirling.software.SPDF.model.api.signature.SavedSignatureResponse;
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Service
+@Slf4j
+public class SharedSignatureService {
+
+    private final String SIGNATURE_BASE_PATH;
+    private final String ALL_USERS_FOLDER = "ALL_USERS";
+    private final ObjectMapper objectMapper;
+
+    public SharedSignatureService() {
+        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
+        this.objectMapper = new ObjectMapper();
+    }
+
+    public boolean hasAccessToFile(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // Check if file exists in user's personal folder or ALL_USERS folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+
+        return Files.exists(userPath) || Files.exists(allUsersPath);
+    }
+
+    public List<SignatureFile> getAvailableSignatures(String username) {
+        List<SignatureFile> signatures = new ArrayList<>();
+
+        // Get signatures from user's personal folder
+        if (StringUtils.hasText(username)) {
+            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+            if (Files.exists(userFolder)) {
+                try {
+                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
+                } catch (IOException e) {
+                    log.error("Error reading user signatures folder", e);
+                }
+            }
+        }
+
+        // Get signatures from ALL_USERS folder
+        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(allUsersFolder)) {
+            try {
+                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
+            } catch (IOException e) {
+                log.error("Error reading shared signatures folder", e);
+            }
+        }
+
+        return signatures;
+    }
+
+    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
+            throws IOException {
+        try (Stream<Path> stream = Files.list(folder)) {
+            return stream.filter(this::isImageFile)
+                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
+                    .toList();
+        }
+    }
+
+    /**
+     * Get a signature from the shared (ALL_USERS) folder. This is always available for both
+     * authenticated and unauthenticated users.
+     */
+    public byte[] getSharedSignatureBytes(String fileName) throws IOException {
+        validateFileName(fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+        if (!Files.exists(allUsersPath)) {
+            throw new FileNotFoundException("Shared signature file not found");
+        }
+        return Files.readAllBytes(allUsersPath);
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg") || fileName.endsWith(".jpeg") || fileName.endsWith(".png");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+        // Only allow alphanumeric, hyphen, underscore, and dot (for extensions)
+        if (!fileName.matches("^[a-zA-Z0-9_.-]+$")) {
+            throw new IllegalArgumentException("Filename contains invalid characters");
+        }
+    }
+
+    private String validateAndNormalizeExtension(String extension) {
+        String normalized = extension.toLowerCase().trim();
+        // Whitelist only safe image extensions
+        if (normalized.equals("png") || normalized.equals("jpg") || normalized.equals("jpeg")) {
+            return normalized;
+        }
+        throw new IllegalArgumentException("Unsupported image extension: " + extension);
+    }
+
+    private void verifyPathWithinDirectory(Path resolvedPath, Path targetDirectory)
+            throws IOException {
+        Path canonicalTarget = targetDirectory.toAbsolutePath().normalize();
+        Path canonicalResolved = resolvedPath.toAbsolutePath().normalize();
+        if (!canonicalResolved.startsWith(canonicalTarget)) {
+            throw new IOException("Resolved path is outside the target directory");
+        }
+    }
+
+    /** Save a signature as image file */
+    public SavedSignatureResponse saveSignature(String username, SavedSignatureRequest request)
+            throws IOException {
+        validateFileName(request.getId());
+
+        // Determine folder based on scope
+        String scope = request.getScope();
+        if (scope == null || scope.isEmpty()) {
+            scope = "personal"; // Default to personal
+        }
+
+        String folderName = "shared".equals(scope) ? ALL_USERS_FOLDER : username;
+        Path targetFolder = Paths.get(SIGNATURE_BASE_PATH, folderName);
+        Files.createDirectories(targetFolder);
+
+        long timestamp = System.currentTimeMillis();
+
+        SavedSignatureResponse response = new SavedSignatureResponse();
+        response.setId(request.getId());
+        response.setLabel(request.getLabel());
+        response.setType(request.getType());
+        response.setScope(scope);
+        response.setCreatedAt(timestamp);
+        response.setUpdatedAt(timestamp);
+
+        // Extract and save image data
+        String dataUrl = request.getDataUrl();
+        if (dataUrl != null && dataUrl.startsWith("data:image/")) {
+            // Extract base64 data
+            String base64Data = dataUrl.substring(dataUrl.indexOf(",") + 1);
+            byte[] imageBytes = Base64.getDecoder().decode(base64Data);
+
+            // Determine and validate file extension from data URL
+            String mimeType = dataUrl.substring(dataUrl.indexOf(":") + 1, dataUrl.indexOf(";"));
+            String rawExtension = mimeType.substring(mimeType.indexOf("/") + 1);
+            String extension = validateAndNormalizeExtension(rawExtension);
+
+            // Save image file only
+            String imageFileName = request.getId() + "." + extension;
+            Path imagePath = targetFolder.resolve(imageFileName);
+
+            // Verify path is within target directory
+            verifyPathWithinDirectory(imagePath, targetFolder);
+
+            Files.write(
+                    imagePath,
+                    imageBytes,
+                    StandardOpenOption.CREATE,
+                    StandardOpenOption.TRUNCATE_EXISTING);
+
+            // Store reference to image file
+            response.setDataUrl("/api/v1/general/signatures/" + imageFileName);
+        }
+
+        log.info("Saved signature {} for user {}", request.getId(), username);
+        return response;
+    }
+
+    /** Get all saved signatures for a user */
+    public List<SavedSignatureResponse> getSavedSignatures(String username) throws IOException {
+        List<SavedSignatureResponse> signatures = new ArrayList<>();
+
+        // Load personal signatures
+        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+        if (Files.exists(personalFolder)) {
+            try (Stream<Path> stream = Files.list(personalFolder)) {
+                stream.filter(this::isImageFile)
+                        .forEach(
+                                path -> {
+                                    try {
+                                        String fileName = path.getFileName().toString();
+                                        String id =
+                                                fileName.substring(0, fileName.lastIndexOf('.'));
+
+                                        SavedSignatureResponse sig = new SavedSignatureResponse();
+                                        sig.setId(id);
+                                        sig.setLabel(id); // Use ID as label
+                                        sig.setType("image"); // Default type
+                                        sig.setScope("personal");
+                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
+                                        sig.setCreatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+                                        sig.setUpdatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+
+                                        signatures.add(sig);
+                                    } catch (IOException e) {
+                                        log.error("Error reading signature file: " + path, e);
+                                    }
+                                });
+            }
+        }
+
+        // Load shared signatures
+        Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(sharedFolder)) {
+            try (Stream<Path> stream = Files.list(sharedFolder)) {
+                stream.filter(this::isImageFile)
+                        .forEach(
+                                path -> {
+                                    try {
+                                        String fileName = path.getFileName().toString();
+                                        String id =
+                                                fileName.substring(0, fileName.lastIndexOf('.'));
+
+                                        SavedSignatureResponse sig = new SavedSignatureResponse();
+                                        sig.setId(id);
+                                        sig.setLabel(id); // Use ID as label
+                                        sig.setType("image"); // Default type
+                                        sig.setScope("shared");
+                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
+                                        sig.setCreatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+                                        sig.setUpdatedAt(
+                                                Files.getLastModifiedTime(path).toMillis());
+
+                                        signatures.add(sig);
+                                    } catch (IOException e) {
+                                        log.error("Error reading signature file: " + path, e);
+                                    }
+                                });
+            }
+        }
+
+        return signatures;
+    }
+
+    /** Delete a saved signature */
+    public void deleteSignature(String username, String signatureId) throws IOException {
+        validateFileName(signatureId);
+
+        // Try to find and delete image file in personal folder
+        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+        boolean deleted = false;
+
+        if (Files.exists(personalFolder)) {
+            try (Stream<Path> stream = Files.list(personalFolder)) {
+                List<Path> matchingFiles =
+                        stream.filter(
+                                        path ->
+                                                path.getFileName()
+                                                        .toString()
+                                                        .startsWith(signatureId + "."))
