Add cluster deployment artifacts and Helm chart

.dockerignore

@@ -26,9 +26,8 @@ version_builds/
 node_modules/
 **/node_modules/
 frontend/node_modules/
-frontend/editor/dist/
-frontend/dist-portal/
-frontend/editor/playwright-report/
+frontend/dist/
+frontend/playwright-report/
 .npm/
 .yarn/
 

.env.saas.example

@@ -1,20 +1,20 @@
 ###############################################################################
-# Stirling-PDF SaaS environment defaults.
+# Stirling-PDF SaaS local environment template.
 #
-# This file is committed and provides non-secret defaults loaded by
-# `task backend:dev:saas`. Put real values for secrets (passwords, project
-# refs, edge function secrets) in `.env.saas.local` - any variable set there
-# takes precedence over what's defined here.
+# Copy this file to `.env.saas.local` (gitignored) and fill in real values.
+# Loaded by `task backend:dev:saas` via Taskfile's `dotenv:` directive, then
+# read by Spring Boot's `${...}` placeholders in application-saas.properties
+# and application-dev.properties.
 #
-# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
+# DO NOT commit `.env.saas.local`. Only `.env.saas.example` is checked in.
 ###############################################################################
 
 # ---------- Supabase project ----------
 # Project reference (the subdomain part of <ref>.supabase.co). Required.
-# Set in .env.saas.local.
+# Example dev project:
 SAAS_DB_PROJECT_REF=
 
-# Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
+# Edge function secret used by billing/license rollup calls.
 SUPABASE_EDGE_FUNCTION_SECRET=
 
 # ---------- Database (saas profile) ----------
@@ -28,7 +28,7 @@ SAAS_DB_PASSWORD=
 # ---------- Database (dev profile overrides) ----------
 # Used when `--spring.profiles.include=dev` is active. The dev profile
 # defaults the URL/username to the shared dev Supabase project, but the
-# password must still be provided in .env.saas.local.
+# password must still be provided here.
 SAAS_DEV_DB_URL=
 SAAS_DEV_DB_USERNAME=postgres
 SAAS_DEV_DB_PASSWORD=

.github/actions/setup-bot/action.yml

@@ -24,7 +24,7 @@ runs:
       id: generate-token
       uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       with:
-        client-id: ${{ inputs.app-id }}
+        app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
     - name: Configure Git
       run: |

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.12.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.12.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')

.github/config/.files.yaml

@@ -1,8 +1,6 @@
 build: &build
   - build.gradle
   - app/(common|core|proprietary)/build.gradle
-  - Taskfile.yml
-  - .taskfiles/backend.yml
 
 openapi: &openapi
   - *build
@@ -40,11 +38,6 @@ project: &project
   - frontend/**
   - docker/**
   - scripts/RestartHelper.java
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .taskfiles/docker.yml
-  - scripts/db-migration/**
-  - .github/workflows/db-migration-test.yml
 
 frontend: &frontend
   - frontend/**
@@ -60,9 +53,6 @@ frontend: &frontend
   - scripts/summarize_type3_signatures.py
   - scripts/type3_to_cff.py
   - scripts/update_type3_library.py
-  - Taskfile.yml
-  - .taskfiles/frontend.yml
-  - .taskfiles/e2e.yml
 
 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
@@ -74,8 +64,6 @@ tauri: &tauri
   - frontend/package-lock.json
   - frontend/editor/vite.config.ts
   - .github/workflows/tauri-build.yml
-  - Taskfile.yml
-  - .taskfiles/desktop.yml
 
 # Files that affect the AI engine (Python tool models, fixers, tests). Gate
 # the engine validation job on changes to engine sources or to the Java
@@ -84,8 +72,6 @@ engine: &engine
   - engine/**
   - app/(common|core|proprietary)/src/main/java/**
   - .github/workflows/ai-engine.yml
-  - Taskfile.yml
-  - .taskfiles/engine.yml
 
 licenses-frontend: &licenses-frontend
   - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -114,4 +100,4 @@ proprietary: &proprietary
   - configs/settings.yml.template
   - build.gradle
   - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml
+  - .github/workflows/build-enterprise.yml

.github/scripts/check_language_toml.py

@@ -13,7 +13,7 @@ Usage:
 """
 
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-US/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
 
 import argparse
 import glob
@@ -184,7 +184,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
     if len(file_list) == 1:
         file_arr = file_list[0].split()
 
-    base_dir = Path.cwd() / "frontend" / "editor" / "public" / "locales"
+    base_dir = Path.cwd() / "frontend" / "public" / "locales"
 
     for file_path in file_arr:
         file_path = Path(file_path)
@@ -211,7 +211,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
             )
             continue
 
-        if basename_current_file == basename_reference_file and locale_dir == "en-US":
+        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
             continue
 
         if (
@@ -308,7 +308,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-US/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -372,7 +372,6 @@ if __name__ == "__main__":
                 os.path.join(
                     os.getcwd(),
                     "frontend",
-                    "editor",
                     "public",
                     "locales",
                     "*",

.github/scripts/verify-updater-signatures.py

@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
-
-Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
-"""
-
-import binascii
-import sys
-import json
-import base64
-import hashlib
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from cryptography.exceptions import InvalidSignature
-
-ART_ROOT = Path(sys.argv[1])
-CONF = Path(
-    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
-)
-
-
-def load_pubkey():
-    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
-    # [2 algo][8 key-id][32 ed25519 public key].
-    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
-    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
-    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
-
-
-def hash_file(path: Path) -> bytes:
-    h = hashlib.blake2b(digest_size=64)
-    with path.open("rb") as f:
-        for chunk in iter(lambda: f.read(1 << 16), b""):
-            h.update(chunk)
-    return h.digest()
-
-
-def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
-    # tauri .sig = base64 of a minisign signature file (4 lines).
-    try:
-        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
-        sig_blob = base64.b64decode(lines[1])
-    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
-        return f"FAIL malformed sig ({type(e).__name__})"
-    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
-    if keyid != keyid_pub:
-        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
-    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
-    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
-    try:
-        pub.verify(sig, msg)
-    except InvalidSignature:
-        return f"FAIL signature invalid (algo={algo.decode()})"
-    # Global signature covers sig + trusted_comment.
-    gc = "global-sig FAIL"
-    try:
-        tc = lines[2].split("trusted comment: ", 1)[1]
-        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
-        gc = "global-sig OK"
-    except (InvalidSignature, IndexError, binascii.Error):
-        pass
-    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
-
-
-keyid_pub, pub = load_pubkey()
-print(f"updater pubkey keyid={keyid_pub.hex()}\n")
-sigs = sorted(ART_ROOT.rglob("*.sig"))
-if not sigs:
-    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
-    sys.exit(0)
-bad = 0
-for sig_file in sigs:
-    artifact = sig_file.with_suffix("")
-    if not artifact.exists():
-        print(f"  ? {sig_file.name}: artifact missing")
-        bad += 1
-        continue
-    res = verify(artifact, sig_file, keyid_pub, pub)
-    print(f"  {artifact.name}: {res}")
-    if not res.startswith("VALID") or "global-sig FAIL" in res:
-        bad += 1
-print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
-sys.exit(1 if bad else 0)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -239,7 +239,7 @@ jobs:
 
       - name: Build and push V2 image (Depot)
         if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -287,13 +287,12 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "false"
                 SECURITY_ENABLELOGIN: "true"
                 SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
                 SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
                 UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
@@ -310,7 +309,7 @@ jobs:
 
           ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
             # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
+            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}
 
             # Move docker-compose file to correct location
             mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -222,10 +222,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Run Gradle Command
         run: |
           if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -256,7 +256,7 @@ jobs:
 
       - name: Build and push PR-specific image (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -285,7 +285,7 @@ jobs:
 
       - name: Build and push engine image (Depot)
         if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: ./engine
@@ -388,7 +388,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                 SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
                 UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
                 UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"

.github/workflows/ai-engine.yml

@@ -1,9 +1,8 @@
 name: AI Engine CI
 
-# Validates the Python AI engine: regenerates tool models and runs the
-# engine quality gate (lint, type-check, format-check, tests). Called from
-# build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net.
+# Validates the Python AI engine: regenerates tool models, runs fixers,
+# lint, type-check, and tests. Called from build.yml on PRs and merge_group;
+# also runs directly on push to main as a post-merge safety net.
 on:
   workflow_call:
   push:
@@ -43,104 +42,36 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Regenerate tool models
         run: task engine:tool-models
 
       - name: Verify tool models are up to date
-        id: tool-models-check
-        continue-on-error: true
-        run: git diff --exit-code engine/src/stirling/models/tool_models.py
-
-      - name: Comment on tool models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.tool-models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const body = [
-              marker,
-              '### Tool Models Check Failed',
-              '',
-              'The generated `engine/src/stirling/models/tool_models.py` is out of date with the Java OpenAPI spec and will need to be regenerated before it can be merged in.',
-              '',
-              'Run `task engine:tool-models` to regenerate, then commit the updated file.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if tool models check failed
-        if: steps.tool-models-check.outcome == 'failure'
         run: |
-          echo "============================================"
-          echo "  Tool Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "The generated engine/src/stirling/models/tool_models.py"
-          echo "is out of date with the Java OpenAPI spec and will"
-          echo "need to be regenerated before it can be merged in."
-          echo ""
-          echo "Run 'task engine:tool-models' to regenerate, then"
-          echo "commit the updated file."
-          echo "============================================"
-          exit 1
+          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
+            echo "tool_models.py is out of date."
+            echo "Run 'task engine:tool-models' locally and commit the updated file."
+            exit 1
+          fi
 
-      - name: Remove tool models check comment on success
-        if: steps.tool-models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run fixers
+        run: task engine:fix
 
-      - name: Quality-check engine
-        id: engine-check
-        run: task engine:check
-        continue-on-error: true
+      - name: Verify fixes are committed
+        id: fixer_changes
+        run: |
+          if ! git diff --quiet; then
+            git --no-pager diff --stat
+            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
+            exit 1
+          fi
 
-      - name: Comment on engine check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
+      - name: Comment on fixer failures
+        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
         continue-on-error: true
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -176,39 +107,11 @@ jobs:
               });
             }
 
-      - name: Fail if engine check failed
-        if: steps.engine-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Engine Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your Python code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task engine:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task engine:check'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
+      - name: Run linting
+        run: task engine:lint
 
-      - name: Remove engine check comment on success
-        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run type checking
+        run: task engine:typecheck
+
+      - name: Run tests
+        run: task engine:test

.github/workflows/backend-build.yml

@@ -1,14 +1,8 @@
 name: Backend build, format check, and coverage
 
 # Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
+# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
-#
-# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
-#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
-#   proprietary  - default build, no saas
-#   saas         - proprietary + the saas subproject (build + JUnit only,
-#                  never any runtime/integration testing)
 on:
   workflow_call:
 
@@ -31,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         jdk-version: [25]
-        flavor: [core, proprietary, saas]
+        spring-security: [true, false]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -58,16 +52,13 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check Java formatting (Spotless)
-        # Runs once per matrix combination - pick the cheapest leg
-        # (core - no proprietary, no saas) so we don't wait for the
-        # heavier flavors just to fail formatting.
-        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
+        if: matrix.jdk-version == 25 && matrix.spring-security == false
         id: spotless-check
         run: task backend:format:check
         continue-on-error: true
@@ -76,7 +67,7 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
-      - name: Comment on backend format check failure
+      - name: Comment on Java formatting failure
         # Only post a comment on PRs. github-script's PR helpers need an
         # issue/PR number, which doesn't exist on merge_group runs.
         if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
@@ -87,11 +78,15 @@ jobs:
             const marker = '<!-- java-formatting-check -->';
             const body = [
               marker,
-              '### Backend Format Check Failed',
+              '### Java Formatting Check Failed',
               '',
-              'There are formatting issues in your Java code that will need to be fixed before they can be merged in.',
+              'Your code has formatting issues. Run the following command to fix them:',
               '',
-              'Run `task backend:format` to auto-fix, then commit and push the changes.',
+              '```bash',
+              'task backend:format',
+              '```',
+              '',
+              'Then commit and push the changes.',
             ].join('\n');
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
@@ -115,61 +110,33 @@ jobs:
               });
             }
 
-      - name: Fail if backend format check failed
+      - name: Fail if Java formatting issues found
         if: steps.spotless-check.outcome == 'failure'
         run: |
           echo "============================================"
-          echo "  Backend Format Check Failed"
+          echo "  Java Formatting Check Failed"
           echo "============================================"
           echo ""
-          echo "There are formatting issues in your Java code"
-          echo "that will need to be fixed before they can be"
-          echo "merged in."
+          echo "Your code has formatting issues."
+          echo "Run the following command to fix them:"
           echo ""
-          echo "Run 'task backend:format' to auto-fix, then"
-          echo "commit and push the changes."
+          echo "  task backend:format"
+          echo ""
+          echo "Then commit and push the changes."
           echo "============================================"
           exit 1
 
-      - name: Remove backend format check comment on success
-        if: steps.spotless-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
-      - name: Build with Gradle (flavor=${{ matrix.flavor }})
-        # STIRLING_FLAVOR is read by settings.gradle and expands into the
-        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
-        # so we don't have to set them by hand. The saas flavor pulls in
-        # the app/saas subproject (unit tests only - no runtime tests).
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
         run: task backend:build:ci
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          STIRLING_FLAVOR: ${{ matrix.flavor }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
 
       - name: Check Test Reports Exist
         if: always()
         run: |
-          # Common + core + proprietary always build (proprietary is
-          # excluded only at runtime, not from the gradle subproject
-          # graph). Saas builds add a fourth report dir.
           declare -a dirs=(
             "app/core/build/reports/tests/"
             "app/core/build/test-results/"
@@ -178,9 +145,6 @@ jobs:
             "app/proprietary/build/reports/tests/"
             "app/proprietary/build/test-results/"
           )
-          if [ "${{ matrix.flavor }}" = "saas" ]; then
-            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
-          fi
           for dir in "${dirs[@]}"; do
             if [ ! -d "$dir" ]; then
               echo "Missing $dir"
@@ -192,7 +156,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
           path: |
             app/**/build/reports/jacoco/test
             app/**/build/reports/tests/
@@ -202,47 +166,7 @@ jobs:
           retention-days: 3
           if-no-files-found: warn
 
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml to
-        # silence security scanners that pattern-match on the stdlib
-        # xml.etree.ElementTree.parse call.
-        if: always() && matrix.flavor == 'saas'
-        run: python -m pip install --quiet defusedxml
-
-      - name: JaCoCo coverage step summary
-        # Only the saas leg posts the JUnit summary - it's a strict
-        # superset of the core + proprietary legs (same .exec files plus
-        # the saas subproject). Posting from all three would mean three
-        # near-identical tables crowding out the aggregate report.
-        if: always() && matrix.flavor == 'saas'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
-            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload raw JUnit .exec for aggregate merge
-        # Same dedup rationale as the summary step: upload from the saas
-        # leg only (the most complete set, includes app/saas/.../test.exec)
-        # so the aggregate workflow merges the union rather than three
-        # overlapping subsets.
-        #
-        # Separate artifact from the HTML reports so the aggregate
-        # workflow can grab just the .exec files with a name pattern
-        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
-        # tarball.
-        if: always() && matrix.flavor == 'saas'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
-          path: app/*/build/jacoco/*.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
         # The action only supports the pull_request event (it posts a PR comment),
         # so skip it for merge_group runs and workflow_dispatch.
         if: github.event_name == 'pull_request'

.github/workflows/build-enterprise.yml

@@ -78,7 +78,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install Playwright (chromium only)
         run: task e2e:install -- chromium
       - name: Build frontend (needed for playwright's vite preview webServer)

.github/workflows/build.yml

@@ -68,18 +68,6 @@ jobs:
     uses: ./.github/workflows/backend-build.yml
     secrets: inherit
 
-  db-migration-test:
-    # Boots the current bootJar against H2 fixtures captured from past
-    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
-    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
-    # the `project` filter so doc-only PRs skip this ~5-minute job.
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/db-migration-test.yml
-    secrets: inherit
-
   check-generateOpenApiDocs:
     if: needs.files-changed.outputs.openapi == 'true'
     needs: [files-changed]
@@ -185,24 +173,6 @@ jobs:
     uses: ./.github/workflows/dependency-review.yml
     secrets: inherit
 
-  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
-  # artifacts produced by the jobs above into one report, plus pulls
-  # in vitest + Playwright frontend coverage for the per-area matrix.
-  # `if: always()` so a producer failing partway still gets credit
-  # for whatever did record. Advisory only - intentionally NOT in
-  # all-checks-passed, so a flaky aggregate run never blocks merging.
-  coverage-aggregate:
-    if: always()
-    needs:
-      - build
-      - playwright-e2e-live
-      - docker-compose-tests
-      - frontend-validation
-    permissions:
-      contents: read
-    uses: ./.github/workflows/coverage-aggregate.yml
-    secrets: inherit
-
   # Single status check that branch protection should mark as required.
   # Succeeds when every upstream job is either `success` or `skipped` (path-
   # gated jobs that didn't apply this run). Any `failure` or `cancelled`
@@ -214,7 +184,6 @@ jobs:
     needs:
       - files-changed
       - build
-      - db-migration-test
       - check-generateOpenApiDocs
       - frontend-validation
       - playwright-e2e
@@ -239,7 +208,6 @@ jobs:
           RESULTS: |
             files-changed=${{ needs.files-changed.result }}
             build=${{ needs.build.result }}
-            db-migration-test=${{ needs.db-migration-test.result }}
             check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
             frontend-validation=${{ needs.frontend-validation.result }}
             playwright-e2e=${{ needs.playwright-e2e.result }}

.github/workflows/check-licence.yml

@@ -40,11 +40,11 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check licenses for compatibility
         run: task backend:licenses:check
         env:

.github/workflows/check-openapi.yml

@@ -45,11 +45,11 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Generate OpenAPI documentation
         run: task backend:swagger
         env:

.github/workflows/check_toml.yml

@@ -166,16 +166,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
+            if (changedFiles.includes("frontend/editor/public/locales/en-GB/translation.toml")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/editor/public/locales/en-GB/translation.toml",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-US.toml";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -183,11 +183,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/editor/public/locales/en-GB/translation.toml",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-US.toml";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -293,6 +293,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/coverage-aggregate.yml

@@ -1,230 +0,0 @@
-name: Aggregate backend coverage
-
-# Reusable workflow called from build.yml after every backend coverage
-# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
-# .exec, merges them into one JaCoCo report, and posts a combined step
-# summary alongside the per-source ones.
-#
-# Kept separate from the per-source jobs so:
-#   - the per-source jobs stay fast and independent (no cross-job waits)
-#   - this job can `if: always()` and still produce something useful when
-#     one of the producers fails partway through
-#   - frontend producers can be added later without touching the
-#     producers themselves
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  aggregate:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 15
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for coverage scripts
-        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
-        # XML through defusedxml - see the script headers for context.
-        run: python -m pip install --quiet defusedxml
-
-      # Pattern matches every artifact this PR's producers might upload:
-      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
-      #                                         leg of backend-build, which
-      #                                         is a strict superset of the
-      #                                         core + proprietary legs)
-      #   jacoco-exec-e2e-live
-      #   jacoco-exec-cucumber
-      # Each lands as a sibling dir under coverage-execs/, with the .exec
-      # files preserving their original relative paths.
-      - name: Download all .exec artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          pattern: jacoco-exec-*
-          path: coverage-execs/
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Inventory .exec files
-        id: inventory
-        # Splits the downloaded artifacts into two buckets:
-        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
-        #   * all       = the above plus JUnit (everything we test)
-        #
-        # Bucketing is by artifact-name prefix: download-artifact preserves
-        # the artifact name as the top-level dir, so JUnit's `.exec`s live
-        # under coverage-execs/jacoco-exec-junit-*/... while the others
-        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
-        #
-        # If nothing was uploaded (e.g. all producers crashed before
-        # writing) we exit gracefully so this advisory job never fails CI.
-        run: |
-          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
-          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
-          if [ "${#all_execs[@]}" -eq 0 ]; then
-            echo "::warning::No .exec artifacts found - skipping aggregate report"
-            echo "found_all=false" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          printf 'All %d .exec files:\n' "${#all_execs[@]}"
-          printf '  %s\n' "${all_execs[@]}"
-          IFS=','; all_joined="${all_execs[*]}"
-          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
-          echo "found_all=true" >> "$GITHUB_OUTPUT"
-          if [ "${#e2e_execs[@]}" -eq 0 ]; then
-            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-          else
-            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
-            printf '  %s\n' "${e2e_execs[@]}"
-            unset IFS
-            IFS=','; e2e_joined="${e2e_execs[*]}"
-            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Compile classes for JaCoCo class lookup
-        # jacocoReportFromExec only needs the compiled .class files
-        # under each subproject's build/classes/java/main/. `classes`
-        # (compileJava + processResources) is enough; we skipped the
-        # heavier `assemble` to avoid building bootJar / fat jars that
-        # add 60+ seconds per run for no gain to the report.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: ./gradlew classes -PnoSpotless
-
-      - name: Generate e2e-only JaCoCo report
-        # "Real user-flow" coverage: only counts code reached by an actual
-        # HTTP request from cucumber or live Playwright. Useful for
-        # questions like "how much of our backend does a user actually
-        # hit?". Skipped when neither producer uploaded a .exec.
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
-            -PreportDir=build/reports/jacoco/aggregate-e2e \
-            -PnoSpotless
-
-      - name: Generate combined JaCoCo report (everything)
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
-            -PreportDir=build/reports/jacoco/aggregate-all \
-            -PnoSpotless
-
-      - name: E2E-only step summary
-        # Rendered first so it gets prime real estate in the Summary
-        # tab - this is the number most readers actually want
-        # ("how much of the backend do real user flows cover?").
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: ALL-sources step summary
-        # Separate call (not a multi-input one) because the helper's
-        # rightmost "Aggregate" column would sum the two reports - which
-        # is meaningless when one is a strict superset of the other.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload combined aggregate report
-        if: steps.inventory.outputs.found_all == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-all-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-all/
-          retention-days: 14
-
-      - name: Upload e2e-only aggregate report
-        if: steps.inventory.outputs.found_e2e == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-e2e-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-e2e/
-          retention-days: 14
-
-      # --------------------------------------------------------------
-      # Per-area matrix: rolls backend + frontend coverage into one
-      # table indexed by core/proprietary/saas/desktop. Pulls the
-      # frontend artifacts now (after the JaCoCo step has done its
-      # work) so the per-source backend summaries still render first
-      # even if the matrix step fails.
-      # --------------------------------------------------------------
-      - name: Download vitest coverage artifact
-        # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence so a backend-only PR still produces the matrix with
-        # just backend rows populated.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: frontend-coverage
-          path: matrix-inputs/vitest/
-        continue-on-error: true
-
-      - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads as `playwright-frontend-coverage-<run_id>`.
-        # Same tolerance as vitest - matrix script handles missing inputs.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: matrix-inputs/playwright/
-        continue-on-error: true
-
-      - name: Coverage matrix step summary
-        if: always()
-        # Matrix references the two aggregate JaCoCo XMLs (already
-        # generated above) plus whichever frontend artifacts landed.
-        # Every input is optional; missing ones render as "-".
-        run: |
-          python scripts/coverage-matrix.py \
-            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
-            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
-            --vitest matrix-inputs/vitest/coverage-summary.json \
-            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
-            --title "Coverage matrix (per-area, e2e vs all)" \
-            --github-step-summary

.github/workflows/db-migration-test.yml

@@ -1,93 +0,0 @@
-name: DB migration smoke test
-
-# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
-# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
-# Catches schema changes that would break existing user databases under
-# Hibernate's `ddl-auto=update` upgrade path.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  migration-test:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    timeout-minutes: 30
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: 25
-          distribution: temurin
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.5.1
-          cache-disabled: true
-
-      # No `-PnoSpotless` here yet because the upstream cache layer matches the
-      # backend build's; reuse keeps cold-cache cost identical.
-      - name: Build Stirling-PDF JAR
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
-
-      - name: Locate built JAR
-        id: jar
-        run: |
-          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
-              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
-          if [[ -z "$jar" ]]; then
-            echo "::error::No JAR under app/core/build/libs"
-            ls -lah app/core/build/libs || true
-            exit 1
-          fi
-          # Absolute path - the migration script pushd's into a temp workdir
-          # before invoking java, which would dangle a relative path.
-          jar=$(realpath "$jar")
-          echo "path=$jar" >> "$GITHUB_OUTPUT"
-          echo "Built JAR: $jar"
-
-      - name: Run migration smoke test
-        env:
-          STIRLING_JAR: ${{ steps.jar.outputs.path }}
-        run: bash scripts/db-migration/run-migration-test.sh
-
-      - name: Upload app logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: db-migration-app-logs
-          # Path matches the preserved workdir in run-migration-test.sh -
-          # only failing fixtures leave a directory behind.
-          path: /tmp/stirling-migration-failed-*/app.log
-          retention-days: 7
-          if-no-files-found: warn

.github/workflows/deploy-on-v2-commit.yml

@@ -107,7 +107,7 @@ jobs:
 
       - name: Build and push frontend image (Depot)
         if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -136,7 +136,7 @@ jobs:
 
       - name: Build and push backend image (Depot)
         if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -188,7 +188,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2"
                 UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
                 UI_APPNAMENAVBAR: "V2 Deployment"

.github/workflows/docker-compose-tests.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Set up Docker Buildx
@@ -87,12 +87,6 @@ jobs:
         run: |
           pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
 
-      - name: Extract JaCoCo agent for cucumber coverage
-        # Stages build/jacoco/jacocoagent.jar where the coverage override
-        # file bind-mounts it into the cucumber container. The agent jar
-        # never goes into the published image - this is host-only.
-        run: ./gradlew copyJacocoAgent -PnoSpotless
-
       - name: Run Docker Compose Tests
         run: |
           chmod +x ./testing/test_webpages.sh
@@ -104,62 +98,6 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
-          # over the cucumber compose so the container starts with the
-          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
-          STIRLING_PDF_TEST_COVERAGE: "1"
-
-      - name: Generate cucumber JaCoCo report
-        # `if: always()` so a behave failure still produces partial
-        # coverage from whatever endpoints did run. The exec file only
-        # exists when the container shut down cleanly - guard so the step
-        # is silent on the (rare) crash path.
-        if: always()
-        id: cucumber-coverage
-        run: |
-          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=testing/cucumber-coverage/cucumber.exec \
-              -PreportDir=build/reports/jacoco/cucumber \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml -
-        # see the script header for context.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-
-      - name: Cucumber coverage step summary
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Cucumber (docker) JaCoCo coverage" \
-            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload cucumber JaCoCo report
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-cucumber-${{ github.run_id }}
-          path: build/reports/jacoco/cucumber/
-          retention-days: 7
-
-      - name: Upload raw cucumber .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-cucumber
-          path: testing/cucumber-coverage/cucumber.exec
-          retention-days: 7
-          if-no-files-found: warn
 
       - name: Upload Cucumber Report
         if: always()

.github/workflows/e2e-live.yml

@@ -42,139 +42,16 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install Playwright (chromium only)
         run: task e2e:install -- chromium
       - name: Build frontend (production bundle for vite preview)
         env:
           VITE_BUILD_FOR_PREVIEW: "1"
         run: task frontend:build
-      - name: Run live E2E tests (chromium) with coverage
+      - name: Run live E2E tests (chromium)
         id: live-tests
-        env:
-          # Attaches the JaCoCo agent to the bootRun JVM (see
-          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
-          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
-          # report step below sees a populated file.
-          COVERAGE: "1"
-          # Tells the Playwright fixture (test-base.ts) to capture per-test
-          # V8 JS coverage. Raw dumps land under
-          # .test-state/playwright/coverage-pw/ for the post-process step
-          # to aggregate. Chromium-only - other engines silently skip.
-          PW_COVERAGE: "1"
         run: task e2e:live
-      - name: Generate JaCoCo report from e2e:live .exec
-        if: always()
-        id: live-coverage
-        # `if: always()` so even a failed test run still produces a
-        # report from whatever flows did exercise the backend before
-        # the failure. The task itself tolerates a missing .exec
-        # (jacoco emits an empty report rather than crashing) but we
-        # guard with `test -s` to keep the job log clean.
-        run: |
-          if [ -s .test-state/playwright/jacoco.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=.test-state/playwright/jacoco.exec \
-              -PreportDir=build/reports/jacoco/e2e-live \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set up Python for coverage summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
-        # to dodge XXE / billion-laughs scanner findings.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-      - name: e2e:live coverage step summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live backend) JaCoCo coverage" \
-            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
-            --github-step-summary
-      - name: Upload e2e:live JaCoCo report
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-e2e-live-${{ github.run_id }}
-          path: build/reports/jacoco/e2e-live/
-          retention-days: 7
-
-      - name: Upload raw e2e:live .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-e2e-live
-          path: .test-state/playwright/jacoco.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Set up Python for frontend coverage summary
-        # Separate from the backend-coverage python step because the
-        # frontend path doesn't depend on a JaCoCo report - it produces
-        # a summary even on backend failure, as long as some Playwright
-        # tests ran far enough to dump V8 coverage.
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for frontend coverage summary
-        # Idempotent re-install: the backend-coverage step may have
-        # installed it already, but this leg can run on its own when the
-        # backend report step skips (e.g. .exec missing).
-        if: always()
-        run: python -m pip install --quiet defusedxml
-
-      - name: Aggregate Playwright frontend (V8) coverage
-        # Rolls per-test V8 dumps from the test-base fixture into one
-        # vitest-shaped coverage-summary.json. Tolerates a missing dump
-        # dir (firefox/webkit runs, or a failure before any test got
-        # far enough to dump).
-        if: always()
-        id: pw-frontend-coverage
-        run: |
-          if [ -d .test-state/playwright/coverage-pw ] && \
-             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            python scripts/playwright-coverage-summary.py \
-              .test-state/playwright/coverage-pw \
-              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
-            echo "summary=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
-            echo "summary=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Playwright frontend coverage step summary
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live) frontend coverage" \
-            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-            --github-step-summary
-
-      - name: Upload Playwright frontend coverage
-        # Bundle both the aggregated summary and the raw V8 dumps so
-        # someone debugging "why is this function showing as covered"
-        # can trace it back to the source dump.
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: |
-            .test-state/playwright/coverage-pw-summary/
-            .test-state/playwright/coverage-pw/
-          retention-days: 7
-
       - name: Print backend log on failure
         if: failure() && steps.live-tests.conclusion == 'failure'
         run: |
@@ -188,30 +65,10 @@ jobs:
           name: backend-log-live-${{ github.run_id }}
           path: .test-state/playwright/backend.log
           retention-days: 7
-      - name: List Playwright output locations (debug)
-        if: always()
-        run: |
-          echo "::group::Playwright output dirs"
-          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend/editor has
-          # none), so artifacts land under frontend/, not frontend/editor/.
-          ls -la frontend/playwright-report 2>/dev/null \
-            || echo "no playwright-report at frontend/"
-          ls -la frontend/test-results 2>/dev/null \
-            || echo "no test-results at frontend/"
-          find . -name node_modules -prune -o -name 'trace.zip' -print 2>/dev/null || true
-          echo "::endgroup::"
-      - name: Upload Playwright report + traces
+      - name: Upload Playwright report
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report-live-${{ github.run_id }}
-          # test-results/ holds the per-test trace.zip (with browser console
-          # logs) + screenshots/video; playwright-report/ is the HTML report.
-          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend/editor has none).
-          path: |
-            frontend/playwright-report/
-            frontend/test-results/
+          path: frontend/editor/playwright-report/
           retention-days: 7
-          if-no-files-found: warn

.github/workflows/e2e-stubbed.yml

@@ -36,7 +36,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install Playwright (chromium only)
         run: task e2e:install -- chromium
       - name: Build frontend (production bundle for vite preview)

.github/workflows/frontend-backend-licenses-update.yml

@@ -97,7 +97,7 @@ jobs:
         run: npm ci --ignore-scripts --audit=false --fund=false
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Generate frontend license report (internal PR)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
         env:
@@ -110,8 +110,8 @@ jobs:
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
         working-directory: frontend
         run: |
-          mkdir -p editor/src/assets
-          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
 