+                                .toList();
+                for (Path file : matchingFiles) {
+                    Files.delete(file);
+                    deleted = true;
+                }
+            }
+        }
+
+        // Try shared folder if not found in personal
+        if (!deleted) {
+            Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+            if (Files.exists(sharedFolder)) {
+                try (Stream<Path> stream = Files.list(sharedFolder)) {
+                    List<Path> matchingFiles =
+                            stream.filter(
+                                            path ->
+                                                    path.getFileName()
+                                                            .toString()
+                                                            .startsWith(signatureId + "."))
+                                    .toList();
+                    for (Path file : matchingFiles) {
+                        Files.delete(file);
+                        deleted = true;
+                    }
+                }
+            }
+        }
+
+        if (!deleted) {
+            throw new FileNotFoundException("Signature not found");
+        }
+
+        log.info("Deleted signature {} for user {}", signatureId, username);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/SignatureService.java

@@ -1,107 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.springframework.stereotype.Service;
-import org.springframework.util.StringUtils;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Service
-@Slf4j
-public class SignatureService {
-
-    private final String SIGNATURE_BASE_PATH;
-    private final String ALL_USERS_FOLDER = "ALL_USERS";
-
-    public SignatureService() {
-        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
-    }
-
-    public boolean hasAccessToFile(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // Check if file exists in user's personal folder or ALL_USERS folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-
-        return Files.exists(userPath) || Files.exists(allUsersPath);
-    }
-
-    public List<SignatureFile> getAvailableSignatures(String username) {
-        List<SignatureFile> signatures = new ArrayList<>();
-
-        // Get signatures from user's personal folder
-        if (StringUtils.hasText(username)) {
-            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-            if (Files.exists(userFolder)) {
-                try {
-                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
-                } catch (IOException e) {
-                    log.error("Error reading user signatures folder", e);
-                }
-            }
-        }
-
-        // Get signatures from ALL_USERS folder
-        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(allUsersFolder)) {
-            try {
-                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
-            } catch (IOException e) {
-                log.error("Error reading shared signatures folder", e);
-            }
-        }
-
-        return signatures;
-    }
-
-    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
-            throws IOException {
-        try (Stream<Path> stream = Files.list(folder)) {
-            return stream.filter(this::isImageFile)
-                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
-                    .toList();
-        }
-    }
-
-    public byte[] getSignatureBytes(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // First try user's personal folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        if (Files.exists(userPath)) {
-            return Files.readAllBytes(userPath);
-        }
-
-        // Then try ALL_USERS folder
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-        if (Files.exists(allUsersPath)) {
-            return Files.readAllBytes(allUsersPath);
-        }
-
-        throw new FileNotFoundException("Signature file not found");
-    }
-
-    private boolean isImageFile(Path path) {
-        String fileName = path.getFileName().toString().toLowerCase();
-        return fileName.endsWith(".jpg")
-                || fileName.endsWith(".jpeg")
-                || fileName.endsWith(".png")
-                || fileName.endsWith(".gif");
-    }
-
-    private void validateFileName(String fileName) {
-        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
-            throw new IllegalArgumentException("Invalid filename");
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/service/WeeklyActiveUsersService.java

@@ -0,0 +1,101 @@
+package stirling.software.SPDF.service;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Service for tracking Weekly Active Users (WAU) in no-login mode. Uses in-memory storage with
+ * automatic cleanup of old entries.
+ */
+@Service
+@Slf4j
+public class WeeklyActiveUsersService {
+
+    // Map of browser ID -> last seen timestamp
+    private final Map<String, Instant> activeBrowsers = new ConcurrentHashMap<>();
+
+    // Track total unique browsers seen (overall)
+    private long totalUniqueBrowsers = 0;
+
+    // Application start time
+    private final Instant startTime = Instant.now();
+
+    /**
+     * Records a browser access with the current timestamp
+     *
+     * @param browserId Unique browser identifier from X-Browser-Id header
+     */
+    public void recordBrowserAccess(String browserId) {
+        if (browserId == null || browserId.trim().isEmpty()) {
+            return;
+        }
+
+        boolean isNewBrowser = !activeBrowsers.containsKey(browserId);
+        activeBrowsers.put(browserId, Instant.now());
+
+        if (isNewBrowser) {
+            totalUniqueBrowsers++;
+            log.debug("New browser recorded: {} (Total: {})", browserId, totalUniqueBrowsers);
+        }
+    }
+
+    /**
+     * Gets the count of unique browsers seen in the last 7 days
+     *
+     * @return Weekly Active Users count
+     */
+    public long getWeeklyActiveUsers() {
+        cleanupOldEntries();
+        return activeBrowsers.size();
+    }
+
+    /**
+     * Gets the total count of unique browsers ever seen
+     *
+     * @return Total unique browsers count
+     */
+    public long getTotalUniqueBrowsers() {
+        return totalUniqueBrowsers;
+    }
+
+    /**
+     * Gets the number of days the service has been running
+     *
+     * @return Days online
+     */
+    public long getDaysOnline() {
+        return ChronoUnit.DAYS.between(startTime, Instant.now());
+    }
+
+    /**
+     * Gets the timestamp when tracking started
+     *
+     * @return Start time
+     */
+    public Instant getStartTime() {
+        return startTime;
+    }
+
+    /** Removes entries older than 7 days */
+    private void cleanupOldEntries() {
+        Instant sevenDaysAgo = Instant.now().minus(7, ChronoUnit.DAYS);
+        activeBrowsers.entrySet().removeIf(entry -> entry.getValue().isBefore(sevenDaysAgo));
+    }
+
+    /** Manual cleanup trigger (can be called by scheduled task if needed) */
+    public void performCleanup() {
+        int sizeBefore = activeBrowsers.size();
+        cleanupOldEntries();
+        int sizeAfter = activeBrowsers.size();
+
+        if (sizeBefore != sizeAfter) {
+            log.debug("Cleaned up {} old browser entries", sizeBefore - sizeAfter);
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/JobOwnershipServiceImpl.java

@@ -0,0 +1,111 @@
+package stirling.software.SPDF.service.pdfjson;
+
+import java.util.Optional;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.service.UserServiceInterface;
+
+/**
+ * Service to manage job ownership and access control for PDF JSON operations. When security is
+ * enabled, jobs are scoped to authenticated users. When security is disabled, jobs are globally
+ * accessible.
+ */
+@Slf4j
+@Service
+@ConditionalOnProperty(name = "security.enable-login", havingValue = "true", matchIfMissing = false)
+public class JobOwnershipServiceImpl
+        implements stirling.software.common.service.JobOwnershipService {
+
+    @Autowired(required = false)
+    private UserServiceInterface userService;
+
+    /**
+     * Get the current authenticated user's identifier. Returns empty if no user is authenticated.
+     *
+     * @return Optional containing user identifier, or empty if not authenticated
+     */
+    public Optional<String> getCurrentUserId() {
+        if (userService == null) {
+            log.debug("UserService not available");
+            return Optional.empty();
+        }
+
+        try {
+            String username = userService.getCurrentUsername();
+            if (username != null && !username.isEmpty() && !"anonymousUser".equals(username)) {
+                log.debug("Current authenticated user: {}", username);
+                return Optional.of(username);
+            }
+        } catch (Exception e) {
+            log.warn("Failed to get current username from UserService: {}", e.getMessage());
+        }
+        return Optional.empty();
+    }
+
+    /**
+     * Create a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param jobId the base job identifier
+     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
+     */
+    public String createScopedJobKey(String jobId) {
+        Optional<String> userId = getCurrentUserId();
+        if (userId.isPresent()) {
+            String scopedKey = userId.get() + ":" + jobId;
+            log.debug("Created scoped job key: {}", scopedKey);
+            return scopedKey;
+        }
+        log.debug("No user authenticated, using unsecured job key: {}", jobId);
+        return jobId;
+    }
+
+    /**
+     * Validate that the current user has access to the given job.