       - name: Postprocess with project script (BASE version)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
@@ -349,10 +349,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check licenses and generate report
         id: license-check
         run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV

.github/workflows/frontend-validation.yml

@@ -31,7 +31,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Quality-check frontend
         id: frontend-check
         run: task frontend:check:all
@@ -109,41 +109,6 @@ jobs:
                 comment_id: existing.id,
               });
             }
-      - name: Vitest coverage
-        # Separate from `frontend:check:all` so the quality-gate run stays
-        # uninstrumented (faster signal) and coverage stays an informational
-        # follow-up. Continue-on-error keeps the workflow green even when
-        # a handful of test files refuse to import (e.g. missing icon
-        # specifiers) - the summary still gets posted with whatever
-        # vitest managed to instrument.
-        id: frontend-coverage
-        continue-on-error: true
-        run: task frontend:test:coverage
-      - name: Set up Python for coverage summary
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # See coverage-summary.py header - it parses XML through defusedxml
-        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
-        if: always()
-        run: python -m pip install --quiet defusedxml
-      - name: Vitest coverage step summary
-        if: always()
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Frontend Vitest coverage" \
-            --vitest frontend/editor/coverage/coverage-summary.json \
-            --github-step-summary
-      - name: Upload vitest coverage report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-coverage
-          path: frontend/editor/coverage/
-          retention-days: 7
-          if-no-files-found: warn
       - name: Upload frontend build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

.github/workflows/multiOSReleases.yml

@@ -73,10 +73,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Get version number
         id: versionNumber
         run: |
@@ -148,7 +148,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
@@ -159,7 +159,7 @@ jobs:
           cache-dependency-path: frontend/package-lock.json
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Build JAR
         run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
@@ -252,10 +252,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       # Build the universal JRE before desktop:prepare so the jlink:runtime
       # task short-circuits on its `test -d runtime/jre` status check.
@@ -442,6 +442,10 @@ jobs:
           echo "Generated tauri.windows.conf.json (alias masked):"
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
 
+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+
       - name: Import release GPG signing key (Linux)
         if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |
@@ -491,7 +495,6 @@ jobs:
           projectPath: ./frontend/editor
           tauriScript: npx tauri
           args: ${{ matrix.args }}
-          updaterJsonKeepUniversal: true
 
       - name: Clear release GPG key from runner keyring (Linux)
         if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -583,37 +586,21 @@ jobs:
         if: always() && steps.digicert-setup.conclusion != 'failure'
         shell: bash
         run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
+          mkdir -p ./dist
           cd ./frontend/editor/src-tauri/target
 
-          echo "=== tauri bundle artifacts ==="
-          find . -path "*/bundle/*" \( -name "*.msi" -o -name "*.deb" \
-            -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.dmg" \
-            -o -name "*.app.tar.gz" -o -name "*.sig" \) 2>/dev/null | sort || true
-          echo "=============================="
-
-          # createUpdaterArtifacts:true signs the native installers in place;
-          # each <bundle> ships with a sibling <bundle>.sig consumed by latest.json.
+          # Find and rename artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
-            find . -name "*.msi.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi.sig" \;
+            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
+            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            # DMG = manual install; .app.tar.gz (+ .sig) = updater payload.
-            # Raw .app is intentionally not shipped (hundreds of MB of uncompressed input).
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app.tar.gz" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz" \;
-            find . -name "*.app.tar.gz.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz.sig" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
           else
-            # The raw .AppImage IS its updater payload (signed -> .AppImage.sig),
-            # not a .tar.gz wrapper - that's only produced under v1Compatible.
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.deb.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb.sig" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.rpm.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm.sig" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-            find . -name "*.AppImage.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage.sig" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
       - name: Upload build artifacts
@@ -624,7 +611,8 @@ jobs:
           path: ./dist/*
           retention-days: 1
 
-  collect-and-release:
+  create-release:
+    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
     needs: [pick, determine-matrix, build, build-jars]
     runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
     permissions:
@@ -635,16 +623,6 @@ jobs:
         with:
           egress-policy: audit
 
-      # Sparse-check out the verifier + pubkey before the artifact downloads
-      # so the checkout cannot clobber ./artifacts.
-      - name: Checkout updater verifier
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          sparse-checkout: |
-            .github/scripts/verify-updater-signatures.py
-            frontend/editor/src-tauri/tauri.conf.json
-          sparse-checkout-cone-mode: false
-
       - name: Download all Tauri artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -672,146 +650,17 @@ jobs:
       - name: Display structure of downloaded files
         run: ls -R ./artifacts
 
-      # tauri-action only emits latest.json when it also publishes the release
-      # (tagName/releaseId set). We publish separately via action-gh-release,
-      # so build latest.json here from the per-platform .sig files.
-      - name: Generate updater latest.json
-        env:
-          VERSION: ${{ needs.determine-matrix.outputs.version }}
-          TAG: v${{ needs.determine-matrix.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: |
-          python3 - << 'PYEOF'
-          import json, os, sys
-          from pathlib import Path
-          from datetime import datetime, timezone
-
-          VERSION = os.environ['VERSION']
-          TAG = os.environ['TAG']
-          REPO = os.environ['REPO']
-
-          ART = Path('./artifacts/tauri')
-
-          # Tauri updater looks up {os}-{arch}-{installer} (e.g. linux-x86_64-deb)
-          # before bare {os}-{arch}, so per-format Linux keys let deb/rpm/appimage
-          # each self-update from their matching file. macOS universal serves both
-          # arches from the one .app.tar.gz.
-          PLATFORM_MAP = [
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.deb'],
-                  'targets': ['linux-x86_64-deb'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.rpm'],
-                  'targets': ['linux-x86_64-rpm'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.AppImage'],
-                  'targets': ['linux-x86_64-appimage'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-windows-x86_64.msi'],
-                  'targets': ['windows-x86_64-msi', 'windows-x86_64'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-macos-universal.app.tar.gz'],
-                  'targets': ['darwin-x86_64', 'darwin-aarch64'],
-              },
-          ]
-
-          # rglob() because download-artifact varies layout: one artifact -> flat,
-          # many -> nested under <artifact-name>/.
-          def find_signed(name):
-              for bundle_path in sorted(ART.rglob(name)):
-                  sig_path = bundle_path.with_name(bundle_path.name + '.sig')
-                  if sig_path.exists():
-                      return bundle_path, sig_path
-              return None
-
-          platforms = {}
-          skipped = []
-          for entry in PLATFORM_MAP:
-              picked = None
-              for name in entry['bundles']:
-                  picked = find_signed(name)
-                  if picked:
-                      break
-              if not picked:
-                  skipped.append(
-                      f"{entry['targets']} (no signed bundle among "
-                      f"{entry['bundles']} - TAURI_SIGNING_PRIVATE_KEY unset "
-                      f"or createUpdaterArtifacts disabled?)"
-                  )
-                  continue
-              bundle_path, sig_path = picked
-              signature = sig_path.read_text(encoding='utf-8').strip()
-              url = f"https://github.com/{REPO}/releases/download/{TAG}/{bundle_path.name}"
-              for target in entry['targets']:
-                  platforms[target] = {'signature': signature, 'url': url}
-              print(f"Added {entry['targets']} from {bundle_path.name}")
-
-          if skipped:
-              print("Skipped platforms:")
-              for s in skipped:
-                  print(f"  - {s}")
-
-          if not platforms:
-              print(
-                  "WARN: no signed updater bundles found - "
-                  "skipping latest.json generation"
-              )
-              sys.exit(0)
-
-          manifest = {
-              'version': VERSION,
-              'notes': f"See https://github.com/{REPO}/releases/tag/{TAG}",
-              'pub_date': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'),
-              'platforms': platforms,
-          }
-
-          out = Path('./artifacts/latest.json')
-          out.write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
-          print(f"Generated {out} with platforms: {sorted(platforms.keys())}")
-          PYEOF
-
-      - name: Upload merged artifacts for review
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: release-artifacts
-          path: ./artifacts/
-          retention-days: 7
-
-      # Gate publish on valid updater sigs. Runs after the review upload (so
-      # artifacts survive for debugging) and before action-gh-release.
-      - name: Verify updater signatures
-        run: |
-          python3 -m pip install --quiet 'cryptography==44.0.0'
-          python3 .github/scripts/verify-updater-signatures.py \
-            ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
-
-      # workflow_dispatch path requires platform=='all' so a single-platform
-      # dispatch can't overwrite an existing release's full latest.json with a
-      # partial one (action-gh-release defaults overwrite_files:true).
-      # release / V2-master always build the full matrix so no extra guard needed.
-      # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
-      # instead of silently shipping a broken auto-update.
       - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
-          fail_on_unmatched_files: true
-          # Installers + updater payloads + manifest. .sig contents are embedded
-          # in latest.json so the .sig files themselves are not uploaded.
           files: |
             ./artifacts/**/*.jar
             ./artifacts/**/*.msi
             ./artifacts/**/*.dmg
-            ./artifacts/**/*.app.tar.gz
             ./artifacts/**/*.deb
             ./artifacts/**/*.rpm
             ./artifacts/**/*.AppImage
-            ./artifacts/latest.json
           draft: false
           prerelease: false

.github/workflows/nightly.yml

@@ -37,7 +37,7 @@ jobs:
           cache-dependency-path: frontend/package-lock.json
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install all Playwright browsers
         run: task e2e:install
 

.github/workflows/push-docker-base.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Generate tags for base image
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base

.github/workflows/push-docker.yml

@@ -78,14 +78,14 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -129,7 +129,7 @@ jobs:
       - name: Generate tags for latest
         id: meta
         if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -178,7 +178,7 @@ jobs:
 
       - name: Generate tags for latest-fat
         id: meta-fat
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
@@ -222,7 +222,7 @@ jobs:
 
       - name: Generate tags for ultra-lite
         id: meta-lite
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |

.github/workflows/stale.yml

@@ -22,7 +22,7 @@ jobs:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -63,7 +63,7 @@ jobs:
           SWAGGERHUB_USER: "Frooodle"
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT

.github/workflows/sync_files_v2.yml

@@ -62,7 +62,7 @@ jobs:
 
       - name: Sync translation TOML files
         run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-GB/translation.toml" --branch main
 
       - name: pre-commit run
         run: |
@@ -100,7 +100,7 @@ jobs:
             This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
+            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
             - **Format**: TOML

.github/workflows/tauri-build.yml

@@ -136,10 +136,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Setup Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Build universal macOS JRE
         if: matrix.platform == 'macos-15'
@@ -157,9 +157,6 @@ jobs:
           JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
         run: task desktop:prepare
 
-      - name: Run Tauri/Cargo tests
-        run: task desktop:test
-
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
@@ -271,6 +268,10 @@ jobs:
           echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
           echo "Certificate imported successfully."
 
+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+
       - name: Check DMG creation dependencies (macOS only)
         if: matrix.platform == 'macos-15'
         run: |
@@ -416,22 +417,20 @@ jobs:
       - name: Rename artifacts
         shell: bash
         run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
+          mkdir -p ./dist
           cd ./frontend/editor/src-tauri/target
 
           # Find and rename artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             # Only ship the MSI installer. The loose exe and WiX toolset exes
             # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
           else
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
       # Verify the MSI AND the inner exe extracted from it are signed.

.github/workflows/test-build-docker.yml

@@ -106,11 +106,11 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Build application
         run: task backend:build
         env:
@@ -157,7 +157,7 @@ jobs:
 
       - name: Build ${{ matrix.docker-rev }} (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -230,7 +230,7 @@ jobs:
 
       - name: Build docker/unoserver/Dockerfile (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .

.github/workflows/testdriver.yml

@@ -51,7 +51,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Build with Gradle
         run: ./gradlew build
@@ -83,7 +83,7 @@ jobs:
 
       - name: Build and push test image (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -129,7 +129,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF Test"
                 UI_HOMEDESCRIPTION: "Test Deployment"
                 UI_APPNAMENAVBAR: "Test"

.gitignore

@@ -23,10 +23,6 @@ customFiles/
 configs/
 watchedFolders/
 clientWebUI/
-# Scratch dir used by local fixture-regeneration runs (see
-# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
-# Holds downloaded JARs and disposable workdirs. Never committed.
-.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
@@ -57,8 +53,6 @@ app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
-app/core/src/main/resources/static/**/*.gz
-app/core/src/main/resources/static/**/*.br
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
 # Gradle
@@ -180,6 +174,7 @@ venv.bak/
 
 # Env files (secrets / local overrides). Subproject .gitignore files whitelist any committed defaults.
 .env*
+!.env.saas.example
 
 # VS Code
 /.vscode/**/*
@@ -214,7 +209,7 @@ out/
 *.asc
 
 # Allow test fixture certificates (synthetic, no real credentials)
-!frontend/editor/src/core/tests/test-fixtures/certs/**
+!frontend/src/core/tests/test-fixtures/certs/**
 
 # SSH Keys
 *.pub
@@ -256,7 +251,7 @@ node_modules/
 *compact*.json
 test_batch.json
 *.backup.*.json
-frontend/editor/public/locales/*/translation.backup*.json
+frontend/public/locales/*/translation.backup*.json
 
 # Development/build artifacts
 .gradle-cache/
@@ -279,6 +274,3 @@ docs/type3/signatures/
 # Playwright MCP screenshots / traces
 .playwright-mcp/
 *.playwright-mcp.png
-
-# Local screenshot artifacts from *-screenshots.spec.ts
-frontend/editor/screenshots/

.gitleaksignore

@@ -1,14 +0,0 @@
-# PostHog project-level key — phc_ prefix keys are public/client-side by design
-# (PostHog client-side tracking embeds them in the browser bundle). Committed
-# intentionally in #6150 so engine/.env has a working default, with real
-# credentials overridden via engine/.env.local.
-engine/.env:generic-api-key:41
-
-# MCP test fixtures / harness - no real secrets:
-# - test-only API key constant in an integration test
-# - JDBC URL + throwaway Keycloak creds in the local test compose
-# - placeholder / shell-variable Bearer headers in curl-based validation scripts
-app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
-testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
-testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
-testing/compose/validate-mcp-test.sh:curl-auth-header:92

.taskfiles/backend.yml

@@ -18,26 +18,16 @@ version: '3'
 tasks:
   dev:
     desc: "Start backend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-
-  dev:proprietary:
-    desc: "Start backend dev server in proprietary mode"
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
       AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
     env:
       SERVER_PORT: '{{.PORT}}'
     cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
         platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}./gradlew :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
         platforms: [linux, darwin]
 
   dev:bundled:
@@ -50,23 +40,18 @@ tasks:
         platforms: [linux, darwin]
 
   dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
+    desc: "Start backend in SaaS flavor against Supabase (loads .env.saas.local)"
     # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
+    # subtaskfile is included with `dir: .`. Drop the file at the repo root.
+    dotenv: ['.env.saas.local']
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
       # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
       PROFILES: '{{.PROFILES | default "dev"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
     env:
       SERVER_PORT: '{{.PORT}}'
       STIRLING_FLAVOR: saas
-      AIENGINE_URL: '{{.AIENGINE_URL}}'
-      AIENGINE_ENABLED: '{{if .AIENGINE_URL}}true{{else}}false{{end}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
     cmds:
       - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
         platforms: [windows]

.taskfiles/desktop.yml

@@ -1,9 +1,7 @@
 version: '3'
 
 vars:
-  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
-  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
+  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
 
   # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
   JPDFIUM_PLATFORMS:
@@ -64,28 +62,21 @@ tasks:
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles app
 
   build:dev:windows:
     desc: "Build Tauri desktop NSIS installer (Windows)"
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles nsis
 
   build:dev:linux:
     desc: "Build Tauri desktop AppImage (Linux)"
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  test:
-    desc: "Run Tauri/Cargo tests"
-    deps: [prepare]
-    dir: editor/src-tauri
-    cmds:
-      - cargo test
+      - npx tauri build --bundles appimage
 
   clean:
     desc: "Clean Tauri/Cargo build artifacts"
@@ -127,38 +118,16 @@ tasks:
     cmds:
       - rm -rf runtime/jre
       - mkdir -p runtime
-      - |
-        JLINK_COMPRESS="$(jlink --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-        jlink \
-          --add-modules {{.JLINK_MODULES}} \
-          --strip-debug \
-          --compress="$JLINK_COMPRESS" \
-          --no-header-files \
-          --no-man-pages \
-          --output runtime/jre
-      # jlink emits its files mode 444 (read-only). Tauri's build-script
-      # resource copier preserves source permissions when staging
-      # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
-      # staged copies are read-only too. On any subsequent incremental
-      # build the copier tries to overwrite them and fails with a bare
-      # `Permission denied (os error 13)` (Rust's io::Error Display drops
-      # the path, so the failure is opaque). Make the source writable here
-      # so the staged destinations are writable and can be overwritten.
-      #
-      # Trade-off: this task runs for both `task desktop:dev` and
-      # `task desktop:build`, so production bundles also ship mode-644
-      # JRE files instead of 444. Functionally harmless on POSIX (the
-      # `other` bit is `r--` either way, and on macOS code signing is the
-      # real integrity check) and on Windows the DOS read-only attribute
-      # isn't load-bearing for the bundled JDK. If we ever need strict
-      # 444 in production, split the chmod into a dev-only step and have
-      # `desktop:build` run `jlink:clean` first to force a fresh build.
-      - cmd: chmod -R u+w runtime/jre
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
-        platforms: [windows]
+      - >-
+        jlink
+        --add-modules {{.JLINK_MODULES}}
+        --strip-debug
+        --compress=zip-6
+        --no-header-files
+        --no-man-pages
+        --output runtime/jre
     status:
-      - test -f runtime/jre/release
+      - test -d editor/src-tauri/runtime/jre
 
   jlink:clean:
     desc: "Remove JLink runtime and bundled JARs"

.taskfiles/docker.yml

@@ -20,11 +20,6 @@ tasks:
     cmds:
       - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
 
-  build:backend:
-    desc: "Build backend-only Docker image (no embedded frontend)"
-    cmds:
-      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
-
   build:frontend:
     desc: "Build frontend-only Docker image"
     cmds:

.taskfiles/e2e.yml

@@ -34,9 +34,6 @@ tasks:
     ignore_error: true
     vars:
       BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
-    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
-    # Off by default to keep local dev runs uninstrumented; CI flips it.
     env:
       STIRLING_BASE_PATH: '{{.BASE_DIR}}'
       # Suppress the analytics opt-in modal that fires on first admin login.
@@ -61,19 +58,12 @@ tasks:
           set -e
           rm -rf "{{.BASE_DIR}}"
           mkdir -p "{{.BASE_DIR}}"
-          GRADLE_ARGS=":stirling-pdf:bootRun"
-          if [ -n "${COVERAGE:-}" ]; then
-            # copyJacocoAgent is wired as a dependency of bootRun when
-            # -PjacocoAgent=true, so we do not need to invoke it separately.
-            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
-            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
-          fi
           # Background gradle and record its PID so the runner can clean up
           # the exact process tree (wrapper + forked Spring Boot JVM) without
           # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
           # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
           # synchronised.
-          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
+          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
           GRADLE_PID=$!
           echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
           wait $GRADLE_PID
@@ -212,55 +202,3 @@ tasks:
     desc: "Stop the SAML keycloak test environment"
     cmds:
       - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
-
-  mcp:up:
-    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
-    summary: |
-      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
-      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:mcp:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:mcp:up -- --validate --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:manual:
-    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
-    summary: |
-      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
-      access token so you can drive your own MCP client (Inspector, curl, ...).
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
-      Add --nobuild if the images are already built:
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:apikey:
-    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
-    summary: |
-      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
-      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
-      Add --nobuild if images are already built:
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:validate:
-    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
-    cmds:
-      - bash testing/compose/validate-mcp-test.sh
-
-  mcp:validate-apikey:
-    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
-    cmds:
-      - bash testing/compose/validate-mcp-apikey.sh
-
-  mcp:down:
-    desc: "Stop the MCP keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v

.taskfiles/engine.yml

@@ -33,7 +33,7 @@ tasks:
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}
 
   dev:
     desc: "Start engine dev server with hot reload"

.taskfiles/frontend.yml

@@ -112,12 +112,6 @@ tasks:
       - task: dev:_run
         vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
 
-  dev:portal:
-    desc: "Start developer portal dev server"
-    deps: [install]
-    cmds:
-      - npx vite portal --port {{.PORT | default "5173"}}{{if .OPEN}} --open{{end}}
-
   # ============================================================
   # Build
   # ============================================================
@@ -162,24 +156,6 @@ tasks:
     cmds:
       - npx vite build editor --mode prototypes
 
-  build:portal:
-    desc: "Build developer portal"
-    deps: [install]
-    cmds:
-      - npx vite build portal
-
-  storybook:
-    desc: "Start Storybook dev server"
-    deps: [install]
-    cmds:
-      - npx storybook dev -p 6006 {{.CLI_ARGS}}
-
-  storybook:build:
-    desc: "Build static Storybook"
-    deps: [install]
-    cmds:
-      - npx storybook build {{.CLI_ARGS}}
-
   # ============================================================
   # Code quality
   # ============================================================
@@ -187,23 +163,9 @@ tasks:
   lint:
     desc: "Run linting"
     deps: [install]
-    cmds:
-      - task: lint:eslint
-      - task: lint:dpdm
-
-  lint:eslint:
-    desc: "Run ESLint linting"
-    deps: [install]
     cmds:
       - npx eslint --max-warnings=0
-
-  lint:dpdm:
-    desc: "Run circular import linting"
-    deps: [install]
-    cmds:
-      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
-      # shell-agnostic. Covers editor, portal, and the shared design system.
-      - npx dpdm "editor/src/**/*.{ts,tsx}" "portal/src/**/*.{ts,tsx}" "shared/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
+      - npx dpdm editor/src --circular --no-warning --no-tree --exit-code circular:1
 
   lint:fix:
     desc: "Auto-fix lint issues"
@@ -274,18 +236,6 @@ tasks:
     cmds:
       - npx tsc --noEmit --project editor/src/prototypes/tsconfig.json
 
-  typecheck:portal:
-    desc: "Typecheck developer portal build variant"
-    deps: [install]
-    cmds:
-      - npx tsc --noEmit --project portal/tsconfig.json
-
-  typecheck:shared:
-    desc: "Typecheck the shared design system"
-    deps: [install]
-    cmds:
-      - npx tsc --noEmit --project shared/tsconfig.json
-
   typecheck:all:
     desc: "Typecheck all build variants"
     cmds:
@@ -295,8 +245,6 @@ tasks:
       - task: typecheck:desktop
       - task: typecheck:scripts
       - task: typecheck:prototypes
-      - task: typecheck:portal
-      - task: typecheck:shared
 
   # ============================================================
   # Quality Gate
@@ -317,9 +265,7 @@ tasks:
       - task: lint
       - task: format:check
       - task: build
-      - task: build:portal
       - task: test
-      - task: storybook:build
 
   # ============================================================
   # Test
@@ -327,36 +273,21 @@ tasks:
 
   test:
     desc: "Run tests"
-    deps: [prepare]
+    deps: [install]
     cmds:
       - npx vitest run --root editor
 
   test:watch:
     desc: "Run tests in watch mode"
-    deps: [prepare]
+    deps: [install]
     cmds:
       - npx vitest --watch --root editor
 
   test:coverage:
-    desc: "Run tests with coverage (one-shot; CI-friendly)."
-    deps: [prepare]
+    desc: "Run tests with coverage"
+    deps: [install]
     cmds:
-      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
-      # mode). Explicit reporter list because v8 + json-summary is what the
-      # coverage-summary.py helper consumes; html/text are kept for humans.
-      #
-      # reportsDirectory is pinned to ./coverage relative to vitest's root
-      # (--root editor), so output lands at frontend/editor/coverage/. The
-      # CI upload step reads from that path. An earlier attempt with
-      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
-      # pinning future-proofs against vitest changing the default.
-      - >
-        npx vitest run --root editor --coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage
+      - npx vitest --coverage --root editor
 
   # ============================================================
   # Code Generation

ADDING_TOOLS.md

@@ -200,9 +200,9 @@ const [ToolName] = (props: BaseToolProps) => {
 ```
 
 ## 5. Add Translations
-Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.
+Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/editor/public/locales/en-US/translation.toml`
+**File to update:** `frontend/editor/public/locales/en-GB/translation.toml`
 
 **Required Translation Keys**:
 ```toml
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-US` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-US/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

AGENTS.md

@@ -426,7 +426,7 @@ The frontend is organized with a clear separation of concerns:
 
 ## Translation Rules
 
-- **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
+- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
 - Translation files are located in `frontend/editor/public/locales/`
 
 ## Important Notes

DeveloperGuide.md

@@ -52,17 +52,6 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)
 
-### Optional System Dependencies
-
-These are not required to run the app but enable specific features. The app detects them at startup and disables the relevant features if they are missing.
-
-| Dependency | Feature | Install |
-|---|---|---|
-| LibreOffice | File-to-PDF conversions | `brew install libreoffice` / `apt install libreoffice` |
-| Tesseract | OCR | `brew install tesseract` / `apt install tesseract-ocr` |
-| WeasyPrint | AI document creation | `brew install weasyprint` / `apt install weasyprint` |
-| qpdf | PDF optimisation | `brew install qpdf` / `apt install qpdf` |
-
 ### Setup Steps
 
 1. Clone the repository:
@@ -587,7 +576,7 @@ When adding a new feature or modifying existing ones in Stirling-PDF, you'll nee
 Find the existing `messages.properties` files in the `stirling-pdf/src/main/resources` directory. You'll see files like:
 
 - `messages.properties` (default, usually English)
-- `messages_en_US.properties`
+- `messages_en_GB.properties`
 - `messages_fr_FR.properties`
 - `messages_de_DE.properties`
 - etc.

LICENSE

@@ -10,16 +10,14 @@ if that directory exists, is licensed under the license defined in "app/propriet
 if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
-* All content that resides under the "frontend/editor/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/proprietary/LICENSE".
-* All content that resides under the "frontend/editor/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/desktop/LICENSE".
-* All content that resides under the "frontend/editor/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/saas/LICENSE".
-* All content that resides under the "frontend/editor/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
-* All content that resides under the "frontend/portal/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/portal/LICENSE".
+* All content that resides under the "frontend/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
+* All content that resides under the "frontend/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
+* All content that resides under the "frontend/src/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
+* All content that resides under the "frontend/src/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

Taskfile.yml

@@ -58,22 +58,9 @@ tasks:
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
 
-  dev:saas:
-    desc: "Start SaaS backend + frontend concurrently on free ports"
-    cmds:
-      - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas }
-
   dev:all:
     desc: "Start backend + frontend + engine concurrently on free ports"
-    cmds:
-      - task: dev:_all
-
-  dev:_all:
-    internal: true
     vars:
-      FRONTEND: '{{.FRONTEND | default "proprietary"}}'
-      BACKEND: '{{.BACKEND | default "proprietary"}}'
       PORTS:
         sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
       BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -83,11 +70,11 @@ tasks:
       - task: engine:dev
         vars:
           PORT: '{{.ENGINE_PORT}}'
-      - task: 'backend:dev:{{.BACKEND}}'
+      - task: backend:dev
         vars:
           PORT: '{{.BACKEND_PORT}}'
           AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-      - task: 'frontend:dev:{{.FRONTEND}}'
+      - task: frontend:dev:prototypes
         vars:
           PORT: '{{.FRONTEND_PORT}}'
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'

app/.gitignore

@@ -1,3 +0,0 @@
-# Whitelist committed env defaults. `.env.saas.local` (and any other .env*)
-# stays ignored via the root .gitignore.
-!.env.saas

app/allowed-licenses.json

@@ -44,10 +44,6 @@
       "moduleName": ".*",
       "moduleLicense": "The MIT License"
     },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "MIT-0"
-    },
     {
       "moduleName": "com.github.jai-imageio:jai-imageio-core",
       "moduleLicense": "LICENSE.txt"

app/common/build.gradle

@@ -60,7 +60,7 @@ dependencies {
         exclude group: 'com.google.code.gson', module: 'gson'
     }
 
-    api 'com.stirling:jpdfium:1.0.2'
+    api 'com.stirling:jpdfium:1.0.1'
 
     // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
     def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
@@ -75,7 +75,7 @@ dependencies {
     }
     logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
     jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1"
     }
 
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)

app/common/src/main/java/stirling/software/SPDF/pdf/parser/CompositeTableParser.java

@@ -0,0 +1,73 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.context.annotation.Primary;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
+ * LineAlignmentTableParser}. The first parser returning a result above {@link
+ * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
+ */
+@Service
+@Primary
+@RequiredArgsConstructor
+@Slf4j
+public class CompositeTableParser implements TableParser {
+
+    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
+    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
+
+    private final TabulaTableParser tabulaParser;
+    private final LineAlignmentTableParser lineAlignmentParser;
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        // Step 1: Tabula lattice mode (ruled/bordered tables).
+        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
+        if (!latticeResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula lattice ({} table(s))",
+                    rawPage.pageNumber(),
+                    latticeResults.size());
+            return latticeResults;
+        }
+
+        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
+        // parseStream is not on the TableParser interface — this intentionally couples to the
+        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
+        List<TableFragment> streamResults =
+                filterConfident(tabulaParser.parseStream(document, rawPage));
+        if (!streamResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula stream ({} table(s))",
+                    rawPage.pageNumber(),
+                    streamResults.size());
+            return streamResults;
+        }
+
+        // Step 3: Geometry-based line-alignment fallback.
+        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
+        if (!lineResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using LineAlignment ({} table(s))",
+                    rawPage.pageNumber(),
+                    lineResults.size());
+            return lineResults;
+        }
+
+        return List.of();
+    }
+
+    private List<TableFragment> filterConfident(List<TableFragment> tables) {
+        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParser.java

@@ -0,0 +1,528 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.TreeMap;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Fallback {@link TableParser} for borderless financial tables using text geometry.
+ *
+ * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
+ * positions, groups vertically proximate anchor lines into table candidates, then scores each group
+ * on column consistency and anchor density (confidence ceiling 0.85).
+ */
+@Service
+@Slf4j
+public class LineAlignmentTableParser implements TableParser {
+
+    /** Width in points of each column position bucket. */
+    static final float COLUMN_BUCKET_PT = 5f;
+
+    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
+    private static final int COLUMN_MATCH_BUCKETS = 2;
+
+    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
+    private static final float MAX_GAP_FACTOR = 2.5f;
+
+    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
+    static final int MIN_TABLE_ROWS = 3;
+
+    /** Minimum confirmed column positions to form a valid table. */
+    static final int MIN_COLUMNS = 2;
+
+    /**
+     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
+     * rows).
+     */
+    private static final double COLUMN_MIN_FREQUENCY = 0.40;
+
+    /**
+     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
+     * percent, nil dashes.
+     */
+    private static final Pattern NUMERIC =
+            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
+
+    /**
+     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
+     * column-gap logic).
+     */
+    static final float ROW_MERGE_TOLERANCE_PT = 2f;
+
+    // ── public API ───────────────────────────────────────────────────────────────────────────────
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        List<RawLine> lines = rawPage.lines();
+        if (lines.size() < MIN_TABLE_ROWS) return List.of();
+
+        float modalSpacing = computeModalSpacing(lines);
+        List<TokenizedLine> tokenized =
+                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
+
+        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
+
+        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
+
+        List<Float> columnGrid = buildColumnGrid(anchors);
+        if (columnGrid.size() < MIN_COLUMNS) {
+            log.debug(
+                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
+                    rawPage.pageNumber(),
+                    MIN_COLUMNS);
+            return List.of();
+        }
+
+        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
+
+        List<TableFragment> results = new ArrayList<>();
+        for (int i = 0; i < groups.size(); i++) {
+            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
+                    .ifPresent(results::add);
+        }
+
+        log.debug(
+                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
+                rawPage.pageNumber(),
+                results.size(),
+                anchors.size(),
+                columnGrid.size());
+        return results;
+    }
+
+    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
+
+    /**
+     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
+     * split by LineBuilder.
+     */
+    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
+        if (tokenized.size() < 2) return tokenized;
+
+        List<TokenizedLine> result = new ArrayList<>();
+        int i = 0;
+
+        while (i < tokenized.size()) {
+            float baseY = tokenized.get(i).line().bounds().y();
+            int j = i + 1;
+            while (j < tokenized.size()
+                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
+                            <= ROW_MERGE_TOLERANCE_PT) {
+                j++;
+            }
+
+            if (j == i + 1) {
+                result.add(tokenized.get(i));
+            } else {
+                result.add(mergeGroup(tokenized.subList(i, j)));
+            }
+            i = j;
+        }
+
+        return result;
+    }
+
+    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
+        List<TextFragment> mergedFragments =
+                group.stream()
+                        .flatMap(tl -> tl.line().fragments().stream())
+                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        Bounds mergedBounds =
+                group.stream()
+                        .map(tl -> tl.line().bounds())
+                        .reduce(Bounds::merge)
+                        .orElse(group.get(0).line().bounds());
+
+        RawLine mergedLine =
+                new RawLine(
+                        group.get(0).line().lineId(),
+                        mergedFragments,
+                        mergedBounds,
+                        group.get(0).line().pageNumber());
+
+        return tokenize(mergedLine);
+    }
+
+    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
+     * fragment.
+     */
+    TokenizedLine tokenize(RawLine line) {
+        List<LineToken> tokens = new ArrayList<>();
+        for (TextFragment frag : line.fragments()) {
+            tokens.addAll(tokensFromFragment(frag));
+        }
+        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
+        return new TokenizedLine(line, tokens, numeric);
+    }
+
+    private List<LineToken> tokensFromFragment(TextFragment frag) {
+        String raw = frag.text();
+        if (raw == null || raw.isBlank()) return List.of();
+
+        float fragX = frag.bounds().x();
+        float fragWidth = frag.bounds().width();
+        int rawLen = raw.length();
+
+        List<LineToken> result = new ArrayList<>();
+        int offset = 0;
+        for (String part : raw.split("\\s+")) {
+            if (part.isEmpty()) {
+                offset++;
+                continue;
+            }
+            int idx = raw.indexOf(part, offset);
+            if (idx < 0) idx = offset;
+
+            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
+            float tokenRight =
+                    rawLen > 0
+                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
+                            : fragX + fragWidth;
+
+            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
+            offset = idx + part.length();
+        }
+        return result;
+    }
+
+    // ── column grid ──────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
+     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
+     */
+    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
+        // bucket → set of line indices that contributed a numeric token to that bucket
+        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
+        for (int i = 0; i < anchors.size(); i++) {
+            for (LineToken t : anchors.get(i).numeric()) {
+                int bucket = bucket(t.right());
+                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
+            }
+        }
+
+        int minHits =
+                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
+
+        // Confirmed buckets → average right-edge for that bucket
+        TreeMap<Integer, Float> confirmed = new TreeMap<>();
+        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
+            // Count distinct lines
+            long distinctLines = entry.getValue().stream().distinct().count();
+            if (distinctLines >= minHits) {
+                double avg =
+                        entry.getValue().stream()
+                                .distinct() // weight each line equally regardless of token count
+                                .mapToDouble(
+                                        lineIdx ->
+                                                avgRightEdgeForBucket(
+                                                        anchors, lineIdx, entry.getKey()))
+                                .average()
+                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
+                confirmed.put(entry.getKey(), (float) avg);
+            }
+        }
+
+        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
+    }
+
+    /**
+     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
+     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
+     */
+    private double avgRightEdgeForBucket(
+            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
+        return anchors.get(lineIdx).numeric().stream()
+                .filter(t -> bucket(t.right()) == targetBucket)
+                .mapToDouble(LineToken::right)
+                .average()
+                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
+    }
+
+    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
+     * MAX_GAP_FACTOR × modal spacing splits groups.
+     */
+    private List<List<TokenizedLine>> groupRows(
+            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
+        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
+
+        List<List<TokenizedLine>> groups = new ArrayList<>();
+        List<TokenizedLine> current = new ArrayList<>();
+
+        for (int i = 0; i < all.size(); i++) {
+            TokenizedLine tl = all.get(i);
+            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
+
+            if (current.isEmpty()) {
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            float gap =
+                    tl.line().bounds().y()
+                            - current.get(current.size() - 1).line().bounds().bottom();
+
+            if (gap > maxGap) {
+                groups.add(current);
+                current = new ArrayList<>();
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            if (fits) {
+                current.add(tl);
+            } else if (!tl.line().text().isBlank()) {
+                // Include non-anchor lines (labels) only if they have text and are within
+                // proximity.
+                current.add(tl);
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+
+        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
+    }
+
+    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
+        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
+                >= MIN_TABLE_ROWS;
+    }
+
+    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
+    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long matches =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) matches / tl.numeric().size() >= 0.60;
+    }
+
+    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long hits =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) hits / tl.numeric().size() < 0.60;
+    }
+
+    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
+
+    private Optional<TableFragment> buildFragment(
+            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
+
+        List<String> warnings = new ArrayList<>();
+        List<List<String>> rawRows = new ArrayList<>();
+        List<TableRow> rows = new ArrayList<>();
+
+        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
+            TokenizedLine tl = group.get(rowIdx);
+            List<String> rawRow = buildRawRow(tl, columnGrid);
+            rawRows.add(Collections.unmodifiableList(rawRow));
+            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
+        }
+
+        // Column count = 1 label column + confirmed numeric columns
+        int colCount = columnGrid.size() + 1;
+        Bounds bounds = computeGroupBounds(group);
+        float confidence = computeConfidence(group, columnGrid, warnings);
+
+        return Optional.of(
+                new TableFragment(
+                        "tbl-la-p" + pageNumber + "-" + tableIndex,
+                        pageNumber,
+                        bounds,
+                        List.of(),
+                        Collections.unmodifiableList(rows),
+                        Collections.unmodifiableList(rawRows),
+                        colCount,
+                        confidence,
+                        Collections.unmodifiableList(warnings),
+                        null));
+    }
+
+    /**
+     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
+     */
+    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
+        String[] cells = new String[columnGrid.size() + 1];
+        Arrays.fill(cells, "");
+
+        // Separate label tokens (those not landing in any confirmed column) from column tokens.
+        List<String> labelParts = new ArrayList<>();
+        for (LineToken token : tl.all()) {
+            int col = nearestColumnIndex(token.right(), columnGrid);
+            if (col >= 0 && token.numeric()) {
+                int cellIdx = col + 1;
+                cells[cellIdx] =
+                        cells[cellIdx].isEmpty()
+                                ? token.text()
+                                : cells[cellIdx] + " " + token.text();
+            } else {
+                labelParts.add(token.text());
+            }
+        }
+        cells[0] = String.join(" ", labelParts).trim();
+        return Arrays.asList(cells);
+    }
+
+    private TableRow buildTableRow(
+            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
+        List<TableCell> cells = new ArrayList<>(rawRow.size());
+
+        // Label cell: use the line's full bounds as an approximation.
+        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
+
+        for (int col = 0; col < columnGrid.size(); col++) {
+            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
+            float right = columnGrid.get(col);
+            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
+            Bounds cellBounds =
+                    new Bounds(
+                            left,
+                            tl.line().bounds().y(),
+                            right - left,
+                            tl.line().bounds().height());
+            cells.add(TableCell.of(col + 1, text, cellBounds));
+        }
+        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
+    }
+
+    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
+
+    /**
+     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
+     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
+     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
+     */
+    private float computeConfidence(
+            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
+        float score = 0.70f;
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        long totalRows = group.size();
+
+        // More columns
+        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
+        score += extraCols * 0.05f;
+
+        // More anchor rows
+        if (anchorCount >= 5) score += 0.05f;
+        if (anchorCount >= 8) score += 0.05f;
+
+        // Inconsistent column matching
+        long inconsistent =
+                group.stream()
+                        .filter(TokenizedLine::isAnchor)
+                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
+                        .count();
+        if (inconsistent > anchorCount * 0.30) {
+            score -= 0.15f;
+            warnings.add(
+                    "Column match inconsistent on "
+                            + inconsistent
+                            + "/"
+                            + anchorCount
+                            + " anchor rows");
+        }
+
+        // Label-heavy
+        long nonAnchor = totalRows - anchorCount;
+        if (nonAnchor > anchorCount) {
+            score -= 0.10f;
+            warnings.add(
+                    "Non-anchor rows ("
+                            + nonAnchor
+                            + ") outnumber anchor rows ("
+                            + anchorCount
+                            + ")");
+        }
+
+        return Math.max(0f, Math.min(0.85f, score));
+    }
+
+    // ── utility ──────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
+     * #COLUMN_MATCH_BUCKETS} buckets.
+     */
+    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
+        int nearest = -1;
+        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
+        for (int i = 0; i < grid.size(); i++) {
+            float dist = Math.abs(rightEdge - grid.get(i));
+            if (dist < minDist) {
+                minDist = dist;
+                nearest = i;
+            }
+        }
+        return nearest;
+    }
+
+    private Bounds computeGroupBounds(List<TokenizedLine> group) {
+        return group.stream()
+                .map(tl -> tl.line().bounds())
+                .reduce(Bounds::merge)
+                .orElse(new Bounds(0, 0, 0, 0));
+    }
+
+    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
+    private float computeModalSpacing(List<RawLine> lines) {
+        if (lines.size() < 2) return 0f;
+        Map<Float, Long> freq = new HashMap<>();
+        for (int i = 1; i < lines.size(); i++) {
+            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
+            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
+        }
+        return freq.entrySet().stream()
+                .max(Map.Entry.comparingByValue())
+                .map(Map.Entry::getKey)
+                .orElse(0f);
+    }
+
+    private static int bucket(float x) {
+        return Math.round(x / COLUMN_BUCKET_PT);
+    }
+
+    // ── private data types ───────────────────────────────────────────────────────────────────────
+
+    /** A word-level token with an approximate right-edge x-position. */
+    record LineToken(String text, float x, float right, boolean numeric) {}
+
+    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
+    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
+        boolean isAnchor() {
+            return numeric.size() >= 2;
+        }
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineBuilder.java

@@ -0,0 +1,139 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
+ *
+ * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
+ * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
+ * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
+ */
+@Service
+@Slf4j
+public class LineBuilder {
+
+    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
+    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
+
+    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
+    private static final float MIN_BASELINE_TOLERANCE = 2f;
+
+    /**
+     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
+     * two-column gutters.
+     */
+    static final float COLUMN_GAP_RATIO = 0.10f;
+
+    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
+    static final float COLUMN_GAP_MIN_PT = 40f;
+
+    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
+        if (fragments.isEmpty()) return List.of();
+
+        float effectiveWidth = inferEffectiveWidth(fragments);
+        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
+        log.debug(
+                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
+                pageNumber,
+                effectiveWidth,
+                columnGapThreshold);
+
+        // Sort top-to-bottom first, then left-to-right within the same baseline band.
+        List<TextFragment> sorted =
+                fragments.stream()
+                        .sorted(
+                                Comparator.comparingDouble(TextFragment::baseline)
+                                        .thenComparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
+
+        List<RawLine> lines = new ArrayList<>(groups.size());
+        for (int i = 0; i < groups.size(); i++) {
+            List<TextFragment> group =
+                    groups.get(i).stream()
+                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                            .toList();
+
+            Bounds lineBounds =
+                    group.stream()
+                            .map(TextFragment::bounds)
+                            .reduce(Bounds::merge)
+                            .orElse(new Bounds(0, 0, 0, 0));
+
+            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
+        }
+        return lines;
+    }
+
+    private List<List<TextFragment>> groupByBaseline(
+            List<TextFragment> sorted, float columnGapThreshold) {
+        List<List<TextFragment>> groups = new ArrayList<>();
+        List<TextFragment> current = new ArrayList<>();
+        float currentBaseline = Float.NaN;
+
+        for (TextFragment fragment : sorted) {
+            if (current.isEmpty()) {
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+                continue;
+            }
+
+            float maxFontSize =
+                    Math.max(
+                            fragment.fontSize(),
+                            (float)
+                                    current.stream()
+                                            .mapToDouble(TextFragment::fontSize)
+                                            .max()
+                                            .orElse(0));
+            float tolerance =
+                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
+
+            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
+            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
+
+            if (sameBaseline && !columnGap) {
+                current.add(fragment);
+                // Anchor to the weighted mean baseline so long lines stay stable.
+                currentBaseline =
+                        (currentBaseline * (current.size() - 1) + fragment.baseline())
+                                / current.size();
+            } else {
+                groups.add(current);
+                current = new ArrayList<>();
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+        return groups;
+    }
+
+    /**
+     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
+     * threshold}.
+     */
+    private static boolean hasColumnGap(
+            TextFragment next, List<TextFragment> group, float threshold) {
+        float lastRight = group.get(group.size() - 1).bounds().right();
+        return next.bounds().x() - lastRight > threshold;
+    }
+
+    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
+    private static float inferEffectiveWidth(List<TextFragment> fragments) {
+        double maxRight =
+                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
+        return (float) maxRight * 1.10f;
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PageColumnLayout.java

@@ -1,142 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Detects whether a page is one- or two-column from per-line bounding boxes, and classifies an
- * X-span into the column it belongs to. Detection is a midpoint vote at {@code pageWidth / 2}.
- *
- * <p>Capped at two columns by design — sufficient for the redaction target set (single-column
- * documents and IEEE-style two-column papers). 3+ column layouts (newspapers, magazines) and
- * off-centre gutters (asymmetric two-column) would need a histogram or clustering approach to
- * detect the actual gutter X. (future work)
- *
- * <p>Coordinates are PDFTextStripper screen space (top-left origin, Y increases downward).
- */
-public final class PageColumnLayout {
-
-    /**
-     * Slack when checking "crosses a gutter" so single-pixel overshoots don't mark a line as
-     * spanning.
-     */
-    public static final float SPAN_SLACK_PT = 2f;
-
-    /**
-     * Slack on each side of the page midpoint inside which a line is considered "spanning"
-     * (covering both columns) rather than belonging to one side.
-     */
-    private static final float MIDPOINT_SLACK_PT = 30f;
-
-    /**
-     * Minimum line width (points) for a line to count toward the two-column tally. Avoids false
-     * positives where right-aligned dates, page numbers, or short "Link" fragments next to a
-     * heading look like a second column when they're really just inline metadata.
-     */
-    private static final float MIN_COLUMN_LINE_WIDTH_PT = 100f;
-
-    /**
-     * Minimum number of clearly leftish AND clearly rightish lines (each of width &ge; {@link
-     * #MIN_COLUMN_LINE_WIDTH_PT}) required to call the page two-column. Anything below this falls
-     * back to single-column.
-     */
-    private static final int MIN_SIDE_LINES = 3;
-
-    private final List<float[]> columns;
-    private final List<float[]> gutters;
-
-    private PageColumnLayout(List<float[]> columns, List<float[]> gutters) {
-        this.columns = columns;
-        this.gutters = gutters;
-    }
-
-    /**
-     * Determines column layout from per-line bounding boxes ({@code [x1, _, x2, _]}). Counts lines
-     * whose X-midpoint sits clearly left of, or clearly right of, the page midpoint (with {@link
-     * #MIDPOINT_SLACK_PT} slack each side). If both sides have at least {@link #MIN_SIDE_LINES}
-     * lines, the page is treated as two-column with the gutter at the page midpoint. Otherwise it's
-     * single-column.
-     *
-     * <p>Cross-column lines must already be split: callers should feed boxes from a line extractor
-     * that splits same-Y glyphs at large X gaps (see {@code AllTextLineExtractor}). Without that
-     * split, IEEE-style aligned-baseline 2-column PDFs produce one wide merged box per row and the
-     * side tallies all end up classified as "spanning", falling to single-column.
-     */
-    public static PageColumnLayout fromLineBoxes(List<float[]> lineBoxes, float pageWidth) {
-        if (lineBoxes == null || lineBoxes.isEmpty()) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float pageMid = pageWidth / 2f;
-        int left = 0, right = 0;
-        for (float[] lb : lineBoxes) {
-            if (lb == null || lb.length < 3) continue;
-            float width = lb[2] - lb[0];
-            // Skip narrow lines — dates, page numbers, "Link" labels next to a heading should
-            // not, on their own, make a single-column doc look two-column.
-            if (width < MIN_COLUMN_LINE_WIDTH_PT) continue;
-            float mid = (lb[0] + lb[2]) * 0.5f;
-            if (mid < pageMid - MIDPOINT_SLACK_PT) left++;
-            else if (mid > pageMid + MIDPOINT_SLACK_PT) right++;
-        }
-        if (left < MIN_SIDE_LINES || right < MIN_SIDE_LINES) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float gutterL = pageMid - MIDPOINT_SLACK_PT;
-        float gutterR = pageMid + MIDPOINT_SLACK_PT;
-        return new PageColumnLayout(
-                List.of(new float[] {0f, gutterL}, new float[] {gutterR, pageWidth}),
-                List.of(new float[] {gutterL, gutterR}));
-    }
-
-    /** All columns, left-to-right, as {@code [leftX, rightX]} pairs. Never empty. */
-    public List<float[]> columns() {
-        return columns;
-    }
-
-    /** Gutters between columns, left-to-right, as {@code [leftX, rightX]} pairs. */
-    public List<float[]> gutters() {
-        return gutters;
-    }
-
-    public int columnCount() {
-        return columns.size();
-    }
-
-    /**
-     * Returns the column index containing the X-midpoint of {@code [x1, x2]}, falling back to the
-     * closest column if the midpoint sits inside a gutter.
-     */
-    public int columnOf(float x1, float x2) {
-        float mid = (x1 + x2) * 0.5f;
-        int best = 0;
-        float bestDist = Float.MAX_VALUE;
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            if (mid >= c[0] && mid <= c[1]) return i;
-            float dist = mid < c[0] ? c[0] - mid : mid - c[1];
-            if (dist < bestDist) {
-                bestDist = dist;
-                best = i;
-            }
-        }
-        return best;
-    }
-
-    /**
-     * Returns every column index whose X-range overlaps {@code [x1, x2]} with at least {@link
-     * #SPAN_SLACK_PT} of intrusion. A normal in-column line returns one index; a line crossing a
-     * gutter returns two or more.
-     */
-    public int[] columnsCrossing(float x1, float x2) {
-        List<Integer> hits = new ArrayList<>();
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            float overlap = Math.min(x2, c[1]) - Math.max(x1, c[0]);
-            if (overlap > SPAN_SLACK_PT) hits.add(i);
-        }
-        if (hits.isEmpty()) hits.add(columnOf(x1, x2));
-        int[] out = new int[hits.size()];
-        for (int i = 0; i < hits.size(); i++) out[i] = hits.get(i);
-        return out;
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PageImageLocator.java

@@ -1,133 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.awt.geom.Point2D;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.contentstream.PDFGraphicsStreamEngine;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImage;
-import org.apache.pdfbox.util.Matrix;
-
-/**
- * PDFGraphicsStreamEngine that intercepts {@code drawImage} calls and records each image's bounding
- * box in PDF user-space (origin bottom-left, Y up) by transforming the unit square through the
- * current transformation matrix (CTM).
- *
- * <p>Usage:
- *
- * <pre>{@code
- * PageImageLocator locator = new PageImageLocator(page, pageIndex);
- * locator.processPage(page);
- * List<ImageBox> boxes = locator.getImageBoxes();
- * }</pre>
- *
- * <p>Each {@link ImageBox} carries the 0-based page index and the axis-aligned bounding box {@code
- * (x1, y1, x2, y2)} in PDF user-space coordinates.
- */
-public final class PageImageLocator extends PDFGraphicsStreamEngine {
-
-    /**
-     * Bounding box of a raster or vector image found on a PDF page.
-     *
-     * @param pageIndex 0-based page index
-     * @param x1 left edge in PDF user-space (origin bottom-left)
-     * @param y1 bottom edge in PDF user-space
-     * @param x2 right edge
-     * @param y2 top edge
-     */
-    public record ImageBox(int pageIndex, float x1, float y1, float x2, float y2) {}
-
-    private final int pageIndex;
-    private final List<ImageBox> imageBoxes = new ArrayList<>();
-    private final Point2D.Float currentPoint = new Point2D.Float();
-
-    /**
-     * @param page the PDPage to process
-     * @param pageIndex 0-based index of this page in the document (stored on each returned {@link
-     *     ImageBox})
-     */
-    public PageImageLocator(PDPage page, int pageIndex) {
-        super(page);
-        this.pageIndex = pageIndex;
-    }
-
-    /** Returns all image bounding boxes collected during {@link #processPage}. */
-    public List<ImageBox> getImageBoxes() {
-        return imageBoxes;
-    }
-
-    @Override
-    public void drawImage(PDImage pdImage) throws IOException {
-        Matrix ctm = getGraphicsState().getCurrentTransformationMatrix();
-        // An image occupies the unit square (0,0)→(1,1) in image space.
-        // Transform all four corners through the CTM to get the page-space bounding box.
-        float a = ctm.getScaleX();
-        float b = ctm.getShearY();
-        float c = ctm.getShearX();
-        float d = ctm.getScaleY();
-        float e = ctm.getTranslateX();
-        float f = ctm.getTranslateY();
-        float[] xs = {e, a + e, c + e, a + c + e};
-        float[] ys = {f, b + f, d + f, b + d + f};
-        float x1 = Float.MAX_VALUE, y1 = Float.MAX_VALUE;
-        float x2 = -Float.MAX_VALUE, y2 = -Float.MAX_VALUE;
-        for (float x : xs) {
-            x1 = Math.min(x1, x);
-            x2 = Math.max(x2, x);
-        }
-        for (float y : ys) {
-            y1 = Math.min(y1, y);
-            y2 = Math.max(y2, y);
-        }
-        imageBoxes.add(new ImageBox(pageIndex, x1, y1, x2, y2));
-    }
-
-    // ---------- required abstract methods (no-op for path operations) ----------
-
-    @Override
-    public void appendRectangle(Point2D p0, Point2D p1, Point2D p2, Point2D p3) {}
-
-    @Override
-    public void clip(int windingRule) {}
-
-    @Override
-    public void moveTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void lineTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void curveTo(float x1, float y1, float x2, float y2, float x3, float y3) {
-        currentPoint.setLocation(x3, y3);
-    }
-
-    @Override
-    public Point2D getCurrentPoint() {
-        return currentPoint;
-    }
-
-    @Override
-    public void closePath() {}
-
-    @Override
-    public void endPath() {}
-
-    @Override
-    public void strokePath() {}
-
-    @Override
-    public void fillPath(int windingRule) {}
-
-    @Override
-    public void fillAndStrokePath(int windingRule) {}
-
-    @Override
-    public void shadingFill(COSName shadingName) {}
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PdfIngester.java

@@ -0,0 +1,79 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
+ * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
+ * {@link PDDocument} lifecycle.
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class PdfIngester {
+
+    private final LineBuilder lineBuilder;
+    private final TableParser tableParser;
+
+    public List<ParsedPage> parse(PDDocument document) throws IOException {
+        return parse(document, document.getNumberOfPages());
+    }
+
+    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
+        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
+        List<ParsedPage> pages = new ArrayList<>(pageCount);
+        long fragmentsMs = 0;
+        long tablesMs = 0;
+        long t0 = System.currentTimeMillis();
+
+        for (int p = 1; p <= pageCount; p++) {
+            long ft = System.currentTimeMillis();
+            List<TextFragment> fragments = extractFragments(document, p);
+            fragmentsMs += System.currentTimeMillis() - ft;
+
+            PDPage page = document.getPage(p - 1);
+            PDRectangle mediaBox = page.getMediaBox();
+            List<RawLine> lines = lineBuilder.build(fragments, p);
+            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
+
+            long tt = System.currentTimeMillis();
+            List<TableFragment> tables = tableParser.parse(document, rawPage);
+            tablesMs += System.currentTimeMillis() - tt;
+
+            log.debug(
+                    "Page {}: {} fragments → {} lines, {} table(s)",
+                    p,
+                    fragments.size(),
+                    lines.size(),
+                    tables.size());
+            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
+        }
+
+        log.info(
+                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
+                pageCount,
+                System.currentTimeMillis() - t0,
+                fragmentsMs,
+                tablesMs);
+        return pages;
+    }
+
+    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
+            throws IOException {
+        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
+        stripper.getText(document);
+        return stripper.getFragments();
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/WordExtractingStripper.java

@@ -0,0 +1,113 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.text.PDFTextStripper;
+import org.apache.pdfbox.text.TextPosition;
+
+/**
+ * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
+ *
+ * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
+ * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
+ * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
+ */
+class WordExtractingStripper extends PDFTextStripper {
+
+    private final int targetPage;
+    private final List<TextFragment> fragments = new ArrayList<>();
+    private int fragmentIndex = 0;
+
+    WordExtractingStripper(int pageNumber) throws IOException {
+        this.targetPage = pageNumber;
+        setStartPage(pageNumber);
+        setEndPage(pageNumber);
+        setSortByPosition(true);
+    }
+
+    @Override
+    protected void startPage(PDPage page) throws IOException {
+        super.startPage(page);
+        fragments.clear();
+        fragmentIndex = 0;
+    }
+
+    @Override
+    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
+        if (text == null || text.isBlank()) return;
+
+        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
+        // number as its own string operation, so this is the common case).
+        if (text.indexOf(' ') < 0) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
+        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
+        if (textPositions.size() != text.length()) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
+        int start = 0;
+        for (int i = 0; i <= text.length(); i++) {
+            if (i == text.length() || text.charAt(i) == ' ') {
+                if (start < i) {
+                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
+                }
+                start = i + 1;
+            }
+        }
+    }
+
+    private void emitFragment(String text, List<TextPosition> positions) {
+        if (positions.isEmpty()) return;
+
+        float minX = Float.MAX_VALUE;
+        float minY = Float.MAX_VALUE;
+        float maxRight = -Float.MAX_VALUE;
+        float maxBaseline = -Float.MAX_VALUE;
+        TextPosition first = null;
+
+        for (TextPosition tp : positions) {
+            if (tp == null) continue;
+            if (first == null) first = tp;
+
+            float x = tp.getX();
+            // getY() is the baseline; top of character = getY() - getHeight().
+            float top = tp.getY() - tp.getHeight();
+            float right = x + tp.getWidth();
+            float baseline = tp.getY();
+
+            minX = Math.min(minX, x);
+            minY = Math.min(minY, top);
+            maxRight = Math.max(maxRight, right);
+            maxBaseline = Math.max(maxBaseline, baseline);
+        }
+
+        if (first == null) return;
+
+        PDFont font = first.getFont();
+        String fontName = font != null ? font.getName() : "";
+        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
+        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
+        float fontSize = first.getHeight();
+
+        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
+        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
+        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
+    }
+
+    List<TextFragment> getFragments() {
+        return Collections.unmodifiableList(fragments);
+    }
+}

app/common/src/main/java/stirling/software/common/annotations/AutoJobPostMapping.java

@@ -77,10 +77,6 @@ public @interface AutoJobPostMapping {
     /**
      * Relative resource weight (1-100). See {@link
      * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
-     *
-     * <p>The default is a sentinel ({@link Integer#MIN_VALUE}); {@code
-     * AutoJobPostMappingWeightTest} fails the build if any endpoint leaves it unset. Runtime
-     * readers clamp the value into {@code [1, 100]}.
      */
-    int resourceWeight() default Integer.MIN_VALUE;
+    int resourceWeight() default 1;
 }

app/common/src/main/java/stirling/software/common/cluster/FileStore.java

@@ -11,37 +11,21 @@ public interface FileStore {
     /** Stored file record. */
     record Stored(String fileId, long size) {}
 
-    /**
-     * Store the given stream and return a generated file id and total bytes written. {@code owner}
-     * may be null to indicate the file has no associated user (anonymous / desktop / async job with
-     * no propagated security context); a non-null value is persisted alongside the data so {@link
-     * #getOwner(String)} can return it later for authorization checks.
-     */
-    Stored store(InputStream in, String originalName, String owner) throws IOException;
-
-    /** Store with no owner. Equivalent to {@link #store(InputStream, String, String)} with null. */
-    default Stored store(InputStream in, String originalName) throws IOException {
-        return store(in, originalName, null);
-    }
+    /** Store the given stream and return a generated file id and total bytes written. */
+    Stored store(InputStream in, String originalName) throws IOException;
 
     /**
      * Store the file at {@code source} and return a generated file id and total bytes written.
      *
      * <p>Default implementation opens {@code source} as a stream and delegates to {@link
-     * #store(InputStream, String, String)}. Local-disk implementations should override to use a
-     * direct file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on
-     * Linux), which avoids the two-memory-copy hit of streaming a disk-backed upload through the
-     * JVM heap.
+     * #store(InputStream, String)}. Local-disk implementations should override to use a direct
+     * file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on Linux),
+     * which avoids the two-memory-copy hit of streaming a disk-backed upload through the JVM heap.
      */
-    default Stored store(Path source, String originalName, String owner) throws IOException {
-        try (InputStream in = Files.newInputStream(source)) {
-            return store(in, originalName, owner);
-        }
-    }
-
-    /** Store with no owner. Equivalent to {@link #store(Path, String, String)} with null. */
     default Stored store(Path source, String originalName) throws IOException {
-        return store(source, originalName, null);
+        try (InputStream in = Files.newInputStream(source)) {
+            return store(in, originalName);
+        }
     }
 
     /** Open the stored file for streaming reads. Caller closes. */
@@ -58,12 +42,4 @@ public interface FileStore {
 
     /** Whether the file id exists in the store. */
     boolean exists(String fileId);
-
-    /**
-     * Returns the owner identifier recorded at store time, or {@code null} if the file does not
-     * exist or was stored without an owner. Implementations must not throw when the file is missing
-     * or when the owner record is absent; they should return null so callers can treat "no owner"
-     * as a non-authoritative case.
-     */
-    String getOwner(String fileId) throws IOException;
 }

app/common/src/main/java/stirling/software/common/cluster/RateLimitStore.java

@@ -2,13 +2,7 @@ package stirling.software.common.cluster;
 
 import java.time.Duration;
 
-/**
- * Token-bucket rate limiting backed by the cluster backplane.
- *
- * <p>In-process implementations enforce a per-JVM limit; distributed implementations enforce a
- * single global limit across every node. Both use a Bucket4j greedy-refill token bucket so the
- * semantics match across single-node and cluster deployments.
- */
+/** Token-bucket rate limiting backed by the cluster backplane. */
 public interface RateLimitStore {
 
     /**

app/common/src/main/java/stirling/software/common/cluster/inprocess/LocalDiskFileStore.java

@@ -3,12 +3,9 @@ package stirling.software.common.cluster.inprocess;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.regex.Pattern;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -18,47 +15,33 @@ import stirling.software.common.cluster.FileStore;
 @Slf4j
 public class LocalDiskFileStore implements FileStore {
 
-    private static final String OWNER_SUFFIX = ".owner";
-
-    // File ids are generated as random UUIDs; reject anything else so a tainted id can never reach
-    // Files.* APIs (defence in depth on top of the resolve() prefix check, and silences CodeQL's
-    // path-injection finding on the resolveOwner sidecar lookup).
-    private static final Pattern UUID_PATTERN =
-            Pattern.compile(
-                    "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$");
-
     private final String baseDirPath;
-    // Fixed-size lock stripes so concurrent store/delete on the same (or colliding) fileId
-    // serialise the data-file + owner-sidecar pair as one critical section. Striped (not
-    // per-id) so the map never has to be cleaned up; collisions across unrelated ids are
-    // harmless contention.
-    private static final int LOCK_STRIPES = 64;
-    private final ReentrantLock[] stripes = new ReentrantLock[LOCK_STRIPES];
 
     public LocalDiskFileStore(String baseDirPath) {
         this.baseDirPath = baseDirPath;
-        for (int i = 0; i < LOCK_STRIPES; i++) {
-            stripes[i] = new ReentrantLock();
-        }
     }
 
     @Override
-    public Stored store(InputStream in, String originalName, String owner) throws IOException {
+    public Stored store(InputStream in, String originalName) throws IOException {
         String fileId = UUID.randomUUID().toString();
         Path filePath = resolve(fileId);
         Files.createDirectories(filePath.getParent());
-        ReentrantLock lock = acquire(fileId);
         boolean success = false;
         try {
             long size = Files.copy(in, filePath);
-            writeOwner(fileId, owner);
             success = true;
             return new Stored(fileId, size);
         } finally {
             if (!success) {
-                cleanupAfterFailedStore(fileId, filePath);
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
             }
-            release(fileId, lock);
         }
     }
 