+     *
+     * @param scopedJobKey the scoped job key to validate
+     * @return true if current user owns the job or no authentication is required
+     * @throws SecurityException if current user does not own the job
+     */
+    public boolean validateJobAccess(String scopedJobKey) {
+        Optional<String> userId = getCurrentUserId();
+
+        // If no user authenticated, allow access (backwards compatibility)
+        if (userId.isEmpty()) {
+            log.debug("No authentication required, allowing access to job: {}", scopedJobKey);
+            return true;
+        }
+
+        // Check if job key starts with current user's ID
+        String userPrefix = userId.get() + ":";
+        if (!scopedJobKey.startsWith(userPrefix)) {
+            log.warn(
+                    "Access denied: User {} attempted to access job key {} which they don't own",
+                    userId.get(),
+                    scopedJobKey);
+            throw new SecurityException(
+                    "Access denied: You do not have permission to access this job");
+        }
+
+        log.debug("Access granted: User {} owns job {}", userId.get(), scopedJobKey);
+        return true;
+    }
+
+    /**
+     * Extract the base job ID from a scoped job key.
+     *
+     * @param scopedJobKey the scoped job key
+     * @return the base job ID without user prefix
+     */
+    public String extractJobId(String scopedJobKey) {
+        int colonIndex = scopedJobKey.indexOf(':');
+        if (colonIndex > 0) {
+            return scopedJobKey.substring(colonIndex + 1);
+        }
+        return scopedJobKey;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/NoOpJobOwnershipService.java

@@ -0,0 +1,44 @@
+package stirling.software.SPDF.service.pdfjson;
+
+import java.util.Optional;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * No-op implementation of job ownership service when security is disabled. All jobs are globally
+ * accessible without authentication.
+ */
+@Slf4j
+@Service
+@ConditionalOnProperty(name = "security.enable-login", havingValue = "false", matchIfMissing = true)
+public class NoOpJobOwnershipService
+        implements stirling.software.common.service.JobOwnershipService {
+
+    @Override
+    public Optional<String> getCurrentUserId() {
+        // No authentication when security is disabled
+        return Optional.empty();
+    }
+
+    @Override
+    public String createScopedJobKey(String jobId) {
+        // Jobs are not scoped to users when security is disabled
+        return jobId;
+    }
+
+    @Override
+    public boolean validateJobAccess(String scopedJobKey) {
+        // All jobs are accessible when security is disabled
+        log.trace("Security disabled, allowing access to job: {}", scopedJobKey);
+        return true;
+    }
+
+    @Override
+    public String extractJobId(String scopedJobKey) {
+        // No user prefix when security is disabled
+        return scopedJobKey;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/PdfJsonFontService.java

@@ -0,0 +1,350 @@
+package stirling.software.SPDF.service.pdfjson;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.util.Base64;
+import java.util.Locale;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+
+import jakarta.annotation.PostConstruct;
+
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.util.ProcessExecutor;
+import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class PdfJsonFontService {
+
+    private final TempFileManager tempFileManager;
+
+    @Getter
+    @Value("${stirling.pdf.json.cff-converter.enabled:true}")
+    private boolean cffConversionEnabled;
+
+    @Getter
+    @Value("${stirling.pdf.json.cff-converter.method:python}")
+    private String cffConverterMethod;
+
+    @Value("${stirling.pdf.json.cff-converter.python-command:/opt/venv/bin/python3}")
+    private String pythonCommand;
+
+    @Value("${stirling.pdf.json.cff-converter.python-script:/scripts/convert_cff_to_ttf.py}")
+    private String pythonScript;
+
+    @Value("${stirling.pdf.json.cff-converter.fontforge-command:fontforge}")
+    private String fontforgeCommand;
+
+    private volatile boolean pythonCffConverterAvailable;
+    private volatile boolean fontForgeCffConverterAvailable;
+
+    @PostConstruct
+    private void initialiseCffConverterAvailability() {
+        if (!cffConversionEnabled) {
+            log.warn("[FONT-DEBUG] CFF conversion is DISABLED in configuration");
+            pythonCffConverterAvailable = false;
+            fontForgeCffConverterAvailable = false;
+            return;
+        }
+
+        log.info("[FONT-DEBUG] CFF conversion enabled, checking tool availability...");
+        pythonCffConverterAvailable = isCommandAvailable(pythonCommand);
+        if (!pythonCffConverterAvailable) {
+            log.warn(
+                    "[FONT-DEBUG] Python command '{}' not found; Python CFF conversion disabled",
+                    pythonCommand);
+        } else {
+            log.info("[FONT-DEBUG] Python command '{}' is available", pythonCommand);
+        }
+
+        fontForgeCffConverterAvailable = isCommandAvailable(fontforgeCommand);
+        if (!fontForgeCffConverterAvailable) {
+            log.warn(
+                    "[FONT-DEBUG] FontForge command '{}' not found; FontForge CFF conversion disabled",
+                    fontforgeCommand);
+        } else {
+            log.info("[FONT-DEBUG] FontForge command '{}' is available", fontforgeCommand);
+        }
+
+        log.info("[FONT-DEBUG] Selected CFF converter method: {}", cffConverterMethod);
+    }
+
+    public byte[] convertCffProgramToTrueType(byte[] fontBytes, String toUnicode) {
+        if (!cffConversionEnabled || fontBytes == null || fontBytes.length == 0) {
+            log.warn(
+                    "[FONT-DEBUG] CFF conversion skipped: enabled={}, bytes={}",
+                    cffConversionEnabled,
+                    fontBytes == null ? "null" : fontBytes.length);
+            return null;
+        }
+
+        log.info(
+                "[FONT-DEBUG] Converting CFF font: {} bytes, method: {}",
+                fontBytes.length,
+                cffConverterMethod);
+
+        if ("python".equalsIgnoreCase(cffConverterMethod)) {
+            if (!pythonCffConverterAvailable) {
+                log.debug("[FONT-DEBUG] Python CFF converter not available, skipping conversion");
+                return null;
+            }
+            byte[] result = convertCffUsingPython(fontBytes, toUnicode);
+            log.debug(
+                    "[FONT-DEBUG] Python conversion result: {}",
+                    result == null ? "null" : result.length + " bytes");
+            return result;
+        } else if ("fontforge".equalsIgnoreCase(cffConverterMethod)) {
+            if (!fontForgeCffConverterAvailable) {
+                log.debug(
+                        "[FONT-DEBUG] FontForge CFF converter not available, skipping conversion");
+                return null;
+            }
+            byte[] result = convertCffUsingFontForge(fontBytes);
+            log.debug(
+                    "[FONT-DEBUG] FontForge conversion result: {}",
+                    result == null ? "null" : result.length + " bytes");
+            return result;
+        } else {
+            log.debug(
+                    "[FONT-DEBUG] Unknown CFF converter method: {}, falling back to Python",
+                    cffConverterMethod);
+            if (!pythonCffConverterAvailable) {
+                log.debug("[FONT-DEBUG] Python CFF converter not available, skipping conversion");
+                return null;
+            }
+            byte[] result = convertCffUsingPython(fontBytes, toUnicode);
+            log.debug(
+                    "[FONT-DEBUG] Python conversion result: {}",
+                    result == null ? "null" : result.length + " bytes");
+            return result;
+        }
+    }
+
+    public String detectFontFlavor(byte[] fontBytes) {
+        if (fontBytes == null || fontBytes.length < 4) {
+            return null;
+        }
+        int signature =
+                ((fontBytes[0] & 0xFF) << 24)
+                        | ((fontBytes[1] & 0xFF) << 16)
+                        | ((fontBytes[2] & 0xFF) << 8)
+                        | (fontBytes[3] & 0xFF);
+        if (signature == 0x00010000 || signature == 0x74727565) {
+            return "ttf";
+        }
+        if (signature == 0x4F54544F) {
+            return "otf";
+        }
+        if (signature == 0x74746366) {
+            return "cff";
+        }
+        return null;
+    }
+
+    public String detectTrueTypeFormat(byte[] data) {
+        if (data == null || data.length < 4) {
+            return null;
+        }
+        int signature =
+                ((data[0] & 0xFF) << 24)
+                        | ((data[1] & 0xFF) << 16)
+                        | ((data[2] & 0xFF) << 8)
+                        | (data[3] & 0xFF);
+        if (signature == 0x00010000) {
+            return "ttf";
+        }
+        if (signature == 0x4F54544F) {
+            return "otf";
+        }
+        if (signature == 0x74746366) {
+            return "cff";
+        }
+        return null;
+    }
+
+    public String validateFontTables(byte[] fontBytes) {
+        if (fontBytes == null || fontBytes.length < 12) {
+            return "Font program too small";
+        }
+        int numTables = ((fontBytes[4] & 0xFF) << 8) | (fontBytes[5] & 0xFF);
+        if (numTables <= 0 || numTables > 512) {
+            return "Invalid numTables: " + numTables;
+        }
+        return null;
+    }
+
+    private byte[] convertCffUsingPython(byte[] fontBytes, String toUnicode) {
+        if (!pythonCffConverterAvailable) {
+            log.debug("[FONT-DEBUG] Python CFF converter not available");
+            return null;
+        }
+        if (pythonCommand == null
+                || pythonCommand.isBlank()
+                || pythonScript == null
+                || pythonScript.isBlank()) {
+            log.debug("[FONT-DEBUG] Python converter not configured");
+            return null;
+        }
+
+        log.debug(
+                "[FONT-DEBUG] Running Python CFF converter: command={}, script={}",
+                pythonCommand,
+                pythonScript);
+
+        try (TempFile inputFile = new TempFile(tempFileManager, ".cff");
+                TempFile outputFile = new TempFile(tempFileManager, ".otf");
+                TempFile toUnicodeFile =
+                        toUnicode != null ? new TempFile(tempFileManager, ".tounicode") : null) {
+            Files.write(inputFile.getPath(), fontBytes);
+            if (toUnicodeFile != null) {
+                try {
+                    byte[] toUnicodeBytes = Base64.getDecoder().decode(toUnicode);
+                    Files.write(toUnicodeFile.getPath(), toUnicodeBytes);
+                } catch (IllegalArgumentException ex) {
+                    log.debug(
+                            "[FONT-DEBUG] Failed to decode ToUnicode data for CFF conversion: {}",
+                            ex.getMessage());
+                    return null;
+                }
+            }
+
+            String[] command =
+                    buildPythonCommand(
+                            inputFile.getAbsolutePath(),
+                            outputFile.getAbsolutePath(),
+                            toUnicodeFile != null ? toUnicodeFile.getAbsolutePath() : null);
+            log.debug("[FONT-DEBUG] Executing: {}", String.join(" ", command));
+
+            ProcessExecutorResult result =
+                    ProcessExecutor.getInstance(ProcessExecutor.Processes.CFF_CONVERTER)
+                            .runCommandWithOutputHandling(java.util.Arrays.asList(command));
+
+            if (result.getRc() != 0) {
+                log.error(
+                        "[FONT-DEBUG] Python CFF conversion failed with exit code: {}",
+                        result.getRc());
+                log.error("[FONT-DEBUG] Stdout: {}", result.getMessages());
+                return null;
+            }
+            if (!Files.exists(outputFile.getPath())) {
+                log.error("[FONT-DEBUG] Python CFF conversion produced no output file");
+                return null;
+            }
+            byte[] data = Files.readAllBytes(outputFile.getPath());
+            if (data.length == 0) {
+                log.error("[FONT-DEBUG] Python CFF conversion returned empty output");
+                return null;
+            }
+            log.info(
+                    "[FONT-DEBUG] Python CFF conversion succeeded: {} bytes -> {} bytes",
+                    fontBytes.length,
+                    data.length);
+            return data;
+        } catch (IOException | InterruptedException ex) {
+            if (ex instanceof InterruptedException) {
+                Thread.currentThread().interrupt();
+            }
+            log.error("[FONT-DEBUG] Python CFF conversion exception: {}", ex.getMessage(), ex);
+            return null;
+        }
+    }
+
+    public byte[] convertCffUsingFontForge(byte[] fontBytes) {
+        if (!fontForgeCffConverterAvailable) {
+            log.debug("FontForge CFF converter not available");
+            return null;
+        }
+
+        try (TempFile inputFile = new TempFile(tempFileManager, ".cff");
+                TempFile outputFile = new TempFile(tempFileManager, ".ttf")) {
+            Files.write(inputFile.getPath(), fontBytes);
+
+            ProcessExecutorResult result =
+                    ProcessExecutor.getInstance(ProcessExecutor.Processes.CFF_CONVERTER)
+                            .runCommandWithOutputHandling(
+                                    java.util.Arrays.asList(
+                                            fontforgeCommand,
+                                            "-lang=ff",
+                                            "-c",
+                                            "Open($1); "
+                                                    + "ScaleToEm(1000); "
+                                                    + "SelectWorthOutputting(); "
+                                                    + "SetFontOrder(2); "
+                                                    + "Reencode(\"unicode\"); "
+                                                    + "RoundToInt(); "
+                                                    + "RemoveOverlap(); "
+                                                    + "Simplify(); "
+                                                    + "CorrectDirection(); "
+                                                    + "Generate($2, \"\", 4+16+32); "
+                                                    + "Close(); "
+                                                    + "Quit()",
+                                            inputFile.getAbsolutePath(),
+                                            outputFile.getAbsolutePath()));
+
+            if (result.getRc() != 0) {
+                log.warn("FontForge CFF conversion failed: {}", result.getRc());
+                return null;
+            }
+            if (!Files.exists(outputFile.getPath())) {
+                log.warn("FontForge CFF conversion produced no output");
+                return null;
+            }
+            byte[] data = Files.readAllBytes(outputFile.getPath());
+            if (data.length == 0) {
+                log.warn("FontForge CFF conversion returned empty output");
+                return null;
+            }
+            return data;
+        } catch (IOException | InterruptedException ex) {
+            if (ex instanceof InterruptedException) {
+                Thread.currentThread().interrupt();
+            }
+            log.warn("FontForge CFF conversion failed: {}", ex.getMessage());
+            return null;
+        }
+    }
+
+    private boolean isCommandAvailable(String command) {
+        if (command == null || command.isBlank()) {
+            return false;
+        }
+        try {
+            ProcessBuilder processBuilder = new ProcessBuilder();
+            if (System.getProperty("os.name").toLowerCase(Locale.ROOT).contains("windows")) {
+                processBuilder.command("where", command);
+            } else {
+                processBuilder.command("which", command);
+            }
+            Process process = processBuilder.start();
+            int exitCode = process.waitFor();
+            return exitCode == 0;
+        } catch (Exception e) {
+            log.debug("Error checking for command {}: {}", command, e.getMessage());
+            return false;
+        }
+    }
+
+    private String[] buildPythonCommand(String input, String output, String toUnicode) {
+        if (toUnicode != null) {
+            return new String[] {
+                pythonCommand,
+                pythonScript,
+                "--input",
+                input,
+                "--output",
+                output,
+                "--to-unicode",
+                toUnicode
+            };
+        }
+        return new String[] {pythonCommand, pythonScript, "--input", input, "--output", output};
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/PdfJsonImageService.java

@@ -0,0 +1,474 @@
+package stirling.software.SPDF.service.pdfjson;
+
+import java.awt.geom.AffineTransform;
+import java.awt.geom.Point2D;
+import java.awt.image.BufferedImage;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.IdentityHashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.UUID;
+import java.util.function.Consumer;
+
+import javax.imageio.ImageIO;
+
+import org.apache.pdfbox.contentstream.PDFGraphicsStreamEngine;
+import org.apache.pdfbox.contentstream.operator.Operator;
+import org.apache.pdfbox.contentstream.operator.OperatorName;
+import org.apache.pdfbox.cos.COSBase;
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDPageContentStream;
+import org.apache.pdfbox.pdmodel.graphics.image.PDImage;
+import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+import org.apache.pdfbox.util.Matrix;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.api.PdfJsonConversionProgress;
+import stirling.software.SPDF.model.json.PdfJsonImageElement;
+
+/**
+ * Service for handling PDF image operations for JSON conversion (extraction, encoding, rendering).