@@ -69,44 +52,27 @@ public class LocalDiskFileStore implements FileStore {
      * the source size before copying so the post-copy stat is unnecessary.
      */
     @Override
-    public Stored store(Path source, String originalName, String owner) throws IOException {
+    public Stored store(Path source, String originalName) throws IOException {
         String fileId = UUID.randomUUID().toString();
         Path filePath = resolve(fileId);
         Files.createDirectories(filePath.getParent());
         long size = Files.size(source);
-        ReentrantLock lock = acquire(fileId);
         boolean success = false;
         try {
             Files.copy(source, filePath);
-            writeOwner(fileId, owner);
             success = true;
             return new Stored(fileId, size);
         } finally {
             if (!success) {
-                cleanupAfterFailedStore(fileId, filePath);
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
             }
-            release(fileId, lock);
-        }
-    }
-
-    private void writeOwner(String fileId, String owner) throws IOException {
-        if (owner == null || owner.isBlank()) {
-            return;
-        }
-        Path ownerPath = resolveOwner(fileId);
-        Files.write(ownerPath, owner.getBytes(StandardCharsets.UTF_8));
-    }
-
-    private void cleanupAfterFailedStore(String fileId, Path filePath) {
-        try {
-            Files.deleteIfExists(filePath);
-        } catch (IOException cleanupEx) {
-            log.warn("Failed to clean up partial file {} after store failure", filePath, cleanupEx);
-        }
-        try {
-            Files.deleteIfExists(resolveOwner(fileId));
-        } catch (IOException cleanupEx) {
-            log.warn("Failed to clean up owner sidecar for {} after store failure", fileId);
         }
     }
 
@@ -135,26 +101,11 @@ public class LocalDiskFileStore implements FileStore {
 
     @Override
     public boolean delete(String fileId) {
-        ReentrantLock lock = acquire(fileId);
         try {
-            // Data first, owner second: a concurrent retrieve that observes the transient
-            // (data-gone, owner-still-present) window simply fails with IOException; the inverse
-            // order would briefly look like an unowned file and could grant cross-user access.
-            boolean removed;
-            try {
-                removed = Files.deleteIfExists(resolve(fileId));
-            } catch (IOException e) {
-                log.error("Error deleting file with ID: {}", fileId, e);
-                return false;
-            }
-            try {
-                Files.deleteIfExists(resolveOwner(fileId));
-            } catch (IOException e) {
-                log.warn("Error deleting owner sidecar for file ID: {}", fileId, e);
-            }
-            return removed;
-        } finally {
-            release(fileId, lock);
+            return Files.deleteIfExists(resolve(fileId));
+        } catch (IOException e) {
+            log.error("Error deleting file with ID: {}", fileId, e);
+            return false;
         }
     }
 
@@ -163,21 +114,8 @@ public class LocalDiskFileStore implements FileStore {
         return Files.exists(resolve(fileId));
     }
 
-    @Override
-    public String getOwner(String fileId) throws IOException {
-        Path ownerPath = resolveOwner(fileId);
-        if (!Files.exists(ownerPath)) {
-            return null;
-        }
-        byte[] bytes = Files.readAllBytes(ownerPath);
-        if (bytes.length == 0) {
-            return null;
-        }
-        return new String(bytes, StandardCharsets.UTF_8);
-    }
-
     public Path resolve(String fileId) {
-        if (fileId == null || !UUID_PATTERN.matcher(fileId).matches()) {
+        if (fileId.contains("..") || fileId.contains("/") || fileId.contains("\\")) {
             throw new IllegalArgumentException("Invalid file ID");
         }
         Path basePath = Path.of(baseDirPath).normalize().toAbsolutePath();
@@ -187,19 +125,4 @@ public class LocalDiskFileStore implements FileStore {
         }
         return resolvedPath;
     }
-
-    private Path resolveOwner(String fileId) {
-        Path data = resolve(fileId);
-        return data.resolveSibling(data.getFileName().toString() + OWNER_SUFFIX);
-    }
-
-    private ReentrantLock acquire(String fileId) {
-        ReentrantLock lock = stripes[(fileId.hashCode() & Integer.MAX_VALUE) % LOCK_STRIPES];
-        lock.lock();
-        return lock;
-    }
-
-    private void release(String fileId, ReentrantLock lock) {
-        lock.unlock();
-    }
 }

app/common/src/main/java/stirling/software/common/configuration/AppConfig.java

@@ -3,6 +3,7 @@ package stirling.software.common.configuration;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.List;
 import java.util.Locale;
 import java.util.Properties;
@@ -121,17 +122,17 @@ public class AppConfig {
 
     @Bean(name = "RunningInDocker")
     public boolean runningInDocker() {
-        return Files.exists(Path.of("/.dockerenv"));
+        return Files.exists(Paths.get("/.dockerenv"));
     }
 
     @Bean(name = "configDirMounted")
     public boolean isRunningInDockerWithConfig() {
-        Path dockerEnv = Path.of("/.dockerenv");
+        Path dockerEnv = Paths.get("/.dockerenv");
         // default to true if not docker
         if (!Files.exists(dockerEnv)) {
             return true;
         }
-        Path mountInfo = Path.of("/proc/1/mountinfo");
+        Path mountInfo = Paths.get("/proc/1/mountinfo");
         // this should always exist, if not some unknown usecase
         if (!Files.exists(mountInfo)) {
             return true;

app/common/src/main/java/stirling/software/common/configuration/ConfigInitializer.java

@@ -7,6 +7,7 @@ import java.net.URISyntaxException;
 import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.nio.file.StandardCopyOption;
 import java.util.List;
 
@@ -26,7 +27,7 @@ public class ConfigInitializer {
 
     public void ensureConfigExists() throws IOException, URISyntaxException {
         // 1) If settings file doesn't exist, create from template
-        Path destPath = Path.of(InstallationPathConfig.getSettingsPath());
+        Path destPath = Paths.get(InstallationPathConfig.getSettingsPath());
 
         boolean settingsFileExists = Files.exists(destPath);
 
@@ -38,7 +39,7 @@ public class ConfigInitializer {
             if (settingsFileExists) {
                 // move settings.yml to settings.yml.{timestamp}.bak
                 Path backupPath =
-                        Path.of(
+                        Paths.get(
                                 InstallationPathConfig.getSettingsPath()
                                         + "."
                                         + System.currentTimeMillis()
@@ -79,7 +80,6 @@ public class ConfigInitializer {
             YamlHelper settingsFile = new YamlHelper(settingTempPath);
 
             migrateEnterpriseEditionToPremium(settingsFile, settingsTemplateFile);
-            migrateProFeaturesKeyCasing(settingsFile, settingsTemplateFile);
 
             boolean changesMade =
                     settingsTemplateFile.updateValuesFromYaml(settingsFile, settingsTemplateFile);
@@ -95,7 +95,7 @@ public class ConfigInitializer {
         }
 
         // 3) Ensure custom settings file exists
-        Path customSettingsPath = Path.of(InstallationPathConfig.getCustomSettingsPath());
+        Path customSettingsPath = Paths.get(InstallationPathConfig.getCustomSettingsPath());
         if (Files.notExists(customSettingsPath)) {
             Files.createFile(customSettingsPath);
             log.info("Created custom_settings file: {}", customSettingsPath);
@@ -116,52 +116,31 @@ public class ConfigInitializer {
         }
         if (yaml.getValueByExactKeyPath("enterpriseEdition", "SSOAutoLogin") != null) {
             template.updateValue(
-                    List.of("premium", "proFeatures", "ssoAutoLogin"),
+                    List.of("premium", "proFeatures", "SSOAutoLogin"),
                     yaml.getValueByExactKeyPath("enterpriseEdition", "SSOAutoLogin"));
         }
         if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "autoUpdateMetadata")
                 != null) {
             template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "autoUpdateMetadata"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "autoUpdateMetadata"),
                     yaml.getValueByExactKeyPath(
                             "enterpriseEdition", "CustomMetadata", "autoUpdateMetadata"));
         }
         if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "author") != null) {
             template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "author"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "author"),
                     yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "author"));
         }
         if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "creator") != null) {
             template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "creator"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "creator"),
                     yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "creator"));
         }
         if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "producer")
                 != null) {
             template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "producer"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "producer"),
                     yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "producer"));
         }
     }
-
-    // TODO: Remove post migration
-    // settings.yml.template renamed the two non-camelCase proFeatures keys
-    // ("SSOAutoLogin" -> "ssoAutoLogin", "CustomMetadata" -> "customMetadata") so the whole
-    // settings pipeline is consistent camelCase. The save path (YamlHelper.updateValue) matches
-    // keys case-sensitively, so without this carry-forward an existing install's values written
-    // under the old PascalCase keys would be dropped on upgrade and reset to template defaults.
-    void migrateProFeaturesKeyCasing(YamlHelper yaml, YamlHelper template) {
-        Object ssoAutoLogin = yaml.getValueByExactKeyPath("premium", "proFeatures", "SSOAutoLogin");
-        if (ssoAutoLogin != null) {
-            template.updateValue(List.of("premium", "proFeatures", "ssoAutoLogin"), ssoAutoLogin);
-        }
-        for (String field : List.of("autoUpdateMetadata", "author", "creator", "producer")) {
-            Object value =
-                    yaml.getValueByExactKeyPath("premium", "proFeatures", "CustomMetadata", field);
-            if (value != null) {
-                template.updateValue(
-                        List.of("premium", "proFeatures", "customMetadata", field), value);
-            }
-        }
-    }
 }

app/common/src/main/java/stirling/software/common/configuration/RuntimePathConfig.java

@@ -3,6 +3,7 @@ package stirling.software.common.configuration;
 import java.nio.file.Files;
 import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.LinkedHashSet;
@@ -200,7 +201,7 @@ public class RuntimePathConfig {
 
             try {
                 // Normalize to absolute path
-                Path path = Path.of(pathStr.trim()).toAbsolutePath().normalize();
+                Path path = Paths.get(pathStr.trim()).toAbsolutePath().normalize();
                 String normalizedPath = path.toString();
 
                 // Check for duplicates
@@ -223,9 +224,9 @@ public class RuntimePathConfig {
 
     private void detectOverlappingPaths(List<String> paths) {
         for (int i = 0; i < paths.size(); i++) {
-            Path path1 = Path.of(paths.get(i));
+            Path path1 = Paths.get(paths.get(i));
             for (int j = i + 1; j < paths.size(); j++) {
-                Path path2 = Path.of(paths.get(j));
+                Path path2 = Paths.get(paths.get(j));
 
                 // Check if one path is a parent of the other
                 if (path1.startsWith(path2)) {
@@ -245,10 +246,10 @@ public class RuntimePathConfig {
 
     private void validatePipelinePaths() {
         try {
-            Path finishedPath = Path.of(pipelineFinishedFoldersPath).toAbsolutePath().normalize();
+            Path finishedPath = Paths.get(pipelineFinishedFoldersPath).toAbsolutePath().normalize();
 
             for (String watchedPathStr : pipelineWatchedFoldersPaths) {
-                Path watchedPath = Path.of(watchedPathStr).toAbsolutePath().normalize();
+                Path watchedPath = Paths.get(watchedPathStr).toAbsolutePath().normalize();
 
                 // Check if watched folder is same as finished folder
                 if (watchedPath.equals(finishedPath)) {

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -77,10 +77,8 @@ public class ApplicationProperties {
     private ProcessExecutor processExecutor = new ProcessExecutor();
     private PdfEditor pdfEditor = new PdfEditor();
     private AiEngine aiEngine = new AiEngine();
-    private Mcp mcp = new Mcp();
     private InternalApi internalApi = new InternalApi();
     private Cluster cluster = new Cluster();
-    private Policies policies = new Policies();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -204,45 +202,6 @@ public class ApplicationProperties {
         }
     }
 
-    @Data
-    public static class Policies {
-        /**
-         * Absolute directories that policy folder input sources and output sinks may read from or
-         * write to. Empty (the default) disables folder access entirely, so a policy can never be
-         * pointed at an arbitrary server path. Stirling's own config directory is always
-         * off-limits, and folder access is always disabled in SaaS mode regardless of this list.
-         */
-        private List<String> allowedFolderRoots = new java.util.ArrayList<>();
-
-        /** How often (seconds) the schedule trigger checks for policies whose schedule is due. */
-        private long scheduleSweepSeconds = 60;
-
-        /**
-         * How often (seconds) the folder-watch trigger reconciles its watch registrations and
-         * re-runs every folder-watch policy as a safety net for filesystem events that were missed
-         * (NFS, bind mounts, inotify-queue overflow).
-         */
-        private long watchReconcileSeconds = 300;
-
-        /**
-         * How long (milliseconds) the folder-watch trigger keeps draining filesystem events after
-         * the first, so a burst from a single file copy coalesces into one run instead of many.
-         */
-        private long watchQuietPeriodMs = 500;
-
-        /**
-         * SSE emitter timeout (milliseconds) for streamed runs; generous for long multi-step runs.
-         */
-        private long streamTimeoutMs = 1800000;
-
-        /**
-         * How long (minutes) a finished run's in-memory state is retained before eviction,
-         * mirroring the job-result expiry so rich run state does not outlive the process. Active
-         * and paused runs are kept regardless of age.
-         */
-        private int runExpiryMinutes = 30;
-    }
-
     @Data
     public static class PdfEditor {
         private Cache cache = new Cache();
@@ -297,103 +256,6 @@ public class ApplicationProperties {
         private int longRunningTimeoutSeconds = 600;
     }
 
-    /**
-     * Model Context Protocol (MCP) server configuration. All keys live under the top-level {@code
-     * mcp.*} prefix. {@link #enabled} defaults to {@code false}: when off, no MCP beans are wired,
-     * no /mcp endpoint exists, and no protected-resource metadata is published.
-     */
-    @Data
-    public static class Mcp {
-
-        /** Master switch. When {@code false} (default), no MCP beans are wired. */
-        private boolean enabled = false;
-
-        /**
-         * When {@code true} (default), invocations require an OAuth scope: {@code mcp.tools.read}
-         * for read-style operations and {@code mcp.tools.write} for write/destructive ones. When
-         * {@code false}, scope checks are skipped (use only if your IdP issues a single coarse
-         * scope).
-         */
-        private boolean scopesEnabled = true;
-
-        /** How often to refresh the AI capabilities manifest from the engine. */
-        private int engineCapabilityRefreshMinutes = 5;
-
-        /**
-         * Tool allow-list (operation ids, e.g. {@code compress-pdf}). When non-empty, ONLY these
-         * operations are exposed over MCP; everything else is hidden, undescribable, and
-         * uninvocable - on top of the global endpoint enable/disable config. Empty = allow all.
-         */
-        private List<String> allowedOperations = new ArrayList<>();
-
-        /**
-         * Tool deny-list (operation ids). Any operation listed here is removed from MCP even if it
-         * would otherwise be allowed. Applied after {@link #allowedOperations}.
-         */
-        private List<String> blockedOperations = new ArrayList<>();
-
-        /** Max MCP request body size in bytes; inline file uploads ride in the JSON-RPC body. */
-        private long maxRequestBytes = 10L * 1024 * 1024;
-
-        /** Results up to this size return inline as base64; larger ones return a fileId only. */
-        private long maxInlineResponseBytes = 10L * 1024 * 1024;
-
-        private Auth auth = new Auth();
-
-        @Data
-        public static class Auth {
-            /**
-             * Authentication mode for the MCP endpoint. {@code oauth} (default) runs a full OAuth2
-             * resource server (JWT, RFC 8707 audience, RFC 9728 metadata). {@code apikey} accepts a
-             * Stirling per-user API key via the {@code X-API-KEY} header (or {@code Authorization:
-             * Bearer <key>}) and binds the request to that user - the low-friction self-host path,
-             * no external IdP required.
-             */
-            private String mode = "oauth";
-
-            /** OAuth2 issuer URI, e.g. {@code http://localhost:9000}. Required when MCP is on. */
-            private String issuerUri = "";
-
-            /**
-             * JWKS URI. When blank, derived from the issuer's {@code
-             * /.well-known/openid-configuration} document.
-             */
-            private String jwksUri = "";
-
-            /**
-             * RFC 8707 resource identifier of THIS MCP server, e.g. {@code
-             * http://localhost:8080/mcp}. Tokens that do not list this id in their {@code aud}
-             * claim are rejected with HTTP 401.
-             */
-            private String resourceId = "";
-
-            /**
-             * Additional JWT audiences accepted at the MCP endpoint, on top of {@link #resourceId}.
-             * Empty (default) keeps strict RFC 8707 binding. Some IdPs cannot mint
-             * resource-specific audiences - e.g. Supabase's OAuth server always issues {@code
-             * aud=authenticated} - so operators list the audience their IdP actually emits here
-             * (env: {@code MCP_AUTH_ACCEPTEDAUDIENCES}, comma-separated).
-             */
-            private List<String> acceptedAudiences = new ArrayList<>();
-
-            /**
-             * JWT claim whose value is matched against a provisioned Stirling username. Defaults to
-             * {@code sub}; set to {@code email} or {@code preferred_username} to match how your IdP
-             * maps users to Stirling accounts.
-             */
-            private String usernameClaim = "sub";
-
-            /**
-             * When {@code true} (default), a validated token is accepted only if its {@link
-             * #usernameClaim} value resolves to an existing, enabled Stirling user account. Tokens
-             * whose subject has no Stirling account (or a disabled one) are rejected with HTTP 403.
-             * Set to {@code false} only if you intentionally want any IdP-valid token to use MCP
-             * without a local account.
-             */
-            private boolean requireExistingAccount = true;
-        }
-    }
-
     /**
      * Cluster backplane configuration. All keys live under the top-level {@code cluster.*} prefix
      * (e.g. env var {@code CLUSTER_ENABLED}). The master switch is {@link #enabled} and defaults to
@@ -666,16 +528,6 @@ public class ApplicationProperties {
             private String provider;
             private Client client = new Client();
 
-            /**
-             * When true, the OAuth2/OIDC login flow logs the full set of ID token and UserInfo
-             * claims at INFO level (and again at ERROR level if the username attribute cannot be
-             * resolved). Used to diagnose provider misconfiguration (for example ADFS not returning
-             * an {@code email} claim). WARNING: writes PII (sub, email, name) to application logs.
-             * Leave disabled in production; enable only while actively troubleshooting and disable
-             * again afterwards.
-             */
-            private Boolean debugLogging = false;
-
             public void setScopes(String scopes) {
                 List<String> scopesList =
                         Arrays.stream(scopes.split(",")).map(String::trim).toList();
@@ -926,7 +778,6 @@ public class ApplicationProperties {
         private boolean enabled = false;
         private String provider = "local";
         private Local local = new Local();
-        private S3 s3 = new S3();
         private Quotas quotas = new Quotas();
         private Sharing sharing = new Sharing();
         private Signing signing = new Signing();
@@ -936,57 +787,6 @@ public class ApplicationProperties {
             private String basePath = InstallationPathConfig.getPath() + "storage";
         }
 
-        @Data
-        public static class S3 {
-            /**
-             * Optional custom endpoint (e.g. {@code https://<account>.r2.cloudflarestorage.com},
-             * {@code https://<project>.supabase.co/storage/v1/s3}, or {@code http://localhost:9000}
-             * for MinIO). Blank = use AWS regional default.
-             */
-            private String endpoint = "";
-
-            private String bucket = "";
-
-            private String region = "us-east-1";
-
-            private String accessKey = "";
-            private String secretKey = "";
-
-            /**
-             * When {@code true} use path-style URLs ({@code <endpoint>/<bucket>/<key>}) instead of
-             * virtual-hosted ({@code <bucket>.<endpoint>/<key>}). MinIO and most S3-compatible
-             * gateways require path-style; AWS S3 prefers virtual-hosted.
-             */
-            private boolean pathStyleAccess = false;
-
-            /**
-             * When {@code false} (default), {@code endpoint} hostnames that resolve to private,
-             * loopback, or link-local addresses are rejected at startup to block SSRF attacks via
-             * the cloud metadata service (e.g. {@code http://169.254.169.254/}). Set to {@code
-             * true} to opt in for MinIO / in-cluster S3 endpoints on private networks.
-             */
-            private boolean allowPrivateEndpoints = false;
-
-            /**
-             * Controls when the SDK adds an {@code x-amz-checksum-*} header on PUT/UploadPart.
-             * Default {@code WHEN_SUPPORTED} (the SDK default since 2.30) makes the SDK send a
-             * CRC32 checksum on every upload - this works on AWS S3, MinIO, current Supabase,
-             * Backblaze B2 (post-July-2025), and modern R2. Set to {@code WHEN_REQUIRED} to
-             * suppress the auto-checksum on vendors that reject unknown {@code x-amz-checksum-*}
-             * headers (older Backblaze B2, some R2 corner cases, GCS S3 endpoint). Invalid values
-             * fall back to {@code WHEN_SUPPORTED}.
-             */
-            private String requestChecksumCalculation = "WHEN_SUPPORTED";
-
-            /**
-             * Controls when the SDK validates returned {@code x-amz-checksum-*} headers on GET
-             * responses. Default {@code WHEN_SUPPORTED}. Set to {@code WHEN_REQUIRED} if your
-             * vendor never returns these headers and you see false-positive checksum-mismatch
-             * errors. Invalid values fall back to {@code WHEN_SUPPORTED}.
-             */
-            private String responseChecksumValidation = "WHEN_SUPPORTED";
-        }
-
         @Data
         public static class Sharing {
             private boolean enabled = false;
@@ -1005,10 +805,6 @@ public class ApplicationProperties {
         @Data
         public static class Signing {
             private boolean enabled = false;
-
-            // Signing user-picker scope: 'org' (default) = whole instance, anything else =
-            // caller's team only (fail-closed). The saas profile pins 'team'.
-            private String userListScope = "org";
         }
     }
 

app/common/src/main/java/stirling/software/common/model/FileInfo.java

@@ -1,6 +1,7 @@
 package stirling.software.common.model;
 
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.time.LocalDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.Locale;
@@ -23,7 +24,7 @@ public class FileInfo {
 
     // Converts the file path string to a Path object.
     public Path getFilePathAsPath() {
-        return Path.of(filePath);
+        return Paths.get(filePath);
     }
 
     // Formats the file size into a human-readable string.

app/common/src/main/java/stirling/software/common/pdf/HeadingDetector.java

@@ -1,191 +0,0 @@
-package stirling.software.common.pdf;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import stirling.software.jpdfium.text.PageText;
-import stirling.software.jpdfium.text.TextChar;
-import stirling.software.jpdfium.text.TextLine;
-import stirling.software.jpdfium.text.TextWord;
-
-final class HeadingDetector {
-
-    private HeadingDetector() {}
-
-    /** A heading is at most this many words; longer lines are treated as body text. */
-    private static final int MAX_HEADING_WORDS = 12;
-
-    /**
-     * Returns the Markdown heading prefix for a line. The decision combines several signals, never
-     * text matching, so a plain line that merely shares text with a heading is never promoted:
-     *
-     * <ul>
-     *   <li><b>Size</b> — dominant glyph font size vs. the document body median (primary signal).
-     *       Some PDFs encode visual size in the text matrix, so every glyph reports ~1.0; for those
-     *       the line height is used as the proxy instead.
-     *   <li><b>Brevity</b> — headings are short labels; a line over {@value #MAX_HEADING_WORDS}
-     *       words is body text regardless of size.
-     *   <li><b>Not a sentence</b> — a line ending in {@code . ! ?} reads as prose, not a heading.
-     * </ul>
-     *
-     * <p>Boldness is deliberately <em>not</em> a heading signal — a bold-but-not-larger line is
-     * emphasis, not a heading (see {@link #isBoldLabel}); promoting it to {@code #}/{@code ##} is
-     * the main source of false-positive headings.
-     *
-     * <ul>
-     *   <li>size &gt; baseline * 1.4 → {@code "# "}
-     *   <li>size &gt; baseline * 1.2 → {@code "## "}
-     *   <li>otherwise → {@code ""}
-     * </ul>
-     */
-    static String headingPrefix(TextLine line, float medianBodySize, float medianBodyHeight) {
-        String text = line.text().strip();
-        if (text.isEmpty() || wordCount(text) > MAX_HEADING_WORDS || endsLikeSentence(text)) {
-            return "";
-        }
-
-        float dominant = dominantFontSize(line);
-        float value;
-        float baseline;
-        if (dominant > 2f && medianBodySize > 2f) {
-            value = dominant;
-            baseline = medianBodySize;
-        } else {
-            value = line.height();
-            baseline = medianBodyHeight;
-        }
-        if (baseline <= 0f) {
-            return "";
-        }
-
-        float ratio = value / baseline;
-        if (ratio > 1.4f) {
-            return "# ";
-        }
-        if (ratio > 1.2f) {
-            return "## ";
-        }
-        return "";
-    }
-
-    /**
-     * True when a line should be emphasised as bold (rendered {@code **like this**}) rather than
-     * promoted to a heading: it is bold, short, and not a full sentence. Used for bold labels that
-     * are not large enough to be headings.
-     */
-    static boolean isBoldLabel(TextLine line) {
-        String text = line.text().strip();
-        if (text.isEmpty() || wordCount(text) > MAX_HEADING_WORDS || endsLikeSentence(text)) {
-            return false;
-        }
-        return isBold(line);
-    }
-
-    private static int wordCount(String text) {
-        return text.split("\\s+").length;
-    }
-
-    private static boolean endsLikeSentence(String text) {
-        char last = text.charAt(text.length() - 1);
-        return last == '.' || last == '!' || last == '?';
-    }
-
-    /** True when the line's dominant font is bold, inferred from PostScript font names. */
-    private static boolean isBold(TextLine line) {
-        Map<String, Integer> counts = new HashMap<>();
-        for (TextWord word : line.words()) {
-            for (TextChar ch : word.chars()) {
-                if (ch.isWhitespace() || ch.isNewline()) {
-                    continue;
-                }
-                String name = ch.fontName();
-                if (name != null && !name.isBlank()) {
-                    counts.merge(name, 1, Integer::sum);
-                }
-            }
-        }
-        String dominantFont = "";
-        int max = -1;
-        for (Map.Entry<String, Integer> e : counts.entrySet()) {
-            if (e.getValue() > max) {
-                max = e.getValue();
-                dominantFont = e.getKey();
-            }
-        }
-        String lower = dominantFont.toLowerCase(java.util.Locale.ROOT);
-        return lower.contains("bold")
-                || lower.contains("black")
-                || lower.contains("heavy")
-                || lower.contains("semibold");
-    }
-
-    /** Computes the median glyph font size across all pages. */
-    static float medianFontSize(List<PageText> allPages) {
-        List<Float> sizes = new ArrayList<>();
-        for (PageText page : allPages) {
-            for (TextChar ch : page.chars()) {
-                if (!ch.isWhitespace() && !ch.isNewline() && ch.fontSize() > 0f) {
-                    sizes.add(ch.fontSize());
-                }
-            }
-        }
-        return median(sizes, 12f);
-    }
-
-    /** Computes the median TextLine height across all pages. Used when font size is degenerate. */
-    static float medianLineHeight(List<PageText> allPages) {
-        List<Float> heights = new ArrayList<>();
-        for (PageText page : allPages) {
-            for (TextLine line : page.lines()) {
-                if (line.height() > 0f && !line.text().isBlank()) {
-                    heights.add(line.height());
-                }
-            }
-        }
-        return median(heights, 12f);
-    }
-
-    private static float median(List<Float> values, float fallback) {
-        if (values.isEmpty()) {
-            return fallback;
-        }
-        Collections.sort(values);
-        int mid = values.size() / 2;
-        if (values.size() % 2 == 0) {
-            return (values.get(mid - 1) + values.get(mid)) / 2f;
-        }
-        return values.get(mid);
-    }
-
-    /**
-     * Returns the font size that appears most often (by character count) in the given line. Ties
-     * are broken in favour of the larger size.
-     */
-    private static float dominantFontSize(TextLine line) {
-        Map<Float, Integer> counts = new HashMap<>();
-        for (TextWord word : line.words()) {
-            for (TextChar ch : word.chars()) {
-                if (!ch.isWhitespace() && !ch.isNewline() && ch.fontSize() > 0f) {
-                    counts.merge(ch.fontSize(), 1, Integer::sum);
-                }
-            }
-        }
-        if (counts.isEmpty()) {
-            return 0f;
-        }
-        float dominant = 0f;
-        int maxCount = -1;
-        for (Map.Entry<Float, Integer> entry : counts.entrySet()) {
-            int count = entry.getValue();
-            float size = entry.getKey();
-            if (count > maxCount || (count == maxCount && size > dominant)) {
-                maxCount = count;
-                dominant = size;
-            }
-        }
-        return dominant;
-    }
-}

app/common/src/main/java/stirling/software/common/pdf/TableRenderer.java

@@ -1,82 +0,0 @@
-package stirling.software.common.pdf;
-
-import stirling.software.jpdfium.text.Table;
-
-final class TableRenderer {
-    private TableRenderer() {}
-
-    /** Renders a Table as a GitHub-Flavoured Markdown table string. */
-    static String render(Table table) {
-        if (table.rowCount() == 0) {
-            return "";
-        }
-
-        String[][] grid = table.asGrid();
-
-        if (table.rowCount() < 2) {
-            // No separator row possible — return plain lines
-            StringBuilder sb = new StringBuilder();
-            for (int c = 0; c < grid[0].length; c++) {
-                if (c > 0) sb.append('\n');
-                sb.append(escape(grid[0][c].trim()));
-            }
-            return sb.toString();
-        }
-
-        int cols = grid[0].length;
-
-        // Compute column widths: max(3, max content length across all rows)
-        int[] widths = new int[cols];
-        for (int c = 0; c < cols; c++) {
-            widths[c] = 3;
-        }
-        for (String[] row : grid) {
-            for (int c = 0; c < cols; c++) {
-                String cell = c < row.length ? row[c].trim() : "";
-                widths[c] = Math.max(widths[c], escape(cell).length());
-            }
-        }
-
-        StringBuilder sb = new StringBuilder();
-
-        // Header row
-        sb.append(buildRow(grid[0], widths, cols));
-        sb.append('\n');
-
-        // Separator row
-        sb.append('|');
-        for (int c = 0; c < cols; c++) {
-            sb.append('-').append("-".repeat(widths[c])).append('-').append('|');
-        }
-        sb.append('\n');
-
-        // Data rows
-        for (int r = 1; r < grid.length; r++) {
-            sb.append(buildRow(grid[r], widths, cols));
-            if (r < grid.length - 1) {
-                sb.append('\n');
-            }
-        }
-
-        return sb.toString();
-    }
-
-    private static String buildRow(String[] row, int[] widths, int cols) {
-        StringBuilder sb = new StringBuilder();
-        sb.append('|');
-        for (int c = 0; c < cols; c++) {
-            String cell = c < row.length ? escape(row[c].trim()) : "";
-            sb.append(' ').append(padRight(cell, widths[c])).append(' ').append('|');
-        }
-        return sb.toString();
-    }
-
-    private static String escape(String cell) {
-        return cell.replace("|", "\\|");
-    }
-
-    private static String padRight(String s, int width) {
-        if (s.length() >= width) return s;
-        return s + " ".repeat(width - s.length());
-    }
-}

app/common/src/main/java/stirling/software/common/service/FileStorage.java

@@ -5,7 +5,6 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.PipedInputStream;
 import java.io.PipedOutputStream;
-import java.util.Optional;
 import java.util.concurrent.Executors;
 import java.util.concurrent.atomic.AtomicReference;
 
@@ -18,7 +17,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.cluster.FileStore;
-import stirling.software.common.util.JobContext;
 