+ */
+@Service
+@Slf4j
+public class PdfJsonImageService {
+
+    private record EncodedImage(String base64, String format) {}
+
+    private record Bounds(float left, float right, float bottom, float top) {
+        float width() {
+            return Math.max(0f, right - left);
+        }
+
+        float height() {
+            return Math.max(0f, top - bottom);
+        }
+    }
+
+    /**
+     * Collects images from all pages in a PDF document.
+     *
+     * @param document The PDF document
+     * @param totalPages Total number of pages
+     * @param progress Progress callback
+     * @return Map of page number to list of image elements
+     * @throws IOException If image extraction fails
+     */
+    public Map<Integer, List<PdfJsonImageElement>> collectImages(
+            PDDocument document, int totalPages, Consumer<PdfJsonConversionProgress> progress)
+            throws IOException {
+        Map<Integer, List<PdfJsonImageElement>> imagesByPage = new LinkedHashMap<>();
+        Map<COSBase, EncodedImage> imageCache = new IdentityHashMap<>();
+        int pageNumber = 1;
+        for (PDPage page : document.getPages()) {
+            ImageCollectingEngine engine =
+                    new ImageCollectingEngine(page, pageNumber, imagesByPage, imageCache);
+            engine.processPage(page);
+
+            // Update progress for image extraction (70-80%)
+            int imageProgress = 70 + (int) ((pageNumber / (double) totalPages) * 10);
+            progress.accept(
+                    PdfJsonConversionProgress.of(
+                            imageProgress, "images", "Extracting images", pageNumber, totalPages));
+            pageNumber++;
+        }
+        return imagesByPage;
+    }
+
+    /**
+     * Extracts images from a single PDF page (for on-demand lazy loading).
+     *
+     * @param document The PDF document
+     * @param page The specific page to extract images from
+     * @param pageNumber The page number (1-indexed)
+     * @return List of image elements for this page
+     * @throws IOException If image extraction fails
+     */
+    public List<PdfJsonImageElement> extractImagesForPage(
+            PDDocument document, PDPage page, int pageNumber) throws IOException {
+        Map<Integer, List<PdfJsonImageElement>> imagesByPage = new LinkedHashMap<>();
+        ImageCollectingEngine engine =
+                new ImageCollectingEngine(page, pageNumber, imagesByPage, new IdentityHashMap<>());
+        engine.processPage(page);
+        return imagesByPage.getOrDefault(pageNumber, new ArrayList<>());
+    }
+
+    /**
+     * Draws an image element on a PDF page content stream.
+     *
+     * @param contentStream The content stream to draw on
+     * @param document The PDF document
+     * @param element The image element to draw
+     * @param cache Cache of previously created image XObjects
+     * @throws IOException If drawing fails
+     */
+    public void drawImageElement(
+            PDPageContentStream contentStream,
+            PDDocument document,
+            PdfJsonImageElement element,
+            Map<String, PDImageXObject> cache)
+            throws IOException {
+        if (element == null || element.getImageData() == null || element.getImageData().isBlank()) {
+            return;
+        }
+
+        String cacheKey =
+                element.getId() != null && !element.getId().isBlank()
+                        ? element.getId()
+                        : Integer.toHexString(System.identityHashCode(element));
+        PDImageXObject image = cache.get(cacheKey);
+        if (image == null) {
+            image = createImageXObject(document, element);
+            if (image == null) {
+                return;
+            }
+            cache.put(cacheKey, image);
+        }
+
+        List<Float> transform = element.getTransform();
+        if (transform != null && transform.size() == 6) {
+            Matrix matrix =
+                    new Matrix(
+                            safeFloat(transform.get(0), 1f),
+                            safeFloat(transform.get(1), 0f),
+                            safeFloat(transform.get(2), 0f),
+                            safeFloat(transform.get(3), 1f),
+                            safeFloat(transform.get(4), 0f),
+                            safeFloat(transform.get(5), 0f));
+            contentStream.drawImage(image, matrix);
+            return;
+        }
+
+        float width = safeFloat(element.getWidth(), fallbackWidth(element));
+        float height = safeFloat(element.getHeight(), fallbackHeight(element));
+        if (width <= 0f) {
+            width = Math.max(1f, fallbackWidth(element));
+        }
+        if (height <= 0f) {
+            height = Math.max(1f, fallbackHeight(element));
+        }
+        float left = resolveLeft(element, width);
+        float bottom = resolveBottom(element, height);
+
+        contentStream.drawImage(image, left, bottom, width, height);
+    }
+
+    /**
+     * Creates a PDImageXObject from a PdfJsonImageElement.
+     *
+     * @param document The PDF document
+     * @param element The image element with base64 data
+     * @return The created image XObject
+     * @throws IOException If image creation fails
+     */
+    public PDImageXObject createImageXObject(PDDocument document, PdfJsonImageElement element)
+            throws IOException {
+        byte[] data;
+        try {
+            data = Base64.getDecoder().decode(element.getImageData());
+        } catch (IllegalArgumentException ex) {
+            log.debug("Failed to decode image element: {}", ex.getMessage());
+            return null;
+        }
+        String name = element.getId() != null ? element.getId() : UUID.randomUUID().toString();
+        return PDImageXObject.createFromByteArray(document, data, name);
+    }
+
+    private EncodedImage encodeImage(PDImage image) {
+        try {
+            BufferedImage bufferedImage = image.getImage();
+            if (bufferedImage == null) {
+                return null;
+            }
+            String format = resolveImageFormat(image);
+            if (format == null || format.isBlank()) {
+                format = "png";
+            }
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            boolean written = ImageIO.write(bufferedImage, format, baos);
+            if (!written) {
+                if (!"png".equalsIgnoreCase(format)) {
+                    baos.reset();
+                    if (!ImageIO.write(bufferedImage, "png", baos)) {
+                        return null;
+                    }
+                    format = "png";
+                } else {
+                    return null;
+                }
+            }
+            return new EncodedImage(Base64.getEncoder().encodeToString(baos.toByteArray()), format);
+        } catch (IOException ex) {
+            log.debug("Failed to encode image: {}", ex.getMessage());
+            return null;
+        }
+    }
+
+    private String resolveImageFormat(PDImage image) {
+        if (image instanceof PDImageXObject xObject) {
+            String suffix = xObject.getSuffix();
+            if (suffix != null && !suffix.isBlank()) {
+                return suffix.toLowerCase(Locale.ROOT);
+            }
+        }
+        return "png";
+    }
+
+    private float fallbackWidth(PdfJsonImageElement element) {
+        if (element.getRight() != null && element.getLeft() != null) {
+            return Math.max(0f, element.getRight() - element.getLeft());
+        }
+        if (element.getNativeWidth() != null) {
+            return element.getNativeWidth();
+        }
+        return 1f;
+    }
+
+    private float fallbackHeight(PdfJsonImageElement element) {
+        if (element.getTop() != null && element.getBottom() != null) {
+            return Math.max(0f, element.getTop() - element.getBottom());
+        }
+        if (element.getNativeHeight() != null) {
+            return element.getNativeHeight();
+        }
+        return 1f;
+    }
+
+    private float resolveLeft(PdfJsonImageElement element, float width) {
+        if (element.getLeft() != null) {
+            return element.getLeft();
+        }
+        if (element.getX() != null) {
+            return element.getX();
+        }
+        if (element.getRight() != null) {
+            return element.getRight() - width;
+        }
+        return 0f;
+    }
+
+    private float resolveBottom(PdfJsonImageElement element, float height) {
+        if (element.getBottom() != null) {
+            return element.getBottom();
+        }
+        if (element.getY() != null) {
+            return element.getY();
+        }
+        if (element.getTop() != null) {
+            return element.getTop() - height;
+        }
+        return 0f;
+    }
+
+    private List<Float> toMatrixValues(Matrix matrix) {
+        List<Float> values = new ArrayList<>(6);
+        values.add(matrix.getValue(0, 0));
+        values.add(matrix.getValue(0, 1));
+        values.add(matrix.getValue(1, 0));
+        values.add(matrix.getValue(1, 1));
+        values.add(matrix.getValue(2, 0));
+        values.add(matrix.getValue(2, 1));
+        return values;
+    }
+
+    private float safeFloat(Float value, float defaultValue) {
+        if (value == null || Float.isNaN(value) || Float.isInfinite(value)) {
+            return defaultValue;
+        }
+        return value;
+    }
+
+    /**
+     * Inner engine that extends PDFGraphicsStreamEngine to collect images from PDF content streams.