 /**
  * Service for storing and retrieving files with unique file IDs. Used by the AutoJobPostMapping
@@ -34,10 +32,8 @@ public class FileStorage {
 
     private final FileOrUploadService fileOrUploadService;
     private final FileStore fileStore;
-    private final Optional<JobOwnershipService> jobOwnershipService;
 
     public String storeFile(MultipartFile file) throws IOException {
-        String owner = resolveOwner();
         // Fast path: when Spring buffered the multipart to disk (typical for large uploads), the
         // backing Resource exposes a real File. Hand the Path to the FileStore so it can do a
         // file-to-file copy (Linux sendfile, no copy through Java heap) rather than streaming
@@ -52,7 +48,7 @@ public class FileStorage {
         if (res != null && res.isFile()) {
             try {
                 FileStore.Stored stored =
-                        fileStore.store(res.getFile().toPath(), file.getOriginalFilename(), owner);
+                        fileStore.store(res.getFile().toPath(), file.getOriginalFilename());
                 log.debug("Stored file with ID: {} (fast path)", stored.fileId());
                 return stored.fileId();
             } catch (IOException ex) {
@@ -61,45 +57,40 @@ public class FileStorage {
             }
         }
         try (InputStream in = file.getInputStream()) {
-            FileStore.Stored stored = fileStore.store(in, file.getOriginalFilename(), owner);
+            FileStore.Stored stored = fileStore.store(in, file.getOriginalFilename());
             log.debug("Stored file with ID: {}", stored.fileId());
             return stored.fileId();
         }
     }
 
     public String storeBytes(byte[] bytes, String originalName) throws IOException {
-        FileStore.Stored stored =
-                fileStore.store(new ByteArrayInputStream(bytes), originalName, resolveOwner());
+        FileStore.Stored stored = fileStore.store(new ByteArrayInputStream(bytes), originalName);
         log.debug("Stored byte array with ID: {}", stored.fileId());
         return stored.fileId();
     }
 
     public MultipartFile retrieveFile(String fileId) throws IOException {
-        enforceOwnership(fileId);
         byte[] fileData = fileStore.retrieveBytes(fileId);
         return fileOrUploadService.toMockMultipartFile(fileId, fileData);
     }
 
     public byte[] retrieveBytes(String fileId) throws IOException {
-        enforceOwnership(fileId);
         return fileStore.retrieveBytes(fileId);
     }
 
     public InputStream retrieveInputStream(String fileId) throws IOException {
-        enforceOwnership(fileId);
         return fileStore.retrieve(fileId);
     }
 
     public StoredFile storeInputStream(InputStream inputStream, String originalName)
             throws IOException {
-        FileStore.Stored stored = fileStore.store(inputStream, originalName, resolveOwner());
+        FileStore.Stored stored = fileStore.store(inputStream, originalName);
         log.debug("Stored input stream with ID: {}", stored.fileId());
         return new StoredFile(stored.fileId(), stored.size());
     }
 
     public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
             throws IOException {
-        String owner = resolveOwner();
         // Hold Throwable not IOException: an unchecked failure (NPE, IllegalState, OOM, etc.)
         // from the body writer would otherwise close the pipe with EOF and the consumer would
         // return a truncated file with no error surfaced to the caller.
@@ -124,7 +115,7 @@ public class FileStorage {
                                         }
                                     }
                                 });
-                FileStore.Stored stored = fileStore.store(in, originalName, owner);
+                FileStore.Stored stored = fileStore.store(in, originalName);
                 Throwable writerErr = bodyError.get();
                 if (writerErr != null) {
                     // Body failed mid-write: the FileStore persisted a truncated entry.
@@ -168,62 +159,21 @@ public class FileStorage {
 
     public String storeFromResource(Resource resource, String originalName) throws IOException {
         try (InputStream in = resource.getInputStream()) {
-            FileStore.Stored stored = fileStore.store(in, originalName, resolveOwner());
+            FileStore.Stored stored = fileStore.store(in, originalName);
             log.debug("Stored Resource with ID: {}", stored.fileId());
             return stored.fileId();
         }
     }
 
     public boolean deleteFile(String fileId) {
-        enforceOwnership(fileId);
         return fileStore.delete(fileId);
     }
 
     public boolean fileExists(String fileId) {
-        enforceOwnership(fileId);
         return fileStore.exists(fileId);
     }
 
     public long getFileSize(String fileId) throws IOException {
-        enforceOwnership(fileId);
         return fileStore.size(fileId);
     }
-
-    private String resolveOwner() {
-        String propagated = JobContext.getOwner();
-        if (propagated != null) {
-            return propagated;
-        }
-        return jobOwnershipService.flatMap(JobOwnershipService::getCurrentUserId).orElse(null);
-    }
-
-    private void enforceOwnership(String fileId) {
-        if (jobOwnershipService.isEmpty()) {
-            return;
-        }
-        Optional<String> currentUser = jobOwnershipService.get().getCurrentUserId();
-        if (currentUser.isEmpty()) {
-            return;
-        }
-        String owner;
-        try {
-            owner = fileStore.getOwner(fileId);
-        } catch (IOException e) {
-            log.warn("Failed to read owner for file {}: {}", fileId, e.getMessage());
-            throw new SecurityException(
-                    "Access denied: could not verify ownership of the requested file");
-        }
-        if (owner == null) {
-            return;
-        }
-        if (!owner.equals(currentUser.get())) {
-            log.warn(
-                    "Access denied: user {} attempted to access file {} owned by {}",
-                    currentUser.get(),
-                    fileId,
-                    owner);
-            throw new SecurityException(
-                    "Access denied: you do not have permission to access this file");
-        }
-    }
 }

app/common/src/main/java/stirling/software/common/service/InternalApiClient.java

@@ -50,16 +50,6 @@ public class InternalApiClient {
                     "^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$"
                             + "|^/api/v1/ai/tools(/[A-Za-z0-9_-]+)+$");
 
-    /**
-     * Marker propagated on every internal sub-step dispatch so the saas PAYG interceptor classifies
-     * the call as {@code BillingCategory.AUTOMATION}. By construction every {@link
-     * InternalApiClient#post} caller is an automation surface (pipeline executor, AI workflow,
-     * policy runner) running a child tool inside a parent automation flow — see the saas {@code
-     * PaygChargeInterceptor.determineCategory} precedence chain, where this header dominates any
-     * per-tool {@code @RequiresFeature} annotation.
-     */
-    public static final String AUTOMATION_HEADER = "X-Stirling-Automation";
-
     private final ServletContext servletContext;
     private final UserServiceInterface userService;
     private final TempFileManager tempFileManager;
@@ -106,23 +96,7 @@ public class InternalApiClient {
         if (apiKey != null && !apiKey.isEmpty()) {
             headers.add("X-API-KEY", apiKey);
         }
-        // Tag the sub-step as automation so PAYG bills it under AUTOMATION regardless of which
-        // tool-level @RequiresFeature annotation the dispatched controller carries (e.g. an AI-OCR
-        // step inside a policy run must bill as AUTOMATION, not AI). Set unconditionally because
-        // every caller of this dispatcher is an automation surface by design.
-        headers.add(AUTOMATION_HEADER, "true");
 
-        // A no-file ai/tools call (e.g. create-pdf-from-html-agent) sends only string params, so
-        // without this RestTemplate would use urlencoded instead of the multipart the controller
-        // expects. File-bearing calls get the right multipart content-type from RestTemplate.
-        boolean isAiTool = endpointPath.startsWith("/api/v1/ai/tools/");
-        boolean hasFilePart =
-                body.values().stream()
-                        .flatMap(java.util.List::stream)
-                        .anyMatch(v -> v instanceof Resource);
-        if (isAiTool && !hasFilePart) {
-            headers.setContentType(MediaType.MULTIPART_FORM_DATA);
-        }
         HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
         RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);
 

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -57,43 +57,85 @@ public class JobExecutorService {
         this.resourceMonitor = resourceMonitor;
         this.jobQueue = jobQueue;
 
+        // Parse session timeout and calculate effective timeout once during initialization
         long sessionTimeoutMs = parseSessionTimeout(sessionTimeout);
         this.effectiveTimeoutMs = Math.min(asyncRequestTimeoutMs, sessionTimeoutMs);
         log.debug(
                 "Job executor configured with effective timeout of {} ms", this.effectiveTimeoutMs);
     }
 
+    /**
+     * Run a job either asynchronously or synchronously
+     *
+     * @param async Whether to run the job asynchronously
+     * @param work The work to be done
+     * @return The response
+     */
     public ResponseEntity<?> runJobGeneric(boolean async, Supplier<Object> work) {
         return runJobGeneric(async, work, -1);
     }
 
+    /**
+     * Run a job either asynchronously or synchronously with a custom timeout
+     *
+     * @param async Whether to run the job asynchronously
+     * @param work The work to be done
+     * @param customTimeoutMs Custom timeout in milliseconds, or -1 to use the default
+     * @return The response
+     */
     public ResponseEntity<?> runJobGeneric(
             boolean async, Supplier<Object> work, long customTimeoutMs) {
         return runJobGeneric(async, work, customTimeoutMs, false, 50);
     }
 
+    /**
+     * Run a job either asynchronously or synchronously with custom parameters
+     *
+     * @param async Whether to run the job asynchronously
+     * @param work The work to be done
+     * @param customTimeoutMs Custom timeout in milliseconds, or -1 to use the default
+     * @param queueable Whether this job can be queued when system resources are limited
+     * @param resourceWeight The resource weight of this job (1-100)
+     * @return The response
+     */
     public ResponseEntity<?> runJobGeneric(
             boolean async,
             Supplier<Object> work,
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
+        // Generate base UUID
         String baseJobId = UUID.randomUUID().toString();
+
+        // Scope job to authenticated user if security is enabled
         String scopedJobKey = getScopedJobKey(baseJobId);
 
         log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
 
+        // Store the scoped job ID in the request for potential use by other components
         if (request != null) {
             request.setAttribute("jobId", scopedJobKey);
+
+            // Also track this job ID in the user's session for authorization purposes
+            // This ensures users can only cancel their own jobs
+            if (request.getSession() != null) {
+                @SuppressWarnings("unchecked")
+                java.util.Set<String> userJobIds =
+                        (java.util.Set<String>) request.getSession().getAttribute("userJobIds");
+
+                if (userJobIds == null) {
+                    userJobIds = new java.util.concurrent.ConcurrentSkipListSet<>();
+                    request.getSession().setAttribute("userJobIds", userJobIds);
+                }
+
+                userJobIds.add(scopedJobKey);
+                log.debug("Added scoped job ID {} to user session", scopedJobKey);
+            }
         }
 
         String jobId = scopedJobKey;
 
-        final String jobOwner =
-                jobOwnershipService != null
-                        ? jobOwnershipService.getCurrentUserId().orElse(null)
-                        : null;
-
+        // Determine which timeout to use
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
         log.debug(
@@ -104,6 +146,7 @@ public class JobExecutorService {
                 queueable,
                 resourceWeight);
 
+        // Check if we need to queue this job based on resource availability
         boolean shouldQueue =
                 queueable
                         && async
@@ -111,6 +154,7 @@ public class JobExecutorService {
                         resourceMonitor.shouldQueueJob(resourceWeight);
 
         if (shouldQueue) {
+            // Queue the job instead of executing immediately
             log.debug(
                     "Queueing job {} due to resource constraints (weight: {})",
                     jobId,
@@ -118,13 +162,18 @@ public class JobExecutorService {
 
             taskManager.createTask(jobId);
 
+            // Create a specialized wrapper that updates the TaskManager
             final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
+                            // Set jobId in ThreadLocal context for the queued job
                             stirling.software.common.util.JobContext.setJobId(
                                     capturedJobIdForQueue);
-                            stirling.software.common.util.JobContext.setOwner(jobOwner);
+                            log.debug(
+                                    "Set jobId {} in JobContext for queued job execution",
+                                    capturedJobIdForQueue);
+
                             Object result = work.get();
                             processJobResult(capturedJobIdForQueue, result);
                             return result;
@@ -137,17 +186,21 @@ public class JobExecutorService {
                             taskManager.setError(capturedJobIdForQueue, e.getMessage());
                             throw e;
                         } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
                             stirling.software.common.util.JobContext.clear();
                         }
                     };
 
+            // Queue the job and get the future
             CompletableFuture<ResponseEntity<?>> future =
                     jobQueue.queueJob(jobId, resourceWeight, wrappedWork, timeoutToUse);
 
+            // Return immediately with job ID
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
 
+            // Capture the jobId for the async thread
             final String capturedJobId = jobId;
 
             executor.execute(
@@ -158,8 +211,13 @@ public class JobExecutorService {
                                     capturedJobId,
                                     timeoutToUse);
 
+                            // Set jobId in ThreadLocal context for the async thread
                             stirling.software.common.util.JobContext.setJobId(capturedJobId);
-                            stirling.software.common.util.JobContext.setOwner(jobOwner);
+                            log.debug(
+                                    "Set jobId {} in JobContext for async execution",
+                                    capturedJobId);
+
+                            // Execute with timeout
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
                             processJobResult(capturedJobId, result);
                         } catch (TimeoutException te) {
@@ -169,6 +227,7 @@ public class JobExecutorService {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
                         } finally {
+                            // Clean up ThreadLocal to avoid memory leaks
                             stirling.software.common.util.JobContext.clear();
                         }
                     });
@@ -178,19 +237,27 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
+                // Make jobId available to downstream components on the worker thread
                 stirling.software.common.util.JobContext.setJobId(jobId);
+                log.debug("Set jobId {} in JobContext for sync execution", jobId);
+
+                // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
+                // If the result is already a ResponseEntity, return it directly
                 if (result instanceof ResponseEntity) {
                     return (ResponseEntity<?>) result;
                 }
 
+                // Process different result types
                 return handleResultForSyncJob(result);
             } catch (TimeoutException te) {
                 log.error("Synchronous job timed out after {} ms", timeoutToUse);
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
             } catch (RuntimeException e) {
+                // Check if this is a typed exception that should be handled by
+                // GlobalExceptionHandler (either directly or wrapped)
                 Throwable cause = e.getCause();
                 if (e instanceof IllegalArgumentException
                         || cause
@@ -200,13 +267,16 @@ public class JobExecutorService {
                                 instanceof
                                 stirling.software.common.util.ExceptionUtils
                                         .BaseValidationException) {
+                    // Rethrow so GlobalExceptionHandler can handle with proper HTTP status codes
                     throw e;
                 }
+                // Handle other RuntimeExceptions as generic errors
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
             } catch (Exception e) {
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
+                // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
             } finally {
@@ -215,13 +285,23 @@ public class JobExecutorService {
         }
     }
 
+    /**
+     * Process the result of an asynchronous job
+     *
+     * @param jobId The job ID
+     * @param result The result
+     */
     private void processJobResult(String jobId, Object result) {
         try {
             if (result instanceof byte[]) {
+                // Store byte array directly to disk to avoid double memory consumption
                 String fileId = fileStorage.storeBytes((byte[]) result, "result.pdf");
                 taskManager.setFileResult(
                         jobId, fileId, "result.pdf", MediaType.APPLICATION_PDF_VALUE);
                 log.debug("Stored byte[] result with fileId: {}", fileId);
+
+                // Let the byte array get collected naturally in the next GC cycle
+                // We don't need to force System.gc() which can be harmful
             } else if (result instanceof ResponseEntity) {
                 ResponseEntity<?> response = (ResponseEntity<?>) result;
                 Object body = response.getBody();
@@ -250,13 +330,16 @@ public class JobExecutorService {
                     taskManager.setFileResult(jobId, fileId, filename, contentType);
                     log.debug("Stored ResponseEntity<Resource> result with fileId: {}", fileId);
                 } else {
+                    // Check if the response body contains a fileId
                     if (body != null && body.toString().contains("fileId")) {
                         try {
+                            // Try to extract fileId using reflection
                             java.lang.reflect.Method getFileId =
                                     body.getClass().getMethod("getFileId");
                             String fileId = (String) getFileId.invoke(body);
 
                             if (fileId != null && !fileId.isEmpty()) {
+                                // Try to get filename and content type
                                 String filename = "result.pdf";
                                 String contentType = MediaType.APPLICATION_PDF_VALUE;
 
@@ -296,6 +379,7 @@ public class JobExecutorService {
                         }
                     }
 
+                    // Store generic result
                     taskManager.setResult(jobId, body);
                 }
             } else if (result instanceof MultipartFile file) {
@@ -304,13 +388,16 @@ public class JobExecutorService {
                         jobId, fileId, file.getOriginalFilename(), file.getContentType());
                 log.debug("Stored MultipartFile result with fileId: {}", fileId);
             } else {
+                // Check if result has a fileId field
                 if (result != null) {
                     try {
+                        // Try to extract fileId using reflection
                         java.lang.reflect.Method getFileId =
                                 result.getClass().getMethod("getFileId");
                         String fileId = (String) getFileId.invoke(result);
 
                         if (fileId != null && !fileId.isEmpty()) {
+                            // Try to get filename and content type
                             String filename = "result.pdf";
                             String contentType = MediaType.APPLICATION_PDF_VALUE;
 
@@ -348,6 +435,7 @@ public class JobExecutorService {
                     }
                 }
 
+                // Default case: store the result as is
                 taskManager.setResult(jobId, result);
             }
 
@@ -358,8 +446,16 @@ public class JobExecutorService {
         }
     }
 
+    /**
+     * Handle different result types for synchronous jobs
+     *
+     * @param result The result object
+     * @return The appropriate ResponseEntity
+     * @throws IOException If there is an error processing the result
+     */
     private ResponseEntity<?> handleResultForSyncJob(Object result) throws IOException {
         if (result instanceof byte[]) {
+            // Return byte array as PDF
             return ResponseEntity.ok()
                     .contentType(MediaType.APPLICATION_PDF)
                     .header(
@@ -367,6 +463,7 @@ public class JobExecutorService {
                             "form-data; name=\"attachment\"; filename=\"result.pdf\"")
                     .body(result);
         } else if (result instanceof MultipartFile file) {
+            // Return MultipartFile content
             return ResponseEntity.ok()
                     .contentType(MediaType.parseMediaType(file.getContentType()))
                     .header(
@@ -376,6 +473,7 @@ public class JobExecutorService {
                                     + "\"")
                     .body(file.getBytes());
         } else {
+            // Default case: return as JSON
             return ResponseEntity.ok(result);
         }
     }
@@ -395,9 +493,15 @@ public class JobExecutorService {
         return mediaType != null ? mediaType.toString() : MediaType.APPLICATION_PDF_VALUE;
     }
 
+    /**
+     * Parse session timeout string (e.g., "30m", "1h") to milliseconds
+     *
+     * @param timeout The timeout string
+     * @return The timeout in milliseconds
+     */
     private long parseSessionTimeout(String timeout) {
         if (timeout == null || timeout.isEmpty()) {
-            return 30 * 60 * 1000;
+            return 30 * 60 * 1000; // Default: 30 minutes
         }
 
         try {
@@ -419,16 +523,27 @@ public class JobExecutorService {
                 case "m" -> (long) (numericValue * 60 * 1000);
                 case "h" -> (long) (numericValue * 60 * 60 * 1000);
                 case "d" -> (long) (numericValue * 24 * 60 * 60 * 1000);
-                default -> (long) (numericValue * 60 * 1000);
+                default -> (long) (numericValue * 60 * 1000); // Default to minutes
             };
         } catch (Exception e) {
             log.warn("Could not parse session timeout '{}', using default", timeout);
-            return 30 * 60 * 1000;
+            return 30 * 60 * 1000; // Default: 30 minutes
         }
     }
 
+    /**
+     * Execute a supplier with a timeout
+     *
+     * @param supplier The supplier to execute
+     * @param timeoutMs The timeout in milliseconds
+     * @return The result from the supplier
+     * @throws TimeoutException If the execution times out
+     * @throws Exception If the supplier throws an exception
+     */
     private <T> T executeWithTimeout(Supplier<T> supplier, long timeoutMs)
             throws TimeoutException, Exception {
+        // Use the same executor as other async jobs for consistency
+        // This ensures all operations run on the same thread pool
         String currentJobId = stirling.software.common.util.JobContext.getJobId();
 
         java.util.concurrent.CompletableFuture<T> future =
@@ -462,10 +577,17 @@ public class JobExecutorService {
         }
     }
 
+    /**
+     * Get a scoped job key that includes user ownership when security is enabled.
+     *
+     * @param baseJobId the base job identifier
+     * @return scoped job key, or just baseJobId if no ownership service available
+     */
     private String getScopedJobKey(String baseJobId) {
         if (jobOwnershipService != null) {
             return jobOwnershipService.createScopedJobKey(baseJobId);
         }
+        // Security disabled, return unsecured job key
         return baseJobId;
     }
 }

app/common/src/main/java/stirling/software/common/service/MobileScannerService.java

@@ -3,6 +3,7 @@ package stirling.software.common.service;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -34,7 +35,7 @@ public class MobileScannerService {
     public MobileScannerService() throws IOException {
         // Create temp directory for mobile scanner uploads
         this.tempDirectory =
-                Path.of(System.getProperty("java.io.tmpdir"), "stirling-mobile-scanner");
+                Paths.get(System.getProperty("java.io.tmpdir"), "stirling-mobile-scanner");
         Files.createDirectories(tempDirectory);
         log.info("Mobile scanner temp directory: {}", tempDirectory);
     }

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -8,7 +8,7 @@ import java.lang.management.OperatingSystemMXBean;
 import java.lang.management.RuntimeMXBean;
 import java.lang.management.ThreadMXBean;
 import java.nio.file.Files;
-import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
@@ -160,7 +160,7 @@ public class PostHogService {
     }
 
     private boolean isRunningInDocker() {
-        return Files.exists(Path.of("/.dockerenv"));
+        return Files.exists(Paths.get("/.dockerenv"));
     }
 
     private Map<String, Object> getDockerMetrics() {

app/common/src/main/java/stirling/software/common/service/ToolMetadataService.java

@@ -1,21 +1,11 @@
 package stirling.software.common.service;
 
-import java.util.List;
-
 /** Provides metadata about tool endpoints for internal dispatch. */
 public interface ToolMetadataService {
 
     /** Returns true if the given operation path accepts multiple input files. */
     boolean isMultiInput(String operationPath);
 
-    /**
-     * Returns the file extensions (lowercase, no leading dot, e.g. {@code "pdf"}) that the
-     * operation accepts as input ({@code output=false}) or produces as output ({@code
-     * output=true}), derived from the endpoint's declared type. Returns {@code null} when the
-     * endpoint declares no specific type, which callers should treat as "any type accepted".
-     */
-    List<String> getExtensionTypes(boolean output, String operationPath);
-
     /**
      * Returns true when the endpoint's ZIP response is a transport for multiple typed results and
      * should be unpacked: multi-output endpoints (Type:SIMO / Type:MIMO) and wrapper declarations

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -255,7 +255,7 @@ public class GeneralUtils {
         String pattern = locationPattern;
         if (pattern.startsWith("file:")) {
             String rawPath = pattern.substring(5).replace("\\*", "").replace("/*", "");
-            Path normalizePath = Path.of(rawPath).normalize();
+            Path normalizePath = Paths.get(rawPath).normalize();
             pattern = "file:" + normalizePath.toString().replace("\\", "/") + "/*";
         }
         return ResourcePatternUtils.getResourcePatternResolver(resourceLoader)
@@ -837,7 +837,7 @@ public class GeneralUtils {
     }
 
     public boolean createDir(String path) {
-        Path folder = Path.of(path);
+        Path folder = Paths.get(path);
         if (!Files.exists(folder)) {
             try {
                 Files.createDirectories(folder);
@@ -867,7 +867,7 @@ public class GeneralUtils {
 
     public void saveKeyToSettings(String key, Object newValue) throws IOException {
         String[] keyArray = key.split("\\.");
-        Path settingsPath = Path.of(InstallationPathConfig.getSettingsPath());
+        Path settingsPath = Paths.get(InstallationPathConfig.getSettingsPath());
         YamlHelper settingsYaml = new YamlHelper(settingsPath);
         settingsYaml.updateValue(Arrays.asList(keyArray), newValue);
         settingsYaml.saveOverride(settingsPath);
@@ -888,7 +888,7 @@ public class GeneralUtils {
             return;
         }
 
-        Path settingsPath = Path.of(InstallationPathConfig.getSettingsPath());
+        Path settingsPath = Paths.get(InstallationPathConfig.getSettingsPath());
         YamlHelper settingsYaml = new YamlHelper(settingsPath);
 
         // Apply all updates to the same YamlHelper instance
@@ -974,11 +974,11 @@ public class GeneralUtils {
      */
     public void extractPipeline() throws IOException {
         Path pipelineDir =
-                Path.of(InstallationPathConfig.getPipelinePath(), DEFAULT_WEBUI_CONFIGS_DIR);
+                Paths.get(InstallationPathConfig.getPipelinePath(), DEFAULT_WEBUI_CONFIGS_DIR);
         Files.createDirectories(pipelineDir);
 
         for (String name : DEFAULT_VALID_PIPELINE) {
-            if (!Path.of(name).getFileName().toString().equals(name)) {
+            if (!Paths.get(name).getFileName().toString().equals(name)) {
                 log.error("Invalid pipeline file name: {}", name);
                 throw new IllegalArgumentException("Invalid pipeline file name: " + name);
             }
@@ -1014,7 +1014,7 @@ public class GeneralUtils {
             throw new IllegalArgumentException(
                     "scriptName must not contain path traversal characters");
         }
-        if (!Path.of(scriptName).getFileName().toString().equals(scriptName)) {
+        if (!Paths.get(scriptName).getFileName().toString().equals(scriptName)) {
             throw new IllegalArgumentException(
                     "scriptName must not contain path traversal characters");
         }
@@ -1024,7 +1024,7 @@ public class GeneralUtils {
                     "scriptName must be either 'png_to_webp.py' or 'split_photos.py'");
         }
 
-        Path scriptsDir = Path.of(InstallationPathConfig.getScriptsPath(), PYTHON_SCRIPTS_DIR);
+        Path scriptsDir = Paths.get(InstallationPathConfig.getScriptsPath(), PYTHON_SCRIPTS_DIR);
         Files.createDirectories(scriptsDir);
 
         Path target = scriptsDir.resolve(scriptName);

app/common/src/main/java/stirling/software/common/util/JarPathUtil.java

@@ -4,6 +4,7 @@ import java.io.File;
 import java.net.URISyntaxException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -19,7 +20,7 @@ public class JarPathUtil {
     public static Path currentJar() {
         try {
             Path jar =
-                    Path.of(
+                    Paths.get(
                                     JarPathUtil.class
                                             .getProtectionDomain()
                                             .getCodeSource()
@@ -60,14 +61,14 @@ public class JarPathUtil {
         }
 
         // Location 2: ./build/libs/ (development build)
-        possibleLocations[1] = Path.of("build", "libs", "restart-helper.jar").toAbsolutePath();
+        possibleLocations[1] = Paths.get("build", "libs", "restart-helper.jar").toAbsolutePath();
 
         // Location 3: app/common/build/libs/ (multi-module build)
         possibleLocations[2] =
-                Path.of("app", "common", "build", "libs", "restart-helper.jar").toAbsolutePath();
+                Paths.get("app", "common", "build", "libs", "restart-helper.jar").toAbsolutePath();
 
         // Location 4: Current working directory
-        possibleLocations[3] = Path.of("restart-helper.jar").toAbsolutePath();
+        possibleLocations[3] = Paths.get("restart-helper.jar").toAbsolutePath();
 
         // Check each location
         for (Path location : possibleLocations) {

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -1,9 +1,8 @@
 package stirling.software.common.util;
 
-/** Thread-local context for passing job ID and owner across async boundaries */
+/** Thread-local context for passing job ID across async boundaries */
 public class JobContext {
     private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
-    private static final ThreadLocal<String> CURRENT_OWNER = new ThreadLocal<>();
 
     public static void setJobId(String jobId) {
         CURRENT_JOB_ID.set(jobId);
@@ -13,16 +12,7 @@ public class JobContext {
         return CURRENT_JOB_ID.get();
     }
 
-    public static void setOwner(String owner) {
-        CURRENT_OWNER.set(owner);
-    }
-
-    public static String getOwner() {
-        return CURRENT_OWNER.get();
-    }
-
     public static void clear() {
         CURRENT_JOB_ID.remove();
-        CURRENT_OWNER.remove();
     }
 }

app/common/src/main/java/stirling/software/common/util/OfficeDocumentSanitizer.java