+     */
+    private class ImageCollectingEngine extends PDFGraphicsStreamEngine {
+
+        private final int pageNumber;
+        private final Map<Integer, List<PdfJsonImageElement>> imagesByPage;
+        private final Map<COSBase, EncodedImage> imageCache;
+
+        private COSName currentXObjectName;
+        private int imageCounter = 0;
+
+        protected ImageCollectingEngine(
+                PDPage page,
+                int pageNumber,
+                Map<Integer, List<PdfJsonImageElement>> imagesByPage,
+                Map<COSBase, EncodedImage> imageCache)
+                throws IOException {
+            super(page);
+            this.pageNumber = pageNumber;
+            this.imagesByPage = imagesByPage;
+            this.imageCache = imageCache;
+        }
+
+        @Override
+        public void processPage(PDPage page) throws IOException {
+            super.processPage(page);
+        }
+
+        @Override
+        public void drawImage(PDImage pdImage) throws IOException {
+            EncodedImage encoded = getOrEncodeImage(pdImage);
+            if (encoded == null) {
+                return;
+            }
+            Matrix ctm = getGraphicsState().getCurrentTransformationMatrix();
+            Bounds bounds = computeBounds(ctm);
+            List<Float> matrixValues = toMatrixValues(ctm);
+
+            PdfJsonImageElement element =
+                    PdfJsonImageElement.builder()
+                            .id(UUID.randomUUID().toString())
+                            .objectName(
+                                    currentXObjectName != null
+                                            ? currentXObjectName.getName()
+                                            : null)
+                            .inlineImage(!(pdImage instanceof PDImageXObject))
+                            .nativeWidth(pdImage.getWidth())
+                            .nativeHeight(pdImage.getHeight())
+                            .x(bounds.left)
+                            .y(bounds.bottom)
+                            .width(bounds.width())
+                            .height(bounds.height())
+                            .left(bounds.left)
+                            .right(bounds.right)
+                            .top(bounds.top)
+                            .bottom(bounds.bottom)
+                            .transform(matrixValues)
+                            .zOrder(-1_000_000 + imageCounter)
+                            .imageData(encoded.base64())
+                            .imageFormat(encoded.format())
+                            .build();
+            imageCounter++;
+            imagesByPage.computeIfAbsent(pageNumber, key -> new ArrayList<>()).add(element);
+        }
+
+        @Override
+        public void appendRectangle(Point2D p0, Point2D p1, Point2D p2, Point2D p3)
+                throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void clip(int windingRule) throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void moveTo(float x, float y) throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void lineTo(float x, float y) throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void curveTo(float x1, float y1, float x2, float y2, float x3, float y3)
+                throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public Point2D getCurrentPoint() throws IOException {
+            return new Point2D.Float();
+        }
+
+        @Override
+        public void closePath() throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void endPath() throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void shadingFill(COSName shadingName) throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void fillAndStrokePath(int windingRule) throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void fillPath(int windingRule) throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        public void strokePath() throws IOException {
+            // Not needed for image extraction
+        }
+
+        @Override
+        protected void processOperator(Operator operator, List<COSBase> operands)
+                throws IOException {
+            if (OperatorName.DRAW_OBJECT.equals(operator.getName())
+                    && !operands.isEmpty()
+                    && operands.get(0) instanceof COSName name) {
+                currentXObjectName = name;
+            }
+            super.processOperator(operator, operands);
+            currentXObjectName = null;
+        }
+
+        private EncodedImage getOrEncodeImage(PDImage pdImage) {
+            if (pdImage == null) {
+                return null;
+            }
+            if (pdImage instanceof PDImageXObject xObject) {
+                if (xObject.isStencil()) {
+                    return encodeImage(pdImage);
+                }
+                COSBase key = xObject.getCOSObject();
+                EncodedImage cached = imageCache.get(key);
+                if (cached != null) {
+                    return cached;
+                }
+                EncodedImage encoded = encodeImage(pdImage);
+                if (encoded != null) {
+                    imageCache.put(key, encoded);
+                }
+                return encoded;
+            }
+            return encodeImage(pdImage);
+        }
+
+        private Bounds computeBounds(Matrix ctm) {
+            AffineTransform transform = ctm.createAffineTransform();
+            Point2D.Float p0 = new Point2D.Float(0, 0);
+            Point2D.Float p1 = new Point2D.Float(1, 0);
+            Point2D.Float p2 = new Point2D.Float(0, 1);
+            Point2D.Float p3 = new Point2D.Float(1, 1);
+            transform.transform(p0, p0);
+            transform.transform(p1, p1);
+            transform.transform(p2, p2);
+            transform.transform(p3, p3);
+
+            float minX = Math.min(Math.min(p0.x, p1.x), Math.min(p2.x, p3.x));
+            float maxX = Math.max(Math.max(p0.x, p1.x), Math.max(p2.x, p3.x));
+            float minY = Math.min(Math.min(p0.y, p1.y), Math.min(p2.y, p3.y));
+            float maxY = Math.max(Math.max(p0.y, p1.y), Math.max(p2.y, p3.y));
+
+            if (!Float.isFinite(minX) || !Float.isFinite(minY)) {
+                return new Bounds(0f, 0f, 0f, 0f);
+            }
+            return new Bounds(minX, maxX, minY, maxY);
+        }
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/PdfJsonMetadataService.java

@@ -0,0 +1,148 @@
+package stirling.software.SPDF.service.pdfjson;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.time.Instant;
+import java.time.format.DateTimeParseException;
+import java.util.Base64;
+import java.util.Calendar;
+import java.util.Optional;
+import java.util.TimeZone;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDDocumentInformation;
+import org.apache.pdfbox.pdmodel.common.PDMetadata;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.json.PdfJsonMetadata;
+
+/** Service for extracting and applying PDF metadata (document info and XMP) for JSON conversion. */
+@Service
+@Slf4j
+public class PdfJsonMetadataService {
+
+    /**
+     * Extracts document information metadata from a PDF.
+     *
+     * @param document The PDF document
+     * @return Metadata model with document info
+     */
+    public PdfJsonMetadata extractMetadata(PDDocument document) {
+        PdfJsonMetadata metadata = new PdfJsonMetadata();
+        PDDocumentInformation info = document.getDocumentInformation();
+        if (info != null) {
+            metadata.setTitle(info.getTitle());
+            metadata.setAuthor(info.getAuthor());
+            metadata.setSubject(info.getSubject());
+            metadata.setKeywords(info.getKeywords());
+            metadata.setCreator(info.getCreator());
+            metadata.setProducer(info.getProducer());
+            metadata.setCreationDate(formatCalendar(info.getCreationDate()));
+            metadata.setModificationDate(formatCalendar(info.getModificationDate()));
+            metadata.setTrapped(info.getTrapped());
+        }
+        metadata.setNumberOfPages(document.getNumberOfPages());
+        return metadata;
+    }
+
+    /**
+     * Extracts XMP metadata from a PDF as base64-encoded string.
+     *
+     * @param document The PDF document
+     * @return Base64-encoded XMP metadata, or null if not present
+     */
+    public String extractXmpMetadata(PDDocument document) {
+        if (document.getDocumentCatalog() == null) {
+            return null;
+        }
+        PDMetadata metadata = document.getDocumentCatalog().getMetadata();
+        if (metadata == null) {
+            return null;
+        }
+        try (InputStream inputStream = metadata.createInputStream();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+            inputStream.transferTo(baos);
+            byte[] data = baos.toByteArray();
+            if (data.length == 0) {
+                return null;
+            }
+            return Base64.getEncoder().encodeToString(data);
+        } catch (IOException ex) {
+            log.debug("Failed to extract XMP metadata: {}", ex.getMessage());
+            return null;
+        }
+    }
+
+    /**
+     * Applies metadata to a PDF document.
+     *
+     * @param document The PDF document
+     * @param metadata The metadata to apply
+     */
+    public void applyMetadata(PDDocument document, PdfJsonMetadata metadata) {
+        if (metadata == null) {
+            return;
+        }
+        PDDocumentInformation info = document.getDocumentInformation();
+        info.setTitle(metadata.getTitle());
+        info.setAuthor(metadata.getAuthor());
+        info.setSubject(metadata.getSubject());
+        info.setKeywords(metadata.getKeywords());
+        info.setCreator(metadata.getCreator());
+        info.setProducer(metadata.getProducer());
+        if (metadata.getCreationDate() != null) {
+            parseInstant(metadata.getCreationDate())
+                    .ifPresent(instant -> info.setCreationDate(toCalendar(instant)));
+        }
+        if (metadata.getModificationDate() != null) {
+            parseInstant(metadata.getModificationDate())
+                    .ifPresent(instant -> info.setModificationDate(toCalendar(instant)));
+        }
+        info.setTrapped(metadata.getTrapped());
+    }
+
+    /**
+     * Applies XMP metadata to a PDF document from base64-encoded string.
+     *
+     * @param document The PDF document
+     * @param base64 Base64-encoded XMP metadata
+     */
+    public void applyXmpMetadata(PDDocument document, String base64) {
+        if (base64 == null || base64.isBlank()) {
+            return;
+        }
+        try (InputStream inputStream =
+                new ByteArrayInputStream(Base64.getDecoder().decode(base64))) {
+            PDMetadata metadata = new PDMetadata(document, inputStream);
+            document.getDocumentCatalog().setMetadata(metadata);
+        } catch (IllegalArgumentException | IOException ex) {
+            log.debug("Failed to apply XMP metadata: {}", ex.getMessage());
+        }
+    }
+
+    private String formatCalendar(Calendar calendar) {
+        if (calendar == null) {
+            return null;
+        }
+        return calendar.toInstant().toString();
+    }
+
+    private Optional<Instant> parseInstant(String value) {
+        try {
+            return Optional.of(Instant.parse(value));
+        } catch (DateTimeParseException ex) {
+            log.warn("Failed to parse instant '{}': {}", value, ex.getMessage());
+            return Optional.empty();
+        }
+    }
+
+    private Calendar toCalendar(Instant instant) {
+        Calendar calendar = Calendar.getInstance(TimeZone.getTimeZone("UTC"));
+        calendar.setTimeInMillis(instant.toEpochMilli());
+        return calendar;
+    }
+}

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/PdfLazyLoadingService.java

@@ -0,0 +1,308 @@
+package stirling.software.SPDF.service.pdfjson;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
+import java.util.function.Consumer;
+
+import org.apache.pdfbox.cos.COSBase;
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.api.PdfJsonConversionProgress;
+import stirling.software.SPDF.model.json.PdfJsonAnnotation;
+import stirling.software.SPDF.model.json.PdfJsonCosValue;
+import stirling.software.SPDF.model.json.PdfJsonDocumentMetadata;
+import stirling.software.SPDF.model.json.PdfJsonFont;
+import stirling.software.SPDF.model.json.PdfJsonImageElement;
+import stirling.software.SPDF.model.json.PdfJsonPage;
+import stirling.software.SPDF.model.json.PdfJsonPageDimension;
+import stirling.software.SPDF.model.json.PdfJsonStream;
+import stirling.software.SPDF.model.json.PdfJsonTextElement;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.service.TaskManager;
+import stirling.software.common.util.ExceptionUtils;
+
+/**
+ * Service for lazy loading PDF pages. Caches PDF documents and extracts pages on-demand to reduce
+ * memory usage for large PDFs.
+ */
+@Service
+@Slf4j
+@RequiredArgsConstructor
+public class PdfLazyLoadingService {
+
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final ObjectMapper objectMapper;
+    private final TaskManager taskManager;
+    private final PdfJsonMetadataService metadataService;
+    private final PdfJsonImageService imageService;
+
+    /** Cache for storing PDDocuments for lazy page loading. Key is jobId. */
+    private final Map<String, CachedPdfDocument> documentCache = new ConcurrentHashMap<>();
+
+    /**
+     * Stores PDF file bytes for lazy page loading. Each page is extracted on-demand by re-loading
+     * the PDF from bytes.
+     */
+    @Data
+    private static class CachedPdfDocument {
+        private final byte[] pdfBytes;
+        private final PdfJsonDocumentMetadata metadata;
+        private final long timestamp;
+
+        public CachedPdfDocument(byte[] pdfBytes, PdfJsonDocumentMetadata metadata) {
+            this.pdfBytes = pdfBytes;
+            this.metadata = metadata;
+            this.timestamp = System.currentTimeMillis();
+        }
+    }
+
+    /**
+     * Extracts document metadata, fonts, and page dimensions without page content. Caches the PDF
+     * bytes for subsequent page requests.