@@ -1,310 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Locale;
-import java.util.Set;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-import java.util.zip.ZipOutputStream;
-
-import javax.xml.XMLConstants;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.transform.OutputKeys;
-import javax.xml.transform.Transformer;
-import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
-import javax.xml.transform.dom.DOMSource;
-import javax.xml.transform.stream.StreamResult;
-
-import org.springframework.stereotype.Component;
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.w3c.dom.NamedNodeMap;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-import org.xml.sax.SAXException;
-
-import io.github.pixee.security.ZipSecurity;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.service.SsrfProtectionService;
-
-// Strips external refs from OOXML/ODF uploads so LibreOffice can't be made to fetch them.
-@Component
-@Slf4j
-public class OfficeDocumentSanitizer {
-
-    private static final Set<String> OOXML_EXTENSIONS =
-            Set.of(
-                    "docx", "docm", "dotx", "dotm", "xlsx", "xlsm", "xltx", "xltm", "pptx", "pptm",
-                    "potx", "potm", "ppsx", "ppsm");
-
-    private static final Set<String> ODF_EXTENSIONS =
-            Set.of(
-                    "odt", "ott", "ods", "ots", "odp", "otp", "odg", "otg", "odf", "odc", "odi",
-                    "odm");
-
-    private static final Set<String> ODF_XML_PARTS =
-            Set.of("content.xml", "styles.xml", "meta.xml", "settings.xml");
-
-    private final SsrfProtectionService ssrfProtectionService;
-    private final ApplicationProperties applicationProperties;
-
-    public OfficeDocumentSanitizer(
-            SsrfProtectionService ssrfProtectionService,
-            ApplicationProperties applicationProperties) {
-        this.ssrfProtectionService = ssrfProtectionService;
-        this.applicationProperties = applicationProperties;
-    }
-
-    public boolean isSanitizableExtension(String extension) {
-        if (extension == null) {
-            return false;
-        }
-        String lower = extension.toLowerCase(Locale.ROOT);
-        return OOXML_EXTENSIONS.contains(lower) || ODF_EXTENSIONS.contains(lower);
-    }
-
-    public byte[] sanitize(byte[] documentBytes, String extension) throws IOException {
-        if (documentBytes == null || documentBytes.length == 0) {
-            throw new IOException("Office document input is empty or null");
-        }
-        if (applicationProperties.getSystem().isDisableSanitize()) {
-            log.debug("Office document sanitization disabled by configuration");
-            return documentBytes;
-        }
-        if (!isSanitizableExtension(extension)) {
-            return documentBytes;
-        }
-
-        ByteArrayOutputStream out = new ByteArrayOutputStream(documentBytes.length);
-        try (ZipInputStream zipIn =
-                        ZipSecurity.createHardenedInputStream(
-                                new ByteArrayInputStream(documentBytes));
-                ZipOutputStream zipOut = new ZipOutputStream(out)) {
-
-            ZipEntry entry;
-            while ((entry = zipIn.getNextEntry()) != null) {
-                String name = entry.getName();
-                byte[] bytes = entry.isDirectory() ? new byte[0] : zipIn.readAllBytes();
-
-                if (!entry.isDirectory()) {
-                    bytes = sanitizeEntry(name, bytes);
-                }
-
-                ZipEntry outEntry = new ZipEntry(name);
-                if (entry.getComment() != null) {
-                    outEntry.setComment(entry.getComment());
-                }
-                if (entry.getExtra() != null) {
-                    outEntry.setExtra(entry.getExtra());
-                }
-                zipOut.putNextEntry(outEntry);
-                if (!entry.isDirectory()) {
-                    zipOut.write(bytes);
-                }
-                zipOut.closeEntry();
-            }
-        }
-        return out.toByteArray();
-    }
-
-    private byte[] sanitizeEntry(String entryName, byte[] entryBytes) {
-        String lower = entryName.toLowerCase(Locale.ROOT);
-        try {
-            if (lower.endsWith(".rels")) {
-                return sanitizeOoxmlRels(entryBytes);
-            }
-            if (isOdfXmlPart(lower)) {
-                return sanitizeOdfXml(entryBytes);
-            }
-        } catch (ParserConfigurationException
-                | SAXException
-                | IOException
-                | TransformerException e) {
-            log.warn(
-                    "Failed to parse XML part '{}' for sanitization, leaving as-is: {}",
-                    entryName,
-                    e.getMessage());
-        }
-        return entryBytes;
-    }
-
-    private boolean isOdfXmlPart(String lowerName) {
-        int slash = lowerName.lastIndexOf('/');
-        String base = slash >= 0 ? lowerName.substring(slash + 1) : lowerName;
-        return ODF_XML_PARTS.contains(base);
-    }
-
-    private byte[] sanitizeOoxmlRels(byte[] xmlBytes)
-            throws IOException, ParserConfigurationException, SAXException, TransformerException {
-        Document doc = parseSecurely(xmlBytes);
-        Element root = doc.getDocumentElement();
-        if (root == null) {
-            return xmlBytes;
-        }
-        NodeList relationships = root.getElementsByTagNameNS("*", "Relationship");
-        List<Node> toRemove = new ArrayList<>();
-        for (int i = 0; i < relationships.getLength(); i++) {
-            Node node = relationships.item(i);
-            NamedNodeMap attrs = node.getAttributes();
-            if (attrs == null) {
-                continue;
-            }
-            Node targetMode = attrs.getNamedItem("TargetMode");
-            if (targetMode == null || !"external".equalsIgnoreCase(targetMode.getNodeValue())) {
-                continue;
-            }
-            Node target = attrs.getNamedItem("Target");
-            String targetValue = target == null ? "" : target.getNodeValue();
-            if (isAdminAllowed(targetValue)) {
-                continue;
-            }
-            log.warn(
-                    "Stripping OOXML external relationship target: {}",
-                    truncateForLog(targetValue));
-            toRemove.add(node);
-        }
-        if (toRemove.isEmpty()) {
-            return xmlBytes;
-        }
-        for (Node n : toRemove) {
-            n.getParentNode().removeChild(n);
-        }
-        return serializeDocument(doc);
-    }
-
-    private byte[] sanitizeOdfXml(byte[] xmlBytes)
-            throws IOException, ParserConfigurationException, SAXException, TransformerException {
-        Document doc = parseSecurely(xmlBytes);
-        Element root = doc.getDocumentElement();
-        if (root == null) {
-            return xmlBytes;
-        }
-        boolean modified = stripExternalHrefs(root);
-        if (!modified) {
-            return xmlBytes;
-        }
-        return serializeDocument(doc);
-    }
-
-    private boolean stripExternalHrefs(Node node) {
-        boolean modified = false;
-        if (node.getNodeType() == Node.ELEMENT_NODE) {
-            NamedNodeMap attrs = node.getAttributes();
-            List<String> hrefAttrsToRemove = new ArrayList<>();
-            for (int i = 0; i < attrs.getLength(); i++) {
-                Node attr = attrs.item(i);
-                String name = attr.getNodeName();
-                if (name == null) {
-                    continue;
-                }
-                String lower = name.toLowerCase(Locale.ROOT);
-                if (!(lower.equals("xlink:href")
-                        || lower.endsWith(":href")
-                        || lower.equals("href"))) {
-                    continue;
-                }
-                String value = attr.getNodeValue();
-                if (!isExternalUrl(value)) {
-                    continue;
-                }
-                if (isAdminAllowed(value)) {
-                    continue;
-                }
-                log.warn(
-                        "Stripping ODF external href attribute ({}): {}",
-                        name,
-                        truncateForLog(value));
-                hrefAttrsToRemove.add(name);
-            }
-            Element element = (Element) node;
-            for (String attrName : hrefAttrsToRemove) {
-                element.removeAttribute(attrName);
-                modified = true;
-            }
-        }
-        NodeList children = node.getChildNodes();
-        for (int i = 0; i < children.getLength(); i++) {
-            if (stripExternalHrefs(children.item(i))) {
-                modified = true;
-            }
-        }
-        return modified;
-    }
-
-    private boolean isExternalUrl(String url) {
-        if (url == null) {
-            return false;
-        }
-        String trimmed = url.trim().toLowerCase(Locale.ROOT);
-        if (trimmed.isEmpty() || trimmed.startsWith("#") || trimmed.startsWith("../")) {
-            return false;
-        }
-        return trimmed.startsWith("http://")
-                || trimmed.startsWith("https://")
-                || trimmed.startsWith("ftp://")
-                || trimmed.startsWith("ftps://")
-                || trimmed.startsWith("file:")
-                || trimmed.startsWith("smb:")
-                || trimmed.startsWith("\\\\")
-                || trimmed.startsWith("//");
-    }
-
-    // Preserved only with an explicit allowedDomains entry; MEDIUM default would admit public URLs.
-    private boolean isAdminAllowed(String url) {
-        if (ssrfProtectionService == null || url == null || url.isBlank()) {
-            return false;
-        }
-        ApplicationProperties.Html.UrlSecurity config =
-                applicationProperties.getSystem().getHtml().getUrlSecurity();
-        if (config == null
-                || config.getAllowedDomains() == null
-                || config.getAllowedDomains().isEmpty()) {
-            return false;
-        }
-        return ssrfProtectionService.isUrlAllowed(url);
-    }
-
-    private Document parseSecurely(byte[] xmlBytes)
-            throws ParserConfigurationException, SAXException, IOException {
-        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
-        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
-        factory.setXIncludeAware(false);
-        factory.setExpandEntityReferences(false);
-        factory.setNamespaceAware(true);
-        DocumentBuilder builder = factory.newDocumentBuilder();
-        return builder.parse(new ByteArrayInputStream(xmlBytes));
-    }
-
-    private byte[] serializeDocument(Document doc) throws TransformerException {
-        TransformerFactory tf = TransformerFactory.newInstance();
-        tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-        Transformer transformer = tf.newTransformer();
-        transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
-        transformer.setOutputProperty(OutputKeys.INDENT, "no");
-        transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "no");
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        transformer.transform(new DOMSource(doc), new StreamResult(baos));
-        return baos.toByteArray();
-    }
-
-    private String truncateForLog(String value) {
-        if (value == null) {
-            return "null";
-        }
-        return value.length() > 80 ? value.substring(0, 80) + "..." : value;
-    }
-}

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -83,16 +83,7 @@ public class RequestUriUtils {
             return false;
         }
 
-        // Blocklist of backend/non-frontend paths that should still go through filters.
-        //
-        // `/files` was historically a backend route; it is now a frontend route
-        // owned by HomePage / FileManagerView. Direct-nav or refresh on /files
-        // (or /files/<folder-uuid>) was returning the Spring auth filter's 401
-        // JSON instead of serving index.html, so the SPA never got a chance to
-        // mount and the user saw a raw error response. There are no `/files`
-        // backend mappings at the servlet root - the real storage endpoints
-        // live under `/api/v1/storage/files`, which is filtered out a few lines
-        // up by the `startsWith("/api/")` guard.
+        // Blocklist of backend/non-frontend paths that should still go through filters
         String[] backendOnlyPrefixes = {
             "/register",
             "/pipeline",
@@ -100,6 +91,7 @@ public class RequestUriUtils {
             "/pdfjs-legacy",
             "/fonts",
             "/images",
+            "/files",
             "/css",
             "/js",
             "/swagger",
@@ -189,7 +181,7 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith(
                         "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
                 || trimmedUri.startsWith("/v1/api-docs")
-                // Workflow participant endpoints - access controlled by share tokens, not login
+                // Workflow participant endpoints — access controlled by share tokens, not login
                 || trimmedUri.startsWith("/api/v1/workflow/participant/")
                 // Share-link SPA bootstrap; data APIs remain protected
                 || trimmedUri.matches("^/share/[^/]+/?$");

app/common/src/main/java/stirling/software/common/util/propertyeditor/JsonListPropertyEditor.java

@@ -1,48 +0,0 @@
-package stirling.software.common.util.propertyeditor;
-
-import java.beans.PropertyEditorSupport;
-import java.util.ArrayList;
-import java.util.List;
-
-import lombok.extern.slf4j.Slf4j;
-
-import tools.jackson.core.type.TypeReference;
-import tools.jackson.databind.DeserializationFeature;
-import tools.jackson.databind.ObjectMapper;
-import tools.jackson.databind.json.JsonMapper;
-
-/**
- * Binds a multipart form value containing a JSON array into a typed {@code List<T>}. Used for
- * endpoints that accept structured list parameters via {@code @ModelAttribute} — the form field
- * carries the full JSON array as its value and the editor parses it once.
- */
-@Slf4j
-public class JsonListPropertyEditor<T> extends PropertyEditorSupport {
-
-    private static final ObjectMapper OBJECT_MAPPER =
-            JsonMapper.builder()
-                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
-                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
-                    .build();
-
-    private final TypeReference<? extends List<T>> typeRef;
-
-    public JsonListPropertyEditor(TypeReference<? extends List<T>> typeRef) {
-        this.typeRef = typeRef;
-    }
-
-    @Override
-    public void setAsText(String text) throws IllegalArgumentException {
-        if (text == null || text.trim().isEmpty()) {
-            setValue(new ArrayList<T>());
-            return;
-        }
-        try {
-            setValue(OBJECT_MAPPER.readValue(text, typeRef));
-        } catch (Exception e) {
-            log.error("Failed to parse JSON list value", e);
-            throw new IllegalArgumentException(
-                    "Expected a JSON array but could not parse: " + e.getMessage());
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/util/propertyeditor/JsonObjectPropertyEditor.java

@@ -1,41 +0,0 @@
-package stirling.software.common.util.propertyeditor;
-
-import java.beans.PropertyEditorSupport;
-
-import lombok.extern.slf4j.Slf4j;
-
-import tools.jackson.databind.DeserializationFeature;
-import tools.jackson.databind.ObjectMapper;
-import tools.jackson.databind.json.JsonMapper;
-
-/**
- * Binds a multipart form value containing a JSON object into a typed {@code T}. Companion to {@link
- * JsonListPropertyEditor} for single-object nested fields on {@code @ModelAttribute} endpoints.
- */
-@Slf4j
-public class JsonObjectPropertyEditor<T> extends PropertyEditorSupport {
-
-    private static final ObjectMapper OBJECT_MAPPER =
-            JsonMapper.builder().disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES).build();
-
-    private final Class<T> type;
-
-    public JsonObjectPropertyEditor(Class<T> type) {
-        this.type = type;
-    }
-
-    @Override
-    public void setAsText(String text) throws IllegalArgumentException {
-        if (text == null || text.trim().isEmpty()) {
-            setValue(null);
-            return;
-        }
-        try {
-            setValue(OBJECT_MAPPER.readValue(text, type));
-        } catch (Exception e) {
-            log.error("Failed to parse JSON object value", e);
-            throw new IllegalArgumentException(
-                    "Expected a JSON object but could not parse: " + e.getMessage());
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditor.java

@@ -0,0 +1,53 @@
+package stirling.software.common.util.propertyeditor;
+
+import java.beans.PropertyEditorSupport;
+import java.util.ArrayList;
+import java.util.List;
+
+import lombok.extern.slf4j.Slf4j;
+
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.JavaType;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Spring property editor that decodes a JSON string into a typed {@link ArrayList}. Used to bind
+ * complex list parameters (e.g. {@code List<RedactionArea>}, {@code List<EditTextOperation>}) from
+ * multipart form fields, where Spring's default binding cannot deserialize a JSON array.
+ */
+@Slf4j
+public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
+
+    private final ObjectMapper objectMapper =
+            JsonMapper.builder()
+                    .enable(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY)
+                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .build();
+
+    private final Class<T> elementType;
+
+    public StringToArrayListPropertyEditor(Class<T> elementType) {
+        this.elementType = elementType;
+    }
+
+    @Override
+    public void setAsText(String text) throws IllegalArgumentException {
+        if (text == null || text.trim().isEmpty()) {
+            setValue(new ArrayList<>());
+            return;
+        }
+        try {
+            JavaType listType =
+                    objectMapper
+                            .getTypeFactory()
+                            .constructCollectionType(ArrayList.class, elementType);
+            List<T> list = objectMapper.readValue(text, listType);
+            setValue(list);
+        } catch (Exception e) {
+            log.error("Exception while converting {}", e);
+            throw new IllegalArgumentException(
+                    "Failed to convert java.lang.String to java.util.List");
+        }
+    }
+}

app/common/src/test/java/stirling/software/SPDF/config/EndpointConfigurationGapTest.java

@@ -1,481 +0,0 @@
-package stirling.software.SPDF.config;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.util.List;
-import java.util.Set;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-
-import stirling.software.SPDF.config.EndpointConfiguration.DisableReason;
-import stirling.software.SPDF.config.EndpointConfiguration.EndpointAvailability;
-import stirling.software.common.model.ApplicationProperties;
-
-/**
- * Unit tests for {@link EndpointConfiguration}. The class wires up its endpoint/group registry in
- * {@code init()} during construction and then applies environment overrides. We build it with a
- * real {@link ApplicationProperties} (whose System/Endpoints sub-objects are non-null by default)
- * so the constructor runs cleanly without any mocking.
- */
-class EndpointConfigurationGapTest {
-
-    private ApplicationProperties applicationProperties;
-
-    /**
-     * Construct an EndpointConfiguration with the given pro flag and current applicationProperties.
-     */
-    private EndpointConfiguration build(boolean runningProOrHigher) {
-        return new EndpointConfiguration(applicationProperties, runningProOrHigher);
-    }
-
-    /** Default config: not pro, no removals, url-to-pdf disabled (default System flag is false). */
-    private EndpointConfiguration buildDefault() {
-        return build(false);
-    }
-
-    @BeforeEach
-    void setUp() {
-        applicationProperties = new ApplicationProperties();
-    }
-
-    @Nested
-    @DisplayName("endpointKeyForUri (static)")
-    class EndpointKeyForUriTests {
-
-        @Test
-        @DisplayName("returns null for null uri")
-        void nullUri() {
-            assertNull(EndpointConfiguration.endpointKeyForUri(null));
-        }
-
-        @Test
-        @DisplayName("returns null when uri does not contain /api/v1")
-        void notApiPath() {
-            assertNull(EndpointConfiguration.endpointKeyForUri("/foo/bar/baz"));
-            assertNull(EndpointConfiguration.endpointKeyForUri("https://example.com/home"));
-        }
-
-        @Test
-        @DisplayName("returns null when uri has too few path segments")
-        void tooFewSegments() {
-            // "/api/v1/general" splits to ["", "api", "v1", "general"] -> length 4, not > 4
-            assertNull(EndpointConfiguration.endpointKeyForUri("/api/v1/general"));
-        }
-
-        @Test
-        @DisplayName("extracts plain endpoint key from a standard /api/v1/<group>/<endpoint> uri")
-        void plainEndpoint() {
-            assertEquals(
-                    "remove-pages",
-                    EndpointConfiguration.endpointKeyForUri("/api/v1/general/remove-pages"));
-        }
-
-        @Test
-        @DisplayName("builds a <from>-to-<to> key for convert endpoints")
-        void convertEndpoint() {
-            assertEquals(
-                    "pdf-to-img",
-                    EndpointConfiguration.endpointKeyForUri("/api/v1/convert/pdf/img"));
-        }
-
-        @Test
-        @DisplayName("convert path without a target segment falls back to the segment after group")
-        void convertWithoutTarget() {
-            // "/api/v1/convert/pdf" -> length 5, the convert branch needs length > 5
-            assertEquals("pdf", EndpointConfiguration.endpointKeyForUri("/api/v1/convert/pdf"));
-        }
-    }
-
-    @Nested
-    @DisplayName("enable / disable endpoint")
-    class EnableDisableEndpointTests {
-
-        @Test
-        @DisplayName("a freshly registered endpoint is enabled by default")
-        void enabledByDefault() {
-            EndpointConfiguration config = buildDefault();
-            assertTrue(config.isEndpointEnabled("merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("disableEndpoint marks the endpoint disabled")
-        void disableEndpoint() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("merge-pdfs");
-            assertFalse(config.isEndpointEnabled("merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("enableEndpoint re-enables a previously disabled endpoint")
-        void reEnableEndpoint() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("merge-pdfs");
-            assertFalse(config.isEndpointEnabled("merge-pdfs"));
-            config.enableEndpoint("merge-pdfs");
-            assertTrue(config.isEndpointEnabled("merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("leading slash is normalized away on disable")
-        void leadingSlashNormalizedOnDisable() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("/merge-pdfs");
-            // both forms resolve to the same key
-            assertFalse(config.isEndpointEnabled("merge-pdfs"));
-            assertFalse(config.isEndpointEnabled("/merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("isEndpointEnabled tolerates a leading slash on the query")
-        void leadingSlashOnQuery() {
-            EndpointConfiguration config = buildDefault();
-            assertTrue(config.isEndpointEnabled("/merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("disabling clears with enable, removing the disable reason")
-        void enableClearsReason() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("split-pages", DisableReason.DEPENDENCY);
-            assertEquals(
-                    DisableReason.DEPENDENCY,
-                    config.getEndpointAvailability("split-pages").getReason());
-            config.enableEndpoint("split-pages");
-            EndpointAvailability availability = config.getEndpointAvailability("split-pages");
-            assertTrue(availability.isEnabled());
-            assertNull(availability.getReason());
-        }
-    }
-
-    @Nested
-    @DisplayName("isEndpointEnabledForUri")
-    class IsEndpointEnabledForUriTests {
-
-        @Test
-        @DisplayName("translates a /api/v1 uri to a key and reports its status")
-        void translatesUri() {
-            EndpointConfiguration config = buildDefault();
-            assertTrue(config.isEndpointEnabledForUri("/api/v1/general/merge-pdfs"));
-            config.disableEndpoint("merge-pdfs");
-            assertFalse(config.isEndpointEnabledForUri("/api/v1/general/merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("falls back to treating a non-api uri as a raw key")
-        void fallsBackToRawKey() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("merge-pdfs");
-            // non-api path: key resolution returns null, so the uri itself is used as the key
-            assertFalse(config.isEndpointEnabledForUri("merge-pdfs"));
-        }
-    }
-
-    @Nested
-    @DisplayName("group enable / disable")
-    class GroupTests {
-
-        @Test
-        @DisplayName("a functional group with all endpoints enabled reports enabled")
-        void functionalGroupEnabled() {
-            EndpointConfiguration config = buildDefault();
-            assertTrue(config.isGroupEnabled("PageOps"));
-        }
-
-        @Test
-        @DisplayName("disabling a functional group cascades to all its endpoints")
-        void disableFunctionalGroupCascades() {
-            EndpointConfiguration config = buildDefault();
-            config.disableGroup("PageOps");
-            assertFalse(config.isGroupEnabled("PageOps"));
-            assertFalse(config.isEndpointEnabled("remove-pages"));
-            assertFalse(config.isEndpointEnabled("split-pages"));
-        }
-
-        @Test
-        @DisplayName("re-enabling a functional group re-enables its endpoints")
-        void enableFunctionalGroupRestores() {
-            EndpointConfiguration config = buildDefault();
-            config.disableGroup("PageOps");
-            assertFalse(config.isEndpointEnabled("remove-pages"));
-            config.enableGroup("PageOps");
-            assertTrue(config.isEndpointEnabled("remove-pages"));
-            assertTrue(config.isGroupEnabled("PageOps"));
-        }
-
-        @Test
-        @DisplayName("a functional group with one disabled endpoint is not enabled")
-        void functionalGroupWithDisabledEndpoint() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("remove-pages");
-            assertFalse(config.isGroupEnabled("PageOps"));
-        }
-
-        @Test
-        @DisplayName("disabledGroups reflects disabled groups and getDisabledGroups returns a copy")
-        void getDisabledGroupsReturnsCopy() {
-            EndpointConfiguration config = buildDefault();
-            config.disableGroup("PageOps");
-            Set<String> disabled = config.getDisabledGroups();
-            assertTrue(disabled.contains("PageOps"));
-            // mutating the returned set must not affect internal state
-            disabled.clear();
-            assertTrue(config.getDisabledGroups().contains("PageOps"));
-        }
-
-        @Test
-        @DisplayName("an unknown group with no endpoints is not enabled")
-        void unknownGroupNotEnabled() {
-            EndpointConfiguration config = buildDefault();
-            assertFalse(config.isGroupEnabled("NoSuchGroupXyz"));
-        }
-    }
-
-    @Nested
-    @DisplayName("tool group semantics")
-    class ToolGroupTests {
-
-        @Test
-        @DisplayName("a tool group is enabled until explicitly disabled")
-        void toolGroupEnabledUntilDisabled() {
-            EndpointConfiguration config = buildDefault();
-            assertTrue(config.isGroupEnabled("qpdf"));
-            config.disableGroup("qpdf");
-            assertFalse(config.isGroupEnabled("qpdf"));
-        }
-
-        @Test
-        @DisplayName("disabling a tool group does NOT cascade to its endpoints directly")
-        void toolGroupNoCascade() {
-            EndpointConfiguration config = buildDefault();
-            // repair has alternatives (qpdf, Ghostscript); disabling only qpdf keeps it enabled
-            config.disableGroup("qpdf");
-            assertTrue(config.isEndpointEnabled("repair"));
-        }
-
-        @Test
-        @DisplayName("endpoint with alternatives is disabled only when all tool groups are gone")
-        void allAlternativesDisabled() {
-            EndpointConfiguration config = buildDefault();
-            config.disableGroup("qpdf");
-            config.disableGroup("Ghostscript");
-            // repair's only alternatives are qpdf and Ghostscript
-            assertFalse(config.isEndpointEnabled("repair"));
-        }
-
-        @Test
-        @DisplayName("endpoint with a still-enabled alternative stays enabled")
-        void oneAlternativeRemains() {
-            EndpointConfiguration config = buildDefault();
-            // compress-pdf alternatives: qpdf, Ghostscript, Java
-            config.disableGroup("qpdf");
-            config.disableGroup("Ghostscript");
-            assertTrue(config.isEndpointEnabled("compress-pdf"));
-            config.disableGroup("Java");
-            assertFalse(config.isEndpointEnabled("compress-pdf"));
-        }
-
-        @Test
-        @DisplayName("single-dependency endpoint (no alternatives) disabled when its tool group is")
-        void singleDependencyDisabled() {
-            EndpointConfiguration config = buildDefault();
-            // pdf-to-epub depends on Calibre, no alternatives registered
-            assertTrue(config.isEndpointEnabled("pdf-to-epub"));
-            config.disableGroup("Calibre");
-            assertFalse(config.isEndpointEnabled("pdf-to-epub"));
-        }
-    }
-
-    @Nested
-    @DisplayName("addEndpointToGroup / addEndpointAlternative")
-    class RegistrationTests {
-
-        @Test
-        @DisplayName("addEndpointToGroup makes the endpoint part of the group")
-        void addEndpointToGroup() {
-            EndpointConfiguration config = buildDefault();
-            config.addEndpointToGroup("CustomGroup", "custom-endpoint");
-            Set<String> endpoints = config.getEndpointsForGroup("CustomGroup");
-            assertTrue(endpoints.contains("custom-endpoint"));
-        }
-
-        @Test
-        @DisplayName("disabling a custom functional group disables its added endpoint")
-        void customFunctionalGroupCascades() {
-            EndpointConfiguration config = buildDefault();
-            config.addEndpointToGroup("CustomGroup", "custom-endpoint");
-            assertTrue(config.isEndpointEnabled("custom-endpoint"));
-            config.disableGroup("CustomGroup");
-            assertFalse(config.isEndpointEnabled("custom-endpoint"));
-        }
-
-        @Test
-        @DisplayName("getEndpointsForGroup returns an empty set for unknown groups")
-        void unknownGroupEmptySet() {
-            EndpointConfiguration config = buildDefault();
-            Set<String> endpoints = config.getEndpointsForGroup("NoSuchGroupXyz");
-            assertNotNull(endpoints);
-            assertTrue(endpoints.isEmpty());
-        }
-    }
-
-    @Nested
-    @DisplayName("getEndpointAvailability / determineDisableReason")
-    class AvailabilityTests {
-
-        @Test
-        @DisplayName("an enabled endpoint has a null disable reason")
-        void enabledHasNullReason() {
-            EndpointConfiguration config = buildDefault();
-            EndpointAvailability availability = config.getEndpointAvailability("merge-pdfs");
-            assertTrue(availability.isEnabled());
-            assertNull(availability.getReason());
-        }
-
-        @Test
-        @DisplayName("explicit disable preserves the supplied reason")
-        void explicitDisableReason() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("merge-pdfs", DisableReason.DEPENDENCY);
-            EndpointAvailability availability = config.getEndpointAvailability("merge-pdfs");
-            assertFalse(availability.isEnabled());
-            assertEquals(DisableReason.DEPENDENCY, availability.getReason());
-        }
-
-        @Test
-        @DisplayName("default disableEndpoint reason is CONFIG")
-        void defaultDisableReasonIsConfig() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("merge-pdfs");
-            assertEquals(
-                    DisableReason.CONFIG, config.getEndpointAvailability("merge-pdfs").getReason());
-        }
-
-        @Test
-        @DisplayName("endpoint disabled via functional group reports the group's reason")
-        void functionalGroupReason() {
-            EndpointConfiguration config = buildDefault();
-            config.disableGroup("PageOps", DisableReason.DEPENDENCY);
-            EndpointAvailability availability = config.getEndpointAvailability("crop");
-            assertFalse(availability.isEnabled());
-            // crop is disabled both via group cascade and group membership; reason is DEPENDENCY
-            assertEquals(DisableReason.DEPENDENCY, availability.getReason());
-        }
-    }
-
-    @Nested
-    @DisplayName("getAllEndpoints")
-    class GetAllEndpointsTests {
-
-        @Test
-        @DisplayName("aggregates endpoints across all groups")
-        void aggregatesAcrossGroups() {
-            EndpointConfiguration config = buildDefault();
-            Set<String> all = config.getAllEndpoints();
-            assertTrue(all.contains("merge-pdfs"));
-            assertTrue(all.contains("compress-pdf"));
-            assertTrue(all.contains("ocr-pdf"));
-            assertFalse(all.isEmpty());
-        }
-
-        @Test
-        @DisplayName("custom endpoints registered after init appear in getAllEndpoints")
-        void includesCustomEndpoints() {
-            EndpointConfiguration config = buildDefault();
-            config.addEndpointToGroup("CustomGroup", "brand-new-endpoint");
-            assertTrue(config.getAllEndpoints().contains("brand-new-endpoint"));
-        }
-    }
-
-    @Nested
-    @DisplayName("environment / constructor driven configuration")
-    class EnvironmentConfigTests {
-
-        @Test
-        @DisplayName("url-to-pdf is disabled when enableUrlToPDF is false (default)")
-        void urlToPdfDisabledByDefault() {
-            EndpointConfiguration config = buildDefault();
-            assertFalse(config.isEndpointEnabled("url-to-pdf"));
-        }
-
-        @Test
-        @DisplayName("url-to-pdf stays enabled when enableUrlToPDF is true")
-        void urlToPdfEnabledWhenFlagSet() {
-            applicationProperties.getSystem().setEnableUrlToPDF(true);
-            EndpointConfiguration config = build(false);
-            assertTrue(config.isEndpointEnabled("url-to-pdf"));
-        }
-
-        @Test
-        @DisplayName("endpoints.toRemove disables the listed endpoints at construction")
-        void endpointsToRemove() {
-            applicationProperties
-                    .getEndpoints()
-                    .setToRemove(List.of(" merge-pdfs ", "split-pages"));
-            EndpointConfiguration config = build(false);
-            // values are trimmed before disabling
-            assertFalse(config.isEndpointEnabled("merge-pdfs"));
-            assertFalse(config.isEndpointEnabled("split-pages"));
-        }
-
-        @Test
-        @DisplayName("endpoints.groupsToRemove disables the listed groups at construction")
-        void groupsToRemove() {
-            applicationProperties.getEndpoints().setGroupsToRemove(List.of(" PageOps "));
-            EndpointConfiguration config = build(false);
-            assertTrue(config.getDisabledGroups().contains("PageOps"));
-            assertFalse(config.isEndpointEnabled("remove-pages"));
-        }
-
-        @Test
-        @DisplayName("non-pro build disables the enterprise group")
-        void nonProDisablesEnterprise() {
-            EndpointConfiguration config = build(false);
-            assertTrue(config.getDisabledGroups().contains("enterprise"));
-        }
-
-        @Test
-        @DisplayName("pro build does not disable the enterprise group")
-        void proDoesNotDisableEnterprise() {
-            EndpointConfiguration config = build(true);
-            assertFalse(config.getDisabledGroups().contains("enterprise"));
-        }
-    }
-
-    @Nested
-    @DisplayName("getEndpointStatuses (Lombok getter) and logging summary")
-    class MiscTests {
-
-        @Test
-        @DisplayName("getEndpointStatuses reflects explicit disable state")
-        void endpointStatusesReflectDisable() {
-            EndpointConfiguration config = buildDefault();
-            config.disableEndpoint("merge-pdfs");
-            assertEquals(Boolean.FALSE, config.getEndpointStatuses().get("merge-pdfs"));
-        }
-
-        @Test
-        @DisplayName("logDisabledEndpointsSummary runs without throwing")
-        void logSummaryDoesNotThrow() {
-            EndpointConfiguration config = buildDefault();
-            config.disableGroup("PageOps");
-            config.disableGroup("qpdf");
-            // purely a smoke test of the logging branch coverage
-            config.logDisabledEndpointsSummary();
-        }
-
-        @Test
-        @DisplayName("logDisabledEndpointsSummary runs when nothing is disabled")
-        void logSummaryNothingDisabled() {
-            applicationProperties.getSystem().setEnableUrlToPDF(true);
-            EndpointConfiguration config = build(true);
-            config.logDisabledEndpointsSummary();
-        }
-    }
-}

app/common/src/test/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParserTest.java