+     *
+     * @param file The uploaded PDF file
+     * @param jobId The job ID for caching
+     * @param fonts Font map (will be populated)
+     * @param pageFontResources Page font resources map (will be populated)
+     * @return Serialized metadata JSON
+     * @throws IOException If extraction fails
+     */
+    public byte[] extractDocumentMetadata(
+            MultipartFile file,
+            String jobId,
+            Map<String, PdfJsonFont> fonts,
+            Map<Integer, Map<PDFont, String>> pageFontResources)
+            throws IOException {
+        if (file == null) {
+            throw ExceptionUtils.createNullArgumentException("fileInput");
+        }
+
+        Consumer<PdfJsonConversionProgress> progress =
+                jobId != null
+                        ? (p) -> {
+                            log.info(
+                                    "Progress: [{}%] {} - {}{}",
+                                    p.getPercent(),
+                                    p.getStage(),
+                                    p.getMessage(),
+                                    (p.getCurrent() != null && p.getTotal() != null)
+                                            ? String.format(
+                                                    " (%d/%d)", p.getCurrent(), p.getTotal())
+                                            : "");
+                            reportProgressToTaskManager(jobId, p);
+                        }
+                        : (p) -> {};
+
+        // Read PDF bytes once for processing and caching
+        byte[] pdfBytes = file.getBytes();
+
+        try (PDDocument document = pdfDocumentFactory.load(pdfBytes, true)) {
+            int totalPages = document.getNumberOfPages();
+
+            // Build metadata response
+            progress.accept(PdfJsonConversionProgress.of(90, "metadata", "Extracting metadata"));
+            PdfJsonDocumentMetadata docMetadata = new PdfJsonDocumentMetadata();
+            docMetadata.setMetadata(metadataService.extractMetadata(document));
+            docMetadata.setXmpMetadata(metadataService.extractXmpMetadata(document));
+            docMetadata.setLazyImages(Boolean.TRUE);
+
+            List<PdfJsonFont> serializedFonts = new ArrayList<>(fonts.values());
+            serializedFonts.sort(
+                    Comparator.comparing(
+                            PdfJsonFont::getUid, Comparator.nullsLast(Comparator.naturalOrder())));
+            docMetadata.setFonts(serializedFonts);
+
+            // Extract page dimensions
+            List<PdfJsonPageDimension> pageDimensions = new ArrayList<>();
+            int pageIndex = 0;
+            for (PDPage page : document.getPages()) {
+                PdfJsonPageDimension dim = new PdfJsonPageDimension();
+                dim.setPageNumber(pageIndex + 1);
+                PDRectangle mediaBox = page.getMediaBox();
+                dim.setWidth(mediaBox.getWidth());
+                dim.setHeight(mediaBox.getHeight());
+                dim.setRotation(page.getRotation());
+                pageDimensions.add(dim);
+                pageIndex++;
+            }
+            docMetadata.setPageDimensions(pageDimensions);
+
+            // Cache PDF bytes and metadata for lazy page loading
+            if (jobId != null) {
+                CachedPdfDocument cached = new CachedPdfDocument(pdfBytes, docMetadata);
+                documentCache.put(jobId, cached);
+                log.info(
+                        "Cached PDF bytes ({} bytes) for lazy loading, jobId: {}",
+                        pdfBytes.length,
+                        jobId);
+
+                // Schedule cleanup after 30 minutes
+                scheduleDocumentCleanup(jobId);
+            }
+
+            progress.accept(
+                    PdfJsonConversionProgress.of(100, "complete", "Metadata extraction complete"));
+
+            return objectMapper.writeValueAsBytes(docMetadata);
+        }
+    }
+
+    /**
+     * Extracts a single page from cached PDF bytes. Re-loads the PDF for each request.
+     *
+     * @param jobId The job ID
+     * @param pageNumber The page number (1-indexed)
+     * @param serializeCosValue Function to serialize COS values
+     * @param extractContentStreams Function to extract content streams
+     * @param filterImageXObjectsFromResources Function to filter image XObjects
+     * @param extractText Function to extract text elements for the page
+     * @param extractAnnotations Function to extract annotations for the page
+     * @return Serialized page JSON
+     * @throws IOException If extraction fails
+     */
+    public byte[] extractSinglePage(
+            String jobId,
+            int pageNumber,
+            java.util.function.Function<COSBase, PdfJsonCosValue> serializeCosValue,
+            java.util.function.Function<PDPage, List<PdfJsonStream>> extractContentStreams,
+            java.util.function.Function<COSBase, COSBase> filterImageXObjectsFromResources,
+            java.util.function.BiFunction<PDDocument, Integer, List<PdfJsonTextElement>>
+                    extractText,
+            java.util.function.BiFunction<PDDocument, Integer, List<PdfJsonAnnotation>>
+                    extractAnnotations)
+            throws IOException {
+        CachedPdfDocument cached = documentCache.get(jobId);
+        if (cached == null) {
+            throw new IllegalArgumentException("No cached document found for jobId: " + jobId);
+        }
+
+        int pageIndex = pageNumber - 1;
+        int totalPages = cached.getMetadata().getPageDimensions().size();
+
+        if (pageIndex < 0 || pageIndex >= totalPages) {
+            throw new IllegalArgumentException(
+                    "Page number " + pageNumber + " out of range (1-" + totalPages + ")");
+        }
+
+        log.debug("Loading PDF from bytes to extract page {} (jobId: {})", pageNumber, jobId);
+
+        // Re-load PDF from cached bytes and extract the single page
+        try (PDDocument document = pdfDocumentFactory.load(cached.getPdfBytes(), true)) {
+            PDPage page = document.getPage(pageIndex);
+            PdfJsonPage pageModel = new PdfJsonPage();
+            pageModel.setPageNumber(pageNumber);
+            PDRectangle mediaBox = page.getMediaBox();
+            pageModel.setWidth(mediaBox.getWidth());
+            pageModel.setHeight(mediaBox.getHeight());
+            pageModel.setRotation(page.getRotation());
+
+            // Extract text on-demand
+            pageModel.setTextElements(extractText.apply(document, pageNumber));
+
+            // Extract annotations on-demand
+            pageModel.setAnnotations(extractAnnotations.apply(document, pageNumber));
+
+            // Extract images on-demand
+            List<PdfJsonImageElement> images =
+                    imageService.extractImagesForPage(document, page, pageNumber);
+            pageModel.setImageElements(images);
+
+            // Extract resources and content streams
+            COSBase resourcesBase = page.getCOSObject().getDictionaryObject(COSName.RESOURCES);
+            COSBase filteredResources = filterImageXObjectsFromResources.apply(resourcesBase);
+            pageModel.setResources(serializeCosValue.apply(filteredResources));
+            pageModel.setContentStreams(extractContentStreams.apply(page));
+
+            log.debug(
+                    "Extracted page {} (text: {}, images: {}, annotations: {}) for jobId: {}",
+                    pageNumber,
+                    pageModel.getTextElements().size(),
+                    images.size(),
+                    pageModel.getAnnotations().size(),
+                    jobId);
+
+            return objectMapper.writeValueAsBytes(pageModel);
+        }
+    }
+
+    /** Clears a cached document. */
+    public void clearCachedDocument(String jobId) {
+        CachedPdfDocument cached = documentCache.remove(jobId);
+        if (cached != null) {
+            log.info(
+                    "Removed cached PDF bytes ({} bytes) for jobId: {}",
+                    cached.getPdfBytes().length,
+                    jobId);
+        }
+    }
+
+    /** Schedules automatic cleanup of cached documents after 30 minutes. */
+    private void scheduleDocumentCleanup(String jobId) {
+        new Thread(
+                        () -> {
+                            try {
+                                Thread.sleep(TimeUnit.MINUTES.toMillis(30));
+                                clearCachedDocument(jobId);
+                                log.info("Auto-cleaned cached document for jobId: {}", jobId);
+                            } catch (InterruptedException e) {
+                                Thread.currentThread().interrupt();
+                            }
+                        })
+                .start();
+    }
+
+    /**
+     * Report progress to TaskManager for async jobs
+     *
+     * @param jobId The job ID
+     * @param progress The progress update
+     */
+    private void reportProgressToTaskManager(String jobId, PdfJsonConversionProgress progress) {
+        try {
+            log.info(
+                    "Reporting progress for job {}: {}% - {}",
+                    jobId, progress.getPercent(), progress.getStage());
+            String note;
+            if (progress.getCurrent() != null && progress.getTotal() != null) {
+                note =
+                        String.format(
+                                "[%d%%] %s: %s (%d/%d)",
+                                progress.getPercent(),
+                                progress.getStage(),
+                                progress.getMessage(),
+                                progress.getCurrent(),
+                                progress.getTotal());
+            } else {
+                note =
+                        String.format(
+                                "[%d%%] %s: %s",
+                                progress.getPercent(), progress.getStage(), progress.getMessage());
+            }
+            boolean added = taskManager.addNote(jobId, note);
+            if (!added) {
+                log.warn("Failed to add note - job {} not found in TaskManager", jobId);
+            } else {
+                log.info("Successfully added progress note for job {}: {}", jobId, note);
+            }
+        } catch (Exception e) {
+            log.error("Exception reporting progress for job {}: {}", jobId, e.getMessage(), e);
+        }
+    }
+}