@@ -0,0 +1,153 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+
+/**
+ * Unit tests for {@link LineAlignmentTableParser}, focused on the coincident-line merge logic and
+ * column-grid construction.
+ */
+class LineAlignmentTableParserTest {
+
+    private final LineAlignmentTableParser parser = new LineAlignmentTableParser();
+
+    // ── mergeCoincidentLines ─────────────────────────────────────────────────────────────────────
+
+    @Test
+    void mergeCoincidentLines_singleLine_unchanged() {
+        var lines = List.of(tokenized(rawLine(10f, 100f, "Revenue")));
+        assertThat(parser.mergeCoincidentLines(lines)).hasSize(1);
+    }
+
+    @Test
+    void mergeCoincidentLines_distinctYLines_unchanged() {
+        // Two lines at different y positions — must NOT be merged.
+        var lines =
+                List.of(
+                        tokenized(rawLine(10f, 100f, "Revenue")),
+                        tokenized(rawLine(10f, 115f, "Cost")));
+        assertThat(parser.mergeCoincidentLines(lines)).hasSize(2);
+    }
+
+    @Test
+    void mergeCoincidentLines_sameY_merged() {
+        // Simulates a financial-table row split by LineBuilder at the column gap:
+        //   label fragment at x=72  → "Revenue"
+        //   value fragment at x=350 → "1,234"
+        // Both have y=100. After merge they should form one TokenizedLine.
+        var label = rawLine(72f, 100f, "Revenue");
+        var value = rawLine(350f, 100f, "1,234");
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
+
+        assertThat(merged).hasSize(1);
+        // The merged line should contain tokens from both halves.
+        var tokens = merged.get(0).all();
+        assertThat(tokens.stream().map(t -> t.text()).toList())
+                .containsExactlyInAnyOrder("Revenue", "1,234");
+    }
+
+    @Test
+    void mergeCoincidentLines_sameY_mergedLineHasCorrectBounds() {
+        var label = rawLine(72f, 100f, "Revenue"); // 7 chars × 6pt = 42pt wide → right = 114
+        var value = rawLine(350f, 100f, "1,234"); // 5 chars × 6pt = 30pt wide → right = 380
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
+
+        var bounds = merged.get(0).line().bounds();
+        assertThat(bounds.x()).isEqualTo(72f);
+        assertThat(bounds.right()).isEqualTo(380f);
+    }
+
+    @Test
+    void mergeCoincidentLines_withinTolerance_merged() {
+        // Lines 1.5pt apart (within ROW_MERGE_TOLERANCE_PT = 2pt) should merge.
+        var a = rawLine(10f, 100.0f, "Alpha");
+        var b = rawLine(200f, 101.5f, "99");
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
+        assertThat(merged).hasSize(1);
+    }
+
+    @Test
+    void mergeCoincidentLines_beyondTolerance_notMerged() {
+        // Lines 3pt apart (beyond ROW_MERGE_TOLERANCE_PT = 2pt) should NOT merge.
+        var a = rawLine(10f, 100.0f, "Alpha");
+        var b = rawLine(200f, 103.0f, "99");
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
+        assertThat(merged).hasSize(2);
+    }
+
+    @Test
+    void mergeCoincidentLines_threeCoincident_allMerged() {
+        // Three fragments at the same y (e.g. wide financial table with two value columns).
+        var a = rawLine(72f, 100f, "Revenue");
+        var b = rawLine(300f, 100f, "1,234");
+        var c = rawLine(400f, 100f, "5,678");
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
+        assertThat(merged).hasSize(1);
+        assertThat(merged.get(0).all()).hasSize(3);
+    }
+
+    @Test
+    void mergeCoincidentLines_coincidentPairFollowedByDistinctLine_twoGroups() {
+        var a = rawLine(72f, 100f, "Revenue");
+        var b = rawLine(350f, 100f, "1,234"); // same y as a → merges with a
+        var c = rawLine(10f, 115f, "Expenses"); // different y → stays separate
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
+        assertThat(merged).hasSize(2);
+    }
+
+    @Test
+    void mergeCoincidentLines_numericAnchorStatus_correctAfterMerge() {
+        // After merging, the combined line should be an anchor (≥2 numeric tokens).
+        // "Revenue" alone → not an anchor. "1,234  567" alone → anchor.
+        // Merged → anchor with at least 2 numerics.
+        var label = rawLine(72f, 100f, "Revenue");
+        var values = rawLineMultiWord(350f, 100f, "1,234", 30f, "567", 30f);
+
+        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(values)));
+
+        assertThat(merged).hasSize(1);
+        assertThat(merged.get(0).isAnchor()).isTrue();
+    }
+
+    // ── helpers ──────────────────────────────────────────────────────────────────────────────────
+
+    /** Creates a RawLine with a single TextFragment of the given text at the given position. */
+    private static RawLine rawLine(float x, float y, String text) {
+        float width = text.length() * 6f; // ~6pt per char — rough but consistent
+        float height = 12f;
+        Bounds bounds = new Bounds(x, y, width, height);
+        TextFragment fragment =
+                new TextFragment("tf-test", text, bounds, y + height, 11f, "Helvetica", false);
+        return new RawLine("ln-test", List.of(fragment), bounds, 1);
+    }
+
+    /**
+     * Creates a RawLine with two TextFragments representing two words separated by a small gap.
+     * Used to simulate a values-only line with multiple numeric tokens.
+     */
+    private static RawLine rawLineMultiWord(
+            float x, float y, String word1, float w1, String word2, float w2) {
+        float height = 12f;
+        Bounds b1 = new Bounds(x, y, w1, height);
+        Bounds b2 = new Bounds(x + w1 + 5f, y, w2, height);
+        TextFragment f1 = new TextFragment("tf-1", word1, b1, y + height, 11f, "Helvetica", false);
+        TextFragment f2 = new TextFragment("tf-2", word2, b2, y + height, 11f, "Helvetica", false);
+        Bounds lineBounds = new Bounds(x, y, x + w1 + 5f + w2 - x, height);
+        return new RawLine("ln-test", List.of(f1, f2), lineBounds, 1);
+    }
+
+    /** Tokenises a RawLine via the parser's own tokenise logic (package-private access). */
+    private LineAlignmentTableParser.TokenizedLine tokenized(RawLine line) {
+        return parser.tokenize(line);
+    }
+}

app/common/src/test/java/stirling/software/SPDF/pdf/parser/PageColumnLayoutTest.java

@@ -1,149 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.junit.jupiter.api.Test;
-
-/** Unit tests for {@link PageColumnLayout} gutter detection and column classification. */
-class PageColumnLayoutTest {
-
-    private static final float PAGE_WIDTH = 612f; // Letter portrait
-
-    // ── single-column ────────────────────────────────────────────────────────────────────────────
-
-    @Test
-    void singleColumn_oneColumnNoGutters() {
-        List<float[]> lines = List.of(lineBox(72f, 396f));
-
-        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
-
-        assertThat(layout.columnCount()).isEqualTo(1);
-        assertThat(layout.gutters()).isEmpty();
-    }
-
-    @Test
-    void singleColumn_classifyAnchor_returnsZero() {
-        PageColumnLayout layout =
-                PageColumnLayout.fromLineBoxes(List.of(lineBox(72f, 396f)), PAGE_WIDTH);
-
-        assertThat(layout.columnOf(100f, 200f)).isEqualTo(0);
-    }
-
-    // ── two-column ───────────────────────────────────────────────────────────────────────────────
-
-    @Test
-    void twoColumn_detectsGutter() {
-        PageColumnLayout layout =
-                PageColumnLayout.fromLineBoxes(buildTwoColumnLines(3), PAGE_WIDTH);
-
-        assertThat(layout.columnCount()).isEqualTo(2);
-        assertThat(layout.gutters()).hasSize(1);
-        float[] gutter = layout.gutters().get(0);
-        // Gutter is centered on pageWidth/2 with PageColumnLayout.MIDPOINT_SLACK_PT slack each
-        // side.
-        float pageMid = PAGE_WIDTH / 2f;
-        assertThat(gutter[0]).isBetween(pageMid - 40f, pageMid - 20f);
-        assertThat(gutter[1]).isBetween(pageMid + 20f, pageMid + 40f);
-    }
-
-    @Test
-    void twoColumn_classifyLeftAndRightAnchors() {
-        PageColumnLayout layout =
-                PageColumnLayout.fromLineBoxes(buildTwoColumnLines(3), PAGE_WIDTH);
-        assertThat(layout.columnOf(100f, 200f)).isEqualTo(0);
-        assertThat(layout.columnOf(380f, 460f)).isEqualTo(1);
-    }
-
-    @Test
-    void twoColumn_columnsCrossing_leftLineOnlyHitsLeft() {
-        PageColumnLayout layout =
-                PageColumnLayout.fromLineBoxes(buildTwoColumnLines(3), PAGE_WIDTH);
-        assertThat(layout.columnsCrossing(72f, 280f)).containsExactly(0);
-        assertThat(layout.columnsCrossing(320f, 540f)).containsExactly(1);
-    }
-
-    @Test
-    void twoColumn_spanningLine_returnsBothColumns() {
-        List<float[]> lines = new ArrayList<>(buildTwoColumnLines(3));
-        // Full-width header that crosses pageWidth/2.
-        lines.add(lineBox(72f, 396f));
-
-        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
-
-        assertThat(layout.columnsCrossing(72f, 540f)).containsExactly(0, 1);
-        assertThat(layout.columnsCrossing(72f, 280f)).containsExactly(0);
-    }
-
-    private static List<float[]> buildTwoColumnLines(int rowsPerColumn) {
-        List<float[]> lines = new ArrayList<>();
-        for (int i = 0; i < rowsPerColumn; i++) {
-            lines.add(lineBox(72f, 136f)); // left column body (72..208)
-            lines.add(lineBox(320f, 220f)); // right column body (320..540)
-        }
-        return lines;
-    }
-
-    // ── three-column ─────────────────────────────────────────────────────────────────────────────
-
-    @Test
-    void threeColumn_collapsesToLeftRightSplit() {
-        // The midpoint-based detector splits the page at pageWidth/2 and treats anything else as
-        // single-column or spanning. A genuine 3-column layout collapses to 2 columns; the middle
-        // column's content ends up classified by midpoint as left or right of pageMid.
-        List<float[]> lines = new ArrayList<>();
-        for (int i = 0; i < 6; i++) {
-            lines.add(lineBox(72f, 150f)); // 72..222
-            lines.add(lineBox(252f, 150f)); // 252..402
-            lines.add(lineBox(432f, 150f)); // 432..582
-        }
-
-        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
-
-        assertThat(layout.columnCount()).isEqualTo(2);
-        assertThat(layout.gutters()).hasSize(1);
-    }
-
-    // ── empty page ───────────────────────────────────────────────────────────────────────────────
-
-    @Test
-    void emptyPage_singleColumnFallback() {
-        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(List.of(), PAGE_WIDTH);
-        assertThat(layout.columnCount()).isEqualTo(1);
-        assertThat(layout.gutters()).isEmpty();
-    }
-
-    @Test
-    void onlyShortFragments_singleColumnFallback() {
-        // Page numbers / decorations — too narrow to vote either side.
-        List<float[]> lines = List.of(lineBox(300f, 6f));
-        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
-        assertThat(layout.columnCount()).isEqualTo(1);
-    }
-
-    // ── narrow gap should not be confused for a gutter ───────────────────────────────────────────
-
-    @Test
-    void narrowInternalGap_doesNotProduceGutter() {
-        // Both halves sit left of the page midpoint, so no line votes for a right column and
-        // detection falls back to single-column.
-        List<float[]> lines = new ArrayList<>();
-        lines.add(lineBox(72f, 100f));
-        lines.add(lineBox(180f, 100f));
-        for (int i = 0; i < 5; i++) {
-            lines.add(lineBox(72f, 208f));
-        }
-
-        PageColumnLayout layout = PageColumnLayout.fromLineBoxes(lines, PAGE_WIDTH);
-        assertThat(layout.columnCount()).isEqualTo(1);
-    }
-
-    // ── helpers ──────────────────────────────────────────────────────────────────────────────────
-
-    /** Builds a line bounding box {@code [x1, 0, x1+width, 0]}; Y is unused by detection. */
-    private static float[] lineBox(float x1, float width) {
-        return new float[] {x1, 0f, x1 + width, 0f};
-    }
-}

app/common/src/test/java/stirling/software/SPDF/pdf/parser/TabulaTableParserGapTest.java

@@ -1,345 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static stirling.software.SPDF.pdf.parser.PdfModels.RawPage;
-import static stirling.software.SPDF.pdf.parser.PdfModels.TableCell;
-import static stirling.software.SPDF.pdf.parser.PdfModels.TableFragment;
-import static stirling.software.SPDF.pdf.parser.PdfModels.TableRow;
-
-import java.awt.Color;
-import java.io.ByteArrayOutputStream;
-import java.util.List;
-
-import org.apache.pdfbox.Loader;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDPageContentStream;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.font.PDType1Font;
-import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-
-/**
- * Unit tests for {@link TabulaTableParser}. Tables are built in-memory with PDFBox so the tests are
- * deterministic and need no fixtures, network, or external processes.
- */
-class TabulaTableParserGapTest {
-
-    private final TabulaTableParser parser = new TabulaTableParser();
-
-    // ── error / empty branches ───────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("Empty and error branches")
-    class EmptyAndErrorBranches {
-
-        @Test
-        @DisplayName("page number 0 is out of Tabula's 1-based range -> empty list, no throw")
-        void pageNumberZeroReturnsEmpty() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"hello"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> result = parser.parse(doc, 0);
-                assertNotNull(result);
-                assertTrue(result.isEmpty());
-            }
-        }
-
-        @Test
-        @DisplayName("page number beyond the document -> empty list, exception swallowed")
-        void pageNumberOutOfRangeReturnsEmpty() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"hello"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> result = parser.parse(doc, 99);
-                assertNotNull(result);
-                assertTrue(result.isEmpty());
-            }
-        }
-
-        @Test
-        @DisplayName("negative page number -> empty list")
-        void negativePageNumberReturnsEmpty() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"hello"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                assertTrue(parser.parse(doc, -5).isEmpty());
-            }
-        }
-
-        @Test
-        @DisplayName("lattice mode on a page with no ruled lines -> no tables")
-        void latticeWithNoRulingsReturnsEmpty() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"just some prose", "no table here"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> result = parser.parse(doc, new RawPage(1, 0f, 0f, List.of()));
-                assertNotNull(result);
-                assertTrue(
-                        result.isEmpty(), "borderless text must not be detected in lattice mode");
-            }
-        }
-
-        @Test
-        @DisplayName("blank page in lattice mode -> empty list")
-        void blankPageLatticeReturnsEmpty() throws Exception {
-            byte[] pdf = blankPdf();
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                assertTrue(parser.parse(doc, new RawPage(1, 0f, 0f, List.of())).isEmpty());
-            }
-        }
-    }
-
-    // ── stream mode (BasicExtractionAlgorithm) ───────────────────────────────
-
-    @Nested
-    @DisplayName("Stream mode")
-    class StreamMode {
-
-        @Test
-        @DisplayName("page with text yields at least one well-formed fragment")
-        void streamOnTextProducesFragment() throws Exception {
-            byte[] pdf =
-                    pdfWithText(new String[] {"Name Age City", "Alice 30 Paris", "Bob 25 Rome"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> fragments =
-                        parser.parseStream(doc, new RawPage(1, 0f, 0f, List.of()));
-                assertNotNull(fragments);
-                assertFalse(fragments.isEmpty(), "stream mode always builds a table from text");
-                assertFragmentWellFormed(fragments.get(0), 1, 0);
-            }
-        }
-
-        @Test
-        @DisplayName("fragment ids encode page and index")
-        void streamFragmentIdFormat() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"col1 col2", "a b"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> fragments =
-                        parser.parseStream(doc, new RawPage(1, 0f, 0f, List.of()));
-                assertFalse(fragments.isEmpty());
-                assertEquals("tbl-p1-0", fragments.get(0).tableId());
-                assertEquals(1, fragments.get(0).pageNumber());
-            }
-        }
-
-        @Test
-        @DisplayName("rawRows and the parsed rows stay in lockstep")
-        void streamRowsMatchRawRows() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"x y", "1 2", "3 4"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> fragments =
-                        parser.parseStream(doc, new RawPage(1, 0f, 0f, List.of()));
-                assertFalse(fragments.isEmpty());
-                TableFragment f = fragments.get(0);
-                assertEquals(f.rawRows().size(), f.rows().size());
-            }
-        }
-    }
-
-    // ── lattice mode with a real bordered grid ───────────────────────────────
-
-    @Nested
-    @DisplayName("Lattice mode")
-    class LatticeMode {
-
-        @Test
-        @DisplayName("bordered grid is detected and produces well-formed fragments")
-        void latticeDetectsBorderedTable() throws Exception {
-            byte[] pdf = pdfWithGrid();
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> fragments =
-                        parser.parse(doc, new RawPage(1, 0f, 0f, List.of()));
-                assertNotNull(fragments);
-                assertFalse(
-                        fragments.isEmpty(), "a clean ruled grid must be detected in lattice mode");
-                TableFragment f = fragments.get(0);
-                assertFragmentWellFormed(f, 1, 0);
-                assertTrue(f.columnCount() >= 1, "a detected grid must have at least one column");
-                assertFalse(f.rawRows().isEmpty(), "a detected grid must have rows");
-            }
-        }
-
-        @Test
-        @DisplayName("convenience overload with page number routes to lattice mode")
-        void parseByPageNumberDetectsGrid() throws Exception {
-            byte[] pdf = pdfWithGrid();
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> fragments = parser.parse(doc, 1);
-                assertNotNull(fragments);
-                assertFalse(fragments.isEmpty());
-                assertEquals(1, fragments.get(0).pageNumber());
-            }
-        }
-
-        @Test
-        @DisplayName("cell text is normalised (trimmed, newlines collapsed)")
-        void latticeCellTextIsNormalised() throws Exception {
-            byte[] pdf = pdfWithGrid();
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                List<TableFragment> fragments =
-                        parser.parse(doc, new RawPage(1, 0f, 0f, List.of()));
-                assertFalse(fragments.isEmpty());
-                for (List<String> row : fragments.get(0).rawRows()) {
-                    for (String cell : row) {
-                        assertNotNull(cell);
-                        assertFalse(cell.contains("\n"), "newlines must be collapsed");
-                        assertFalse(cell.contains("\r"), "carriage returns must be collapsed");
-                        assertEquals(cell.trim(), cell, "cell text must be trimmed");
-                    }
-                }
-            }
-        }
-    }
-
-    // ── contract invariants ──────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("Contract invariants")
-    class ContractInvariants {
-
-        @Test
-        @DisplayName("parse never returns null")
-        void parseNeverReturnsNull() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"abc"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                assertNotNull(parser.parse(doc, new RawPage(1, 0f, 0f, List.of())));
-                assertNotNull(parser.parse(doc, 1));
-                assertNotNull(parser.parseStream(doc, new RawPage(1, 0f, 0f, List.of())));
-            }
-        }
-
-        @Test
-        @DisplayName("the document is not closed by the parser")
-        void documentRemainsOpenAfterParse() throws Exception {
-            byte[] pdf = pdfWithText(new String[] {"keep me open"});
-            try (PDDocument doc = Loader.loadPDF(pdf)) {
-                parser.parse(doc, new RawPage(1, 0f, 0f, List.of()));
-                parser.parseStream(doc, new RawPage(1, 0f, 0f, List.of()));
-                // ObjectExtractor.close() would close the underlying COSDocument; the parser must
-                // not.
-                assertFalse(
-                        doc.getDocument().isClosed(),
-                        "parser must not close the caller's document");
-                assertEquals(1, doc.getNumberOfPages());
-            }
-        }
-    }
-
-    // ── helpers ──────────────────────────────────────────────────────────────
-
-    /** Asserts every field of a fragment satisfies the documented contract. */
-    private static void assertFragmentWellFormed(
-            TableFragment f, int expectedPage, int expectedIndex) {
-        assertNotNull(f);
-        assertEquals(expectedPage, f.pageNumber());
-        assertEquals("tbl-p" + expectedPage + "-" + expectedIndex, f.tableId());
-        assertNotNull(f.bounds());
-        assertNotNull(f.headers());
-        assertTrue(f.headers().isEmpty(), "headers are deferred to v2 and must be empty");
-        assertNotNull(f.rows());
-        assertNotNull(f.rawRows());
-        assertNotNull(f.warnings());
-        assertSame(null, f.continuedFromPage(), "continuedFromPage is deferred to v2");
-        assertTrue(f.columnCount() >= 0);
-        assertTrue(f.confidence() >= 0f && f.confidence() <= 1f, "confidence must be within [0,1]");
-        assertEquals(f.rawRows().size(), f.rows().size());
-
-        for (TableRow row : f.rows()) {
-            assertNotNull(row.cells());
-            for (TableCell cell : row.cells()) {
-                assertNotNull(cell.text());
-                assertNotNull(cell.bounds());
-                assertEquals(1, cell.colSpan(), "colSpan is always 1 in v1");
-                assertEquals(1, cell.rowSpan(), "rowSpan is always 1 in v1");
-            }
-        }
-    }
-
-    private static byte[] pdfWithText(String[] lines) throws Exception {
-        try (PDDocument doc = new PDDocument()) {
-            PDPage page = new PDPage(PDRectangle.A4);
-            doc.addPage(page);
-            try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), 12);
-                cs.setNonStrokingColor(Color.BLACK);
-                float y = 720f;
-                for (String line : lines) {
-                    cs.beginText();
-                    cs.newLineAtOffset(72f, y);
-                    cs.showText(line);
-                    cs.endText();
-                    y -= 20f;
-                }
-            }
-            return save(doc);
-        }
-    }
-
-    private static byte[] blankPdf() throws Exception {
-        try (PDDocument doc = new PDDocument()) {
-            doc.addPage(new PDPage(PDRectangle.A4));
-            return save(doc);
-        }
-    }
-
-    /**
-     * Builds a small 3-row x 3-column ruled grid with text in each cell. The ruled lines make the
-     * table detectable by lattice mode.
-     */
-    private static byte[] pdfWithGrid() throws Exception {
-        try (PDDocument doc = new PDDocument()) {
-            PDPage page = new PDPage(PDRectangle.A4);
-            doc.addPage(page);
-
-            float left = 100f;
-            float right = 400f;
-            float top = 700f;
-            float bottom = 550f;
-            int cols = 3;
-            int rows = 3;
-            float colStep = (right - left) / cols;
-            float rowStep = (top - bottom) / rows;
-
-            try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                cs.setStrokingColor(Color.BLACK);
-                cs.setLineWidth(1f);
-
-                // vertical lines
-                for (int c = 0; c <= cols; c++) {
-                    float x = left + c * colStep;
-                    cs.moveTo(x, bottom);
-                    cs.lineTo(x, top);
-                }
-                // horizontal lines
-                for (int r = 0; r <= rows; r++) {
-                    float yLine = bottom + r * rowStep;
-                    cs.moveTo(left, yLine);
-                    cs.lineTo(right, yLine);
-                }
-                cs.stroke();
-
-                // cell text
-                cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), 10);
-                cs.setNonStrokingColor(Color.BLACK);
-                for (int r = 0; r < rows; r++) {
-                    for (int c = 0; c < cols; c++) {
-                        cs.beginText();
-                        cs.newLineAtOffset(left + c * colStep + 5f, top - (r + 1) * rowStep + 6f);
-                        cs.showText("R" + r + "C" + c);
-                        cs.endText();
-                    }
-                }
-            }
-            return save(doc);
-        }
-    }
-
-    private static byte[] save(PDDocument doc) throws Exception {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        doc.save(baos);
-        return baos.toByteArray();
-    }
-}

app/common/src/test/java/stirling/software/common/cluster/inprocess/InProcessDistributedLockTest.java

@@ -24,9 +24,7 @@ class InProcessDistributedLockTest {
     }
 
     @Test
-    void reentryFromSameThreadFails_parityWithValkey() {
-        // The Valkey impl refuses reentry (SET NX semantics); the in-process impl must match,
-        // otherwise code working in single-instance silently breaks in cluster mode.
+    void reentryFromSameThreadFails() {
         DistributedLock lock = new InProcessDistributedLock();
         DistributedLock.LockHandle h1 = lock.tryAcquire("k", Duration.ofSeconds(30)).orElseThrow();
         Optional<DistributedLock.LockHandle> reentry = lock.tryAcquire("k", Duration.ofSeconds(30));

app/common/src/test/java/stirling/software/common/cluster/inprocess/LocalDiskFileStoreTest.java

@@ -3,13 +3,11 @@ package stirling.software.common.cluster.inprocess;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.nio.file.Files;
 import java.nio.file.Path;
 
 import org.junit.jupiter.api.Test;
@@ -41,46 +39,4 @@ class LocalDiskFileStoreTest {
         assertThrows(IllegalArgumentException.class, () -> store.resolve("a/b"));
         assertThrows(IllegalArgumentException.class, () -> store.resolve("a\\b"));
     }
-
-    @Test
-    void ownerSidecarCannotBeReadAsFileId(@TempDir Path dir) throws IOException {
-        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
-        FileStore.Stored stored =
-                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", "alice");
-        String sidecarId = stored.fileId() + ".owner";
-        assertThrows(IllegalArgumentException.class, () -> store.resolve(sidecarId));
-        assertThrows(IllegalArgumentException.class, () -> store.retrieveBytes(sidecarId));
-    }
-
-    @Test
-    void ownerIsPersistedAndReturnedByGetOwner(@TempDir Path dir) throws IOException {
-        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
-        FileStore.Stored stored =
-                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", "alice");
-        assertEquals("alice", store.getOwner(stored.fileId()));
-    }
-
-    @Test
-    void getOwnerReturnsNullWhenNoOwnerWasRecorded(@TempDir Path dir) throws IOException {
-        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
-        FileStore.Stored stored =
-                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", null);
-        assertNull(store.getOwner(stored.fileId()));
-    }
-
-    @Test
-    void getOwnerReturnsNullForUnknownFileId(@TempDir Path dir) throws IOException {
-        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
-        assertNull(store.getOwner("00000000-0000-0000-0000-000000000000"));
-    }
-
-    @Test
-    void deleteRemovesOwnerSidecar(@TempDir Path dir) throws IOException {
-        LocalDiskFileStore store = new LocalDiskFileStore(dir.toString());
-        FileStore.Stored stored =
-                store.store(new ByteArrayInputStream("hi".getBytes()), "f.bin", "alice");
-        assertTrue(store.delete(stored.fileId()));
-        assertFalse(Files.exists(dir.resolve(stored.fileId() + ".owner")));
-        assertNull(store.getOwner(stored.fileId()));
-    }
 }

app/common/src/test/java/stirling/software/common/configuration/ConfigInitializerTest.java

@@ -1,95 +0,0 @@
-package stirling.software.common.configuration;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import org.junit.jupiter.api.Test;
-import org.snakeyaml.engine.v2.api.LoadSettings;
-
-import stirling.software.common.util.YamlHelper;
-
-class ConfigInitializerTest {
-
-    private static final LoadSettings LOAD_SETTINGS =
-            LoadSettings.builder()
-                    .setUseMarks(true)
-                    .setMaxAliasesForCollections(Integer.MAX_VALUE)
-                    .setAllowRecursiveKeys(true)
-                    .setParseComments(true)
-                    .build();
-
-    // Mirrors the proFeatures block of settings.yml.template after the camelCase rename.
-    private static final String CAMEL_CASE_TEMPLATE =
-            """
-            premium:
-              proFeatures:
-                ssoAutoLogin: false
-                customMetadata:
-                  autoUpdateMetadata: false
-                  author: username
-                  creator: Stirling-PDF
-                  producer: Stirling-PDF
-            """;
-
-    @Test
-    void migrateProFeaturesKeyCasing_carriesForwardLegacyPascalCaseValues() {
-        // An existing install whose settings.yml still uses the old PascalCase keys.
-        String legacy =
-                """
-                premium:
-                  proFeatures:
-                    SSOAutoLogin: true
-                    CustomMetadata:
-                      autoUpdateMetadata: true
-                      author: alice
-                      creator: bob
-                      producer: carol
-                """;
-        YamlHelper template = new YamlHelper(LOAD_SETTINGS, CAMEL_CASE_TEMPLATE);
-        YamlHelper existing = new YamlHelper(LOAD_SETTINGS, legacy);
-
-        new ConfigInitializer().migrateProFeaturesKeyCasing(existing, template);
-
-        assertEquals(
-                "true", template.getValueByExactKeyPath("premium", "proFeatures", "ssoAutoLogin"));
-        assertEquals(
-                "true",
-                template.getValueByExactKeyPath(
-                        "premium", "proFeatures", "customMetadata", "autoUpdateMetadata"));
-        assertEquals(
-                "alice",
-                template.getValueByExactKeyPath(
-                        "premium", "proFeatures", "customMetadata", "author"));
-        assertEquals(
-                "bob",
-                template.getValueByExactKeyPath(
-                        "premium", "proFeatures", "customMetadata", "creator"));
-        assertEquals(
-                "carol",
-                template.getValueByExactKeyPath(
-                        "premium", "proFeatures", "customMetadata", "producer"));
-    }
-
-    @Test
-    void migrateProFeaturesKeyCasing_withoutLegacyKeys_keepsTemplateDefaults() {
-        // No PascalCase keys present -> this migration step must be a no-op.
-        String alreadyCamel =
-                """
-                premium:
-                  proFeatures:
-                    ssoAutoLogin: true
-                    customMetadata:
-                      author: dave
-                """;
-        YamlHelper template = new YamlHelper(LOAD_SETTINGS, CAMEL_CASE_TEMPLATE);
-        YamlHelper existing = new YamlHelper(LOAD_SETTINGS, alreadyCamel);
-
-        new ConfigInitializer().migrateProFeaturesKeyCasing(existing, template);
-
-        assertEquals(
-                "false", template.getValueByExactKeyPath("premium", "proFeatures", "ssoAutoLogin"));
-        assertEquals(
-                "username",
-                template.getValueByExactKeyPath(
-                        "premium", "proFeatures", "customMetadata", "author"));
-    }
-}

app/common/src/test/java/stirling/software/common/configuration/RuntimePathConfigTest.java

@@ -1,520 +0,0 @@
-package stirling.software.common.configuration;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.CustomPaths.Operations;
-import stirling.software.common.model.ApplicationProperties.CustomPaths.Pipeline;
-import stirling.software.common.model.ApplicationProperties.ProcessExecutor.UnoServerEndpoint;
-
-/**
- * Unit tests for {@link RuntimePathConfig}. All of the resolution logic lives in the constructor,
- * so each test builds a real {@link ApplicationProperties} (a plain @Data POJO with sensible
- * defaults), constructs the config, and asserts on the exposed getters.
- */
-class RuntimePathConfigTest {
-
-    /** The base path the production code derives from {@link InstallationPathConfig#getPath()}. */
-    private static final String BASE_PATH = InstallationPathConfig.getPath();
-
-    private static ApplicationProperties newProperties() {
-        return new ApplicationProperties();
-    }
-
-    private static RuntimePathConfig build(ApplicationProperties properties) {
-        return new RuntimePathConfig(properties);
-    }
-
-    @Nested
-    @DisplayName("Pipeline directory resolution")
-    class PipelinePaths {
-
-        @Test
-        @DisplayName("Defaults to <basePath>/pipeline and derived sub-folders")
-        void defaultPipelinePaths() {
-            RuntimePathConfig config = build(newProperties());
-
-            String expectedPipeline = Path.of(BASE_PATH, "pipeline").toString();
-            assertEquals(expectedPipeline, config.getPipelinePath());
-            // Watched folders are resolved to an absolute, normalized path by the production code.
-            assertEquals(
-                    Path.of(expectedPipeline, "watchedFolders")
-                            .toAbsolutePath()
-                            .normalize()
-                            .toString(),
-                    config.getPipelineWatchedFoldersPath());
-            assertEquals(
-                    Path.of(expectedPipeline, "finishedFolders").toString(),
-                    config.getPipelineFinishedFoldersPath());
-            assertEquals(
-                    Path.of(expectedPipeline, "defaultWebUIConfigs").toString(),
-                    config.getPipelineDefaultWebUiConfigs());
-        }
-
-        @Test
-        @DisplayName("Custom pipelineDir overrides the default pipeline path")
-        void customPipelineDir() {
-            ApplicationProperties properties = newProperties();
-            Pipeline pipeline = properties.getSystem().getCustomPaths().getPipeline();
-            pipeline.setPipelineDir("/custom/pipeline");
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals("/custom/pipeline", config.getPipelinePath());
-            // Sub-folders are derived from the (already-resolved) custom pipeline path.
-            assertEquals(
-                    Path.of("/custom/pipeline", "finishedFolders").toString(),
-                    config.getPipelineFinishedFoldersPath());
-            assertEquals(
-                    Path.of("/custom/pipeline", "defaultWebUIConfigs").toString(),
-                    config.getPipelineDefaultWebUiConfigs());
-        }
-
-        @Test
-        @DisplayName("Blank pipelineDir falls back to the default")
-        void blankPipelineDirFallsBackToDefault() {
-            ApplicationProperties properties = newProperties();
-            properties.getSystem().getCustomPaths().getPipeline().setPipelineDir("   ");
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals(Path.of(BASE_PATH, "pipeline").toString(), config.getPipelinePath());
-        }
-
-        @Test
-        @DisplayName("Custom finished and webUI configs dirs override defaults")
-        void customFinishedAndWebUiDirs() {
-            ApplicationProperties properties = newProperties();
-            Pipeline pipeline = properties.getSystem().getCustomPaths().getPipeline();
-            pipeline.setFinishedFoldersDir("/custom/finished");
-            pipeline.setWebUIConfigsDir("/custom/webui");
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals("/custom/finished", config.getPipelineFinishedFoldersPath());
-            assertEquals("/custom/webui", config.getPipelineDefaultWebUiConfigs());
-        }
-    }
-
-    @Nested
-    @DisplayName("Watched folder resolution")
-    class WatchedFolders {
-
-        @Test
-        @DisplayName("Default watched folder is <pipeline>/watchedFolders and list has one entry")
-        void defaultWatchedFolder() {
-            RuntimePathConfig config = build(newProperties());
-
-            // Watched folders are resolved to an absolute, normalized path by the production code.
-            String expected =
-                    Path.of(Path.of(BASE_PATH, "pipeline").toString(), "watchedFolders")
-                            .toAbsolutePath()
-                            .normalize()
-                            .toString();
-            assertEquals(expected, config.getPipelineWatchedFoldersPath());
-            assertEquals(1, config.getPipelineWatchedFoldersPaths().size());
-            assertEquals(expected, config.getPipelineWatchedFoldersPaths().get(0));
-        }
-
-        @Test
-        @DisplayName("Legacy single watchedFoldersDir is used when no list is provided")
-        void legacyWatchedFolder() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getPipeline()
-                    .setWatchedFoldersDir("relativeWatched");
-
-            RuntimePathConfig config = build(properties);
-
-            // Legacy paths are normalized to absolute.
-            String expected = Path.of("relativeWatched").toAbsolutePath().normalize().toString();
-            assertEquals(1, config.getPipelineWatchedFoldersPaths().size());
-            assertEquals(expected, config.getPipelineWatchedFoldersPath());
-        }
-
-        @Test
-        @DisplayName("New list config takes precedence over the legacy single dir")
-        void listTakesPrecedenceOverLegacy() {
-            ApplicationProperties properties = newProperties();
-            Pipeline pipeline = properties.getSystem().getCustomPaths().getPipeline();
-            pipeline.setWatchedFoldersDir("legacyDir");
-            pipeline.setWatchedFoldersDirs(new ArrayList<>(Arrays.asList("listDirA", "listDirB")));
-
-            RuntimePathConfig config = build(properties);
-
-            List<String> paths = config.getPipelineWatchedFoldersPaths();
-            assertEquals(2, paths.size());
-            assertEquals(Path.of("listDirA").toAbsolutePath().normalize().toString(), paths.get(0));
-            assertEquals(Path.of("listDirB").toAbsolutePath().normalize().toString(), paths.get(1));
-            // The legacy value must NOT appear when the list is present.
-            assertFalse(
-                    paths.contains(Path.of("legacyDir").toAbsolutePath().normalize().toString()));
-        }
-
-        @Test
-        @DisplayName("Duplicate paths in the list are de-duplicated after normalization")
-        void duplicatePathsAreDeduplicated() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getPipeline()
-                    .setWatchedFoldersDirs(
-                            new ArrayList<>(Arrays.asList("dupDir", "dupDir", "otherDir")));
-
-            RuntimePathConfig config = build(properties);
-
-            List<String> paths = config.getPipelineWatchedFoldersPaths();
-            assertEquals(2, paths.size());
-            assertEquals(Path.of("dupDir").toAbsolutePath().normalize().toString(), paths.get(0));
-            assertEquals(Path.of("otherDir").toAbsolutePath().normalize().toString(), paths.get(1));
-        }
-
-        @Test
-        @DisplayName("Blank and whitespace-only list entries are sanitized out")
-        void blankListEntriesAreFiltered() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getPipeline()
-                    .setWatchedFoldersDirs(
-                            new ArrayList<>(Arrays.asList("  ", "", "validDir", "   ")));
-
-            RuntimePathConfig config = build(properties);
-
-            List<String> paths = config.getPipelineWatchedFoldersPaths();
-            assertEquals(1, paths.size());
-            assertEquals(Path.of("validDir").toAbsolutePath().normalize().toString(), paths.get(0));
-        }
-
-        @Test
-        @DisplayName("List entries are trimmed before resolution")
-        void listEntriesAreTrimmed() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getPipeline()
-                    .setWatchedFoldersDirs(new ArrayList<>(Arrays.asList("  spacedDir  ")));
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals(
-                    Path.of("spacedDir").toAbsolutePath().normalize().toString(),
-                    config.getPipelineWatchedFoldersPath());
-        }
-
-        @Test
-        @DisplayName("An all-blank list falls back to the legacy dir, then default")
-        void allBlankListFallsBackToDefault() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getPipeline()
-                    .setWatchedFoldersDirs(new ArrayList<>(Arrays.asList("", "   ")));
-
-            RuntimePathConfig config = build(properties);
-
-            // sanitizePathList strips everything -> empty -> falls through to default watched
-            // folder.
-            // The default is also resolved to an absolute, normalized path by the production code.
-            String expectedDefault =
-                    Path.of(Path.of(BASE_PATH, "pipeline").toString(), "watchedFolders")
-                            .toAbsolutePath()
-                            .normalize()
-                            .toString();
-            assertEquals(1, config.getPipelineWatchedFoldersPaths().size());
-            assertEquals(expectedDefault, config.getPipelineWatchedFoldersPath());
-        }
-
-        @Test
-        @DisplayName("First watched folder path is always exposed via the singular getter")
-        void singularGetterReturnsFirstEntry() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getPipeline()
-                    .setWatchedFoldersDirs(new ArrayList<>(Arrays.asList("firstDir", "secondDir")));
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals(
-                    config.getPipelineWatchedFoldersPaths().get(0),
-                    config.getPipelineWatchedFoldersPath());
-            assertEquals(
-                    Path.of("firstDir").toAbsolutePath().normalize().toString(),
-                    config.getPipelineWatchedFoldersPath());
-        }
-    }
-
-    @Nested
-    @DisplayName("Operation tool path resolution")
-    class OperationPaths {
-
-        @Test
-        @DisplayName("Defaults to bare command names when not running in Docker")
-        void defaultOperationPaths() {
-            // The test host has no /.dockerenv, so the non-docker defaults apply.
-            RuntimePathConfig config = build(newProperties());
-
-            assertEquals("weasyprint", config.getWeasyPrintPath());
-            assertEquals("unoconvert", config.getUnoConvertPath());
-            assertEquals("ebook-convert", config.getCalibrePath());
-            assertEquals("ocrmypdf", config.getOcrMyPdfPath());
-            assertEquals("soffice", config.getSOfficePath());
-        }
-
-        @Test
-        @DisplayName("Custom operation paths override the defaults")
-        void customOperationPaths() {
-            ApplicationProperties properties = newProperties();
-            Operations operations = properties.getSystem().getCustomPaths().getOperations();
-            operations.setWeasyprint("/opt/custom/weasyprint");
-            operations.setUnoconvert("/opt/custom/unoconvert");
-            operations.setCalibre("/opt/custom/ebook-convert");
-            operations.setOcrmypdf("/opt/custom/ocrmypdf");
-            operations.setSoffice("/opt/custom/soffice");
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals("/opt/custom/weasyprint", config.getWeasyPrintPath());
-            assertEquals("/opt/custom/unoconvert", config.getUnoConvertPath());
-            assertEquals("/opt/custom/ebook-convert", config.getCalibrePath());
-            assertEquals("/opt/custom/ocrmypdf", config.getOcrMyPdfPath());
-            assertEquals("/opt/custom/soffice", config.getSOfficePath());
-        }
-
-        @Test
-        @DisplayName("Blank custom operation path falls back to the default")
-        void blankOperationPathFallsBack() {
-            ApplicationProperties properties = newProperties();
-            properties.getSystem().getCustomPaths().getOperations().setWeasyprint("   ");
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals("weasyprint", config.getWeasyPrintPath());
-        }
-
-        @Test
-        @DisplayName("A single custom path leaves the other operation paths at defaults")
-        void partialOperationOverride() {
-            ApplicationProperties properties = newProperties();
-            properties
-                    .getSystem()
-                    .getCustomPaths()
-                    .getOperations()
-                    .setSoffice("/usr/local/soffice");
-
-            RuntimePathConfig config = build(properties);
-
-            assertEquals("/usr/local/soffice", config.getSOfficePath());
-            assertEquals("weasyprint", config.getWeasyPrintPath());
-            assertEquals("unoconvert", config.getUnoConvertPath());
-        }
-    }
-
-    @Nested
-    @DisplayName("Tesseract data path resolution")
-    class TessdataPath {
-
-        @Test
-        @DisplayName("Explicit tessdataDir config wins over env var and default")
-        void configuredTessdataDirWins() {
-            ApplicationProperties properties = newProperties();
-            properties.getSystem().setTessdataDir("/my/tessdata");
-
-            RuntimePathConfig config = build(properties);
-
-            // Config setting has the highest priority regardless of TESSDATA_PREFIX env state.
-            assertEquals("/my/tessdata", config.getTessDataPath());
-        }
-
-        @Test
-        @DisplayName("tessDataPath is never null even with no config")
-        void tessDataPathNeverNull() {
-            RuntimePathConfig config = build(newProperties());
-
-            // With no config setting, the value comes from TESSDATA_PREFIX or the hard default,
-            // either of which is non-null.
-            assertNotNull(config.getTessDataPath());
-            assertFalse(config.getTessDataPath().isEmpty());
-        }
-    }
-
-    @Nested
-    @DisplayName("UNO server endpoint resolution")
-    class UnoServerEndpoints {
-
-        @Test
-        @DisplayName("Auto mode builds one endpoint when session limit is unset (defaults to 1)")
-        void autoSingleEndpointByDefault() {
-            // Default ApplicationProperties: autoUnoServer = true, libreOfficeSessionLimit = 0 ->
-            // 1.
-            RuntimePathConfig config = build(newProperties());
-
-            List<UnoServerEndpoint> endpoints = config.getUnoServerEndpoints();
-            assertEquals(1, endpoints.size());
-            assertEquals("127.0.0.1", endpoints.get(0).getHost());
-            assertEquals(2003, endpoints.get(0).getPort());
-        }
-
-        @Test
-        @DisplayName("Auto mode builds N endpoints on consecutive even ports")
-        void autoMultipleEndpoints() {
-            ApplicationProperties properties = newProperties();
-            properties.getProcessExecutor().getSessionLimit().setLibreOfficeSessionLimit(3);
-
-            RuntimePathConfig config = build(properties);
-
-            List<UnoServerEndpoint> endpoints = config.getUnoServerEndpoints();
-            assertEquals(3, endpoints.size());
-            assertEquals(2003, endpoints.get(0).getPort());
-            assertEquals(2005, endpoints.get(1).getPort());
-            assertEquals(2007, endpoints.get(2).getPort());
-            for (UnoServerEndpoint endpoint : endpoints) {
-                assertEquals("127.0.0.1", endpoint.getHost());
-            }
-        }
-
-        @Test
-        @DisplayName("Manual mode returns the configured (valid) endpoints")
-        void manualEndpointsAreUsed() {
-            ApplicationProperties properties = newProperties();
-            ApplicationProperties.ProcessExecutor processExecutor = properties.getProcessExecutor();
-            processExecutor.setAutoUnoServer(false);
-
-            UnoServerEndpoint endpoint = new UnoServerEndpoint();
-            endpoint.setHost("10.0.0.5");
-            endpoint.setPort(4000);
-            processExecutor.setUnoServerEndpoints(new ArrayList<>(Arrays.asList(endpoint)));
-
-            RuntimePathConfig config = build(properties);
-
-            List<UnoServerEndpoint> endpoints = config.getUnoServerEndpoints();
-            assertEquals(1, endpoints.size());
-            assertEquals("10.0.0.5", endpoints.get(0).getHost());
-            assertEquals(4000, endpoints.get(0).getPort());
-        }
-
-        @Test
-        @DisplayName("Manual mode filters out endpoints with blank host or non-positive port")
-        void manualEndpointsAreSanitized() {
-            ApplicationProperties properties = newProperties();
-            ApplicationProperties.ProcessExecutor processExecutor = properties.getProcessExecutor();
-            processExecutor.setAutoUnoServer(false);
-
-            UnoServerEndpoint valid = new UnoServerEndpoint();
-            valid.setHost("192.168.1.10");
-            valid.setPort(5000);
-
-            UnoServerEndpoint blankHost = new UnoServerEndpoint();
-            blankHost.setHost("   ");
-            blankHost.setPort(5001);
-
-            UnoServerEndpoint badPort = new UnoServerEndpoint();
-            badPort.setHost("192.168.1.11");
-            badPort.setPort(0);
-
-            processExecutor.setUnoServerEndpoints(
-                    new ArrayList<>(Arrays.asList(valid, blankHost, badPort)));
-
-            RuntimePathConfig config = build(properties);
-
-            List<UnoServerEndpoint> endpoints = config.getUnoServerEndpoints();
-            assertEquals(1, endpoints.size());
-            assertEquals("192.168.1.10", endpoints.get(0).getHost());
-            assertEquals(5000, endpoints.get(0).getPort());
-        }
-
-        @Test
-        @DisplayName("Manual mode with no usable endpoints falls back to a single default endpoint")
-        void manualModeNoEndpointsFallsBackToDefault() {
-            ApplicationProperties properties = newProperties();
-            ApplicationProperties.ProcessExecutor processExecutor = properties.getProcessExecutor();
-            processExecutor.setAutoUnoServer(false);
-            processExecutor.setUnoServerEndpoints(new ArrayList<>());
-
-            RuntimePathConfig config = build(properties);
-
-            List<UnoServerEndpoint> endpoints = config.getUnoServerEndpoints();
-            assertEquals(1, endpoints.size());
-            assertEquals("127.0.0.1", endpoints.get(0).getHost());
-            assertEquals(2003, endpoints.get(0).getPort());
-        }
-
-        @Test
-        @DisplayName("Null processExecutor defaults to a single UNO endpoint")
-        void nullProcessExecutorDefaultsToSingleEndpoint() {
-            ApplicationProperties properties = newProperties();
-            properties.setProcessExecutor(null);
-
-            RuntimePathConfig config = build(properties);
-
-            List<UnoServerEndpoint> endpoints = config.getUnoServerEndpoints();
-            assertEquals(1, endpoints.size());
-            assertEquals("127.0.0.1", endpoints.get(0).getHost());
-            assertEquals(2003, endpoints.get(0).getPort());
-        }
-    }
-
-    @Nested
-    @DisplayName("General contract")
-    class GeneralContract {
-
-        @Test
-        @DisplayName("getProperties returns the same instance passed to the constructor")
-        void propertiesAccessorReturnsSameInstance() {
-            ApplicationProperties properties = newProperties();
-
-            RuntimePathConfig config = build(properties);
-
-            assertSame(properties, config.getProperties());
-        }
-
-        @Test
-        @DisplayName("basePath matches InstallationPathConfig.getPath()")
-        void basePathMatchesInstallationPath() {
-            RuntimePathConfig config = build(newProperties());
-
-            assertEquals(BASE_PATH, config.getBasePath());
-        }
-
-        @Test
-        @DisplayName("All resolved path getters are non-null")
-        void allPathsNonNull() {
-            RuntimePathConfig config = build(newProperties());
-
-            assertNotNull(config.getPipelinePath());
-            assertNotNull(config.getPipelineWatchedFoldersPath());
-            assertNotNull(config.getPipelineWatchedFoldersPaths());
-            assertNotNull(config.getPipelineFinishedFoldersPath());
-            assertNotNull(config.getPipelineDefaultWebUiConfigs());
-            assertNotNull(config.getWeasyPrintPath());
-            assertNotNull(config.getUnoConvertPath());
-            assertNotNull(config.getCalibrePath());
-            assertNotNull(config.getOcrMyPdfPath());
-            assertNotNull(config.getSOfficePath());
-            assertNotNull(config.getTessDataPath());
-            assertNotNull(config.getUnoServerEndpoints());
-            assertTrue(config.getUnoServerEndpoints().size() >= 1);
-        }
-    }
-}

app/common/src/test/java/stirling/software/common/model/ApplicationPropertiesLogicTest.java

@@ -2,7 +2,7 @@ package stirling.software.common.model;
 
 import static org.junit.jupiter.api.Assertions.*;
 
-import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
@@ -31,33 +31,18 @@ class ApplicationPropertiesLogicTest {
         assertTrue(sys.isAnalyticsEnabled());
     }
 
-    @Test
-    void storageSigning_userListScope_defaultsToOrg_andIsSettable() {
-        // Self-host backward-compat: scope must default to "org" (saas profile pins "team").
-        ApplicationProperties.Storage.Signing signing = new ApplicationProperties.Storage.Signing();
-
-        assertFalse(signing.isEnabled());
-        assertEquals("org", signing.getUserListScope());
-
-        signing.setUserListScope("team");
-        assertEquals("team", signing.getUserListScope());
-
-        // Reachable from the full tree as storage.signing.userListScope.
-        assertEquals(
-                "org", new ApplicationProperties().getStorage().getSigning().getUserListScope());
-    }
-
     @Test
     void tempFileManagement_defaults_and_overrides() {
-        Function<String, String> normalize = s -> Path.of(s).normalize().toString();
+        Function<String, String> normalize = s -> Paths.get(s).normalize().toString();
         ApplicationProperties.TempFileManagement tfm =
                 new ApplicationProperties.TempFileManagement();
 
         String expectedBase =
-                Path.of(java.lang.System.getProperty("java.io.tmpdir"), "stirling-pdf").toString();
+                Paths.get(java.lang.System.getProperty("java.io.tmpdir"), "stirling-pdf")
+                        .toString();
         assertEquals(expectedBase, tfm.getBaseTmpDir());
 
-        String expectedLibre = Path.of(expectedBase, "libreoffice").toString();
+        String expectedLibre = Paths.get(expectedBase, "libreoffice").toString();
         assertEquals(expectedLibre, tfm.getLibreofficeDir());
 
         tfm.setBaseTmpDir("/custom/base");

app/common/src/test/java/stirling/software/common/pdf/PdfMarkdownConverterTest.java

@@ -1,269 +0,0 @@
-package stirling.software.common.pdf;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.junit.jupiter.api.Assertions.fail;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.junit.jupiter.api.Disabled;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.Arguments;
-import org.junit.jupiter.params.provider.MethodSource;
-
-import stirling.software.jpdfium.PdfDocument;
-import stirling.software.jpdfium.text.TextLine;
-import stirling.software.jpdfium.text.TextWord;
-
-/**
- * Accuracy and robustness tests for {@link PdfMarkdownConverter}, comparing conversion output
- * against hand-authored golden Markdown for a set of owned/synthetic fixtures.
- *
- * <p>The {@link #gatedFixtures()} set is enforced in CI: those fixtures currently convert within
- * the accuracy threshold and guard against regressions. Fixtures still being iterated on live in
- * {@link #wipFixtures()} under a {@link Disabled} test so the goldens stay in the tree without
- * breaking the build. Enable the WIP test locally to see per-fixture scores while working on the
- * converter.
- */
-class PdfMarkdownConverterTest {
-
-    /** Accuracy threshold: output must share at least this fraction of content with the golden. */
-    private static final double THRESHOLD = 0.95;
-
-    @TempDir Path tmp;
-
-    /** Fixtures that meet the accuracy threshold today and therefore gate CI. */
-    static Stream<Arguments> gatedFixtures() {
-        return Stream.of(
-                Arguments.of("multi-column-test_lorem.pdf", "multi-column-test_lorem.md"),
-                Arguments.of("bordered-table-test_widget.pdf", "bordered-table-test_widget.md"),
-                Arguments.of("many-tables-test_stress.pdf", "many-tables-test_stress.md"));
-    }
-
-    /** Fixtures still below the threshold; tracked here, enable locally to iterate. */
-    static Stream<Arguments> wipFixtures() {
-        return Stream.of(
-                Arguments.of(
-                        "wrapped-cell-test_expense-report.pdf",
-                        "wrapped-cell-test_expense-report.md"));
-    }
-
-    @ParameterizedTest(name = "{0}")
-    @MethodSource("gatedFixtures")
-    void convertMatchesGoldenMarkdown(String pdfName, String mdName) throws IOException {
-        assertConversionMatchesGolden(pdfName, mdName);
-    }
-
-    @Disabled("WIP fixtures below the accuracy threshold; enable locally to iterate")
-    @ParameterizedTest(name = "{0}")
-    @MethodSource("wipFixtures")
-    void convertMatchesGoldenMarkdownWip(String pdfName, String mdName) throws IOException {
-        assertConversionMatchesGolden(pdfName, mdName);
-    }
-
-    /**
-     * Degenerate/extreme geometry must not crash the converter. A crafted or malformed PDF can
-     * position text anywhere via a text matrix, so a row's words can span from near the origin to a
-     * coordinate beyond {@link Integer#MAX_VALUE}. The old column-detection code sized an {@code
-     * int[]} straight from {@code (int) Math.ceil(maxX) - lo}, which either allocated a multi-GB
-     * array (OutOfMemoryError) or overflowed to a negative length (NegativeArraySizeException) —
-     * taking down the request thread. Detection must instead bail out and return no columns.
-     */
-    @Test
-    void columnDetectionSurvivesDegenerateGeometry() {
-        // x ≈ 2.5e9 is past Integer.MAX_VALUE; combined with a near-origin word it yields an
-        // implausible span that the pre-fix code turned into a fatal array allocation.
-        List<TextLine> rows = new ArrayList<>();
-        for (int r = 0; r < 4; r++) {
-            float y = 400f - r * 12f;
-            TextWord near = new TextWord(List.of(), 50f, y, 30f, 10f);
-            TextWord far = new TextWord(List.of(), 2_500_000_000f, y, 30f, 10f);
-            rows.add(new TextLine(List.of(near, far), 50f, y, 2_499_999_980f, 10f));
-        }
-
-        List<float[]> columns =
-                assertDoesNotThrow(() -> PdfMarkdownConverter.findColumnRangesFromLines(rows));
-        assertTrue(
-                columns.isEmpty(),
-                "implausible page span should disable column detection, not allocate from it");
-    }
-
-    private void assertConversionMatchesGolden(String pdfName, String mdName) throws IOException {
-        Path pdfPath = tmp.resolve(pdfName);
-        try (InputStream in =
-                getClass().getResourceAsStream("/pdf-ingestion-fixtures/" + pdfName)) {
-            if (in == null) {
-                fail("Fixture not found on classpath: /pdf-ingestion-fixtures/" + pdfName);
-            }
-            Files.copy(in, pdfPath);
-        }
-
-        String actual;
-        try (PdfDocument doc = PdfDocument.open(pdfPath)) {
-            actual = new PdfMarkdownConverter().convert(doc);
-        }
-
-        String expected;
-        try (InputStream in = getClass().getResourceAsStream("/pdf-ingestion-fixtures/" + mdName)) {
-            if (in == null) {
-                fail("Golden file not found on classpath: /pdf-ingestion-fixtures/" + mdName);
-            }
-            expected = new String(in.readAllBytes(), StandardCharsets.UTF_8);
-        }
-
-        // Image placeholders are not scored: their body text is a TODO ("ideally, add the info
-        // available about the image...") rather than real content, so comparing it would penalise
-        // output for matching a placeholder we intend to replace. Drop those lines from both sides.
-        expected = stripImagePlaceholders(expected);
-        actual = stripImagePlaceholders(actual);
-
-        double similarity = similarity(expected, actual);
-        if (similarity < THRESHOLD) {
-            fail(
-                    String.format(
-                            "Markdown output differs from golden file '%s' by %.1f%% (threshold %.0f%%):%n%s",
-                            mdName,
-                            (1.0 - similarity) * 100,
-                            (1.0 - THRESHOLD) * 100,
-                            unifiedDiff(expected, actual)));
-        }
-    }
-
-    /** Substring identifying an image-placeholder line, which is excluded from scoring. */
-    private static final String IMAGE_PLACEHOLDER_MARKER = "Image intentionally redacted";
-
-    /**
-     * Removes non-content lines from the comparison: image placeholders (TODO text we intend to
-     * replace) and GFM table separator rows (the {@code |---|---|} divider, whose exact dash count
-     * is cosmetic — any run of three or more dashes is valid Markdown).
-     */
-    private static String stripImagePlaceholders(String md) {
-        StringBuilder sb = new StringBuilder();
-        for (String line : md.split("\n", -1)) {
-            if (line.contains(IMAGE_PLACEHOLDER_MARKER)
-                    || line.strip().startsWith("<image redacted")
-                    || isTableSeparatorRow(line)) {
-                continue;
-            }
-            if (sb.length() > 0) {
-                sb.append('\n');
-            }
-            sb.append(line);
-        }
-        return sb.toString();
-    }
-
-    /** True for a GFM table separator row, e.g. {@code |---|:--:|---|} (only |, -, :, space). */
-    private static boolean isTableSeparatorRow(String line) {
-        String t = line.strip();
-        if (!t.contains("-")) {
-            return false;
-        }
-        return t.chars().allMatch(c -> c == '|' || c == '-' || c == ':' || c == ' ');
-    }
-
-    /**
-     * Character-level similarity: proportion of expected characters that appear in the LCS. O(n*m)
-     * but golden files are small enough that this is fine.
-     */
-    private static double similarity(String expected, String actual) {
-        if (expected.isEmpty() && actual.isEmpty()) return 1.0;
-        if (expected.isEmpty() || actual.isEmpty()) return 0.0;
-        // Strip all whitespace for a content-focused comparison
-        String e = expected.replaceAll("\\s+", " ").strip();
-        String a = actual.replaceAll("\\s+", " ").strip();
-        int lcs = lcsLength(e, a);
-        return (double) lcs / Math.max(e.length(), a.length());
-    }
-
-    private static int lcsLength(String a, String b) {
-        // Use two-row DP to keep memory reasonable
-        int m = a.length(), n = b.length();
-        int[] prev = new int[n + 1];
-        int[] curr = new int[n + 1];
-        for (int i = 1; i <= m; i++) {
-            for (int j = 1; j <= n; j++) {
-                if (a.charAt(i - 1) == b.charAt(j - 1)) {
-                    curr[j] = prev[j - 1] + 1;
-                } else {
-                    curr[j] = Math.max(curr[j - 1], prev[j]);
-                }
-            }
-            int[] tmp = prev;
-            prev = curr;
-            curr = tmp;
-            java.util.Arrays.fill(curr, 0);
-        }
-        return prev[n];
-    }
-
-    private static String unifiedDiff(String expected, String actual) {
-        String[] expectedLines = expected.split("\n", -1);
-        String[] actualLines = actual.split("\n", -1);
-
-        List<String> diff = new ArrayList<>();
-        diff.add("--- expected");
-        diff.add("+++ actual");
-
-        int maxLines = Math.max(expectedLines.length, actualLines.length);
-        int context = 3;
-        boolean inHunk = false;
-        int hunkStart = -1;
-        List<String> hunkLines = new ArrayList<>();
-
-        for (int i = 0; i < maxLines; i++) {
-            String exp = i < expectedLines.length ? expectedLines[i] : null;
-            String act = i < actualLines.length ? actualLines[i] : null;
-
-            boolean changed = exp == null || act == null || !exp.equals(act);
-            if (changed) {
-                if (!inHunk) {
-                    inHunk = true;
-                    hunkStart = Math.max(0, i - context);
-                    // add context lines before change
-                    for (int c = hunkStart; c < i; c++) {
-                        hunkLines.add(" " + (c < expectedLines.length ? expectedLines[c] : ""));
-                    }
-                }
-                if (exp != null) hunkLines.add("-" + exp);
-                if (act != null) hunkLines.add("+" + act);
-            } else {
-                if (inHunk) {
-                    hunkLines.add(" " + exp);
-                    // check if we're far enough past the last change to close the hunk
-                    boolean moreChanges = false;
-                    for (int j = i + 1; j < Math.min(i + context, maxLines); j++) {
-                        String e2 = j < expectedLines.length ? expectedLines[j] : null;
-                        String a2 = j < actualLines.length ? actualLines[j] : null;
-                        if (e2 == null || a2 == null || !e2.equals(a2)) {
-                            moreChanges = true;
-                            break;
-                        }
-                    }
-                    if (!moreChanges && (i - hunkStart) >= context) {
-                        diff.add("@@ -" + (hunkStart + 1) + " @@");
-                        diff.addAll(hunkLines);
-                        hunkLines.clear();
-                        inHunk = false;
-                    }
-                }
-            }
-        }
-
-        if (inHunk && !hunkLines.isEmpty()) {
-            diff.add("@@ -" + (hunkStart + 1) + " @@");
-            diff.addAll(hunkLines);
-        }
-
-        return String.join("\n", diff);
-    }
-}

app/common/src/test/java/stirling/software/common/service/FileStorageDelegationTest.java

@@ -5,7 +5,6 @@ import static org.mockito.Mockito.mock;
 
 import java.io.IOException;
 import java.nio.file.Path;
-import java.util.Optional;
 
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -20,8 +19,7 @@ class FileStorageDelegationTest {
         FileStorage fs =
                 new FileStorage(
                         mock(FileOrUploadService.class),
-                        new LocalDiskFileStore(tempDir.toString()),
-                        Optional.empty());
+                        new LocalDiskFileStore(tempDir.toString()));
         byte[] payload = "round-trip".getBytes();
         String id = fs.storeBytes(payload, "x.bin");
         assertArrayEquals(payload, fs.retrieveBytes(id));

app/common/src/test/java/stirling/software/common/service/FileStorageOwnershipTest.java

@@ -1,107 +0,0 @@
-package stirling.software.common.service;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicReference;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import stirling.software.common.cluster.inprocess.LocalDiskFileStore;
-import stirling.software.common.util.JobContext;
-
-class FileStorageOwnershipTest {
-
-    private FileStorage newStorageWithoutSecurity(Path tempDir) {
-        return new FileStorage(
-                mock(FileOrUploadService.class),
-                new LocalDiskFileStore(tempDir.toString()),
-                Optional.empty());
-    }
-
-    private FileStorage newStorageWithCurrentUser(Path tempDir, AtomicReference<String> userRef) {
-        JobOwnershipService svc = mock(JobOwnershipService.class);
-        when(svc.getCurrentUserId()).thenAnswer(invocation -> Optional.ofNullable(userRef.get()));
-        return new FileStorage(
-                mock(FileOrUploadService.class),
-                new LocalDiskFileStore(tempDir.toString()),
-                Optional.of(svc));
-    }
-
-    @Test
-    void desktopMode_noOwnershipService_storesAndRetrievesWithoutChecks(@TempDir Path tempDir)
-            throws IOException {
-        FileStorage fs = newStorageWithoutSecurity(tempDir);
-        byte[] payload = "desktop".getBytes();
-        String id = fs.storeBytes(payload, "x.bin");
-        assertArrayEquals(payload, fs.retrieveBytes(id));
-    }
-
-    @Test
-    void sameUserStoresAndRetrieves_allowed(@TempDir Path tempDir) throws IOException {
-        AtomicReference<String> user = new AtomicReference<>("alice");
-        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
-        byte[] payload = "alice's file".getBytes();
-        String id = fs.storeBytes(payload, "x.bin");
-        assertArrayEquals(payload, fs.retrieveBytes(id));
-    }
-
-    @Test
-    void differentUserRetrieves_throwsSecurityException(@TempDir Path tempDir) throws IOException {
-        AtomicReference<String> user = new AtomicReference<>("alice");
-        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
-        String id = fs.storeBytes("alice's file".getBytes(), "x.bin");
-        user.set("bob");
-        assertThrows(SecurityException.class, () -> fs.retrieveBytes(id));
-        assertThrows(SecurityException.class, () -> fs.retrieveInputStream(id));
-        assertThrows(SecurityException.class, () -> fs.getFileSize(id));
-        assertThrows(SecurityException.class, () -> fs.fileExists(id));
-        assertThrows(SecurityException.class, () -> fs.deleteFile(id));
-    }
-
-    @Test
-    void anonymousRetrieveOfOwnedFile_allowed_noCurrentUserMeansNoCompare(@TempDir Path tempDir)
-            throws IOException {
-        AtomicReference<String> user = new AtomicReference<>("alice");
-        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
-        byte[] payload = "alice's file".getBytes();
-        String id = fs.storeBytes(payload, "x.bin");
-        user.set(null);
-        assertArrayEquals(payload, fs.retrieveBytes(id));
-    }
-
-    @Test
-    void authedRetrieveOfAnonymousFile_allowed_noOwnerOnFile(@TempDir Path tempDir)
-            throws IOException {
-        AtomicReference<String> user = new AtomicReference<>(null);
-        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
-        byte[] payload = "no-owner".getBytes();
-        String id = fs.storeBytes(payload, "x.bin");
-        user.set("alice");
-        assertArrayEquals(payload, fs.retrieveBytes(id));
-    }
-
-    @Test
-    void propagatedOwner_scopesAsyncWriteWithNoLiveUser(@TempDir Path tempDir) throws IOException {
-        AtomicReference<String> user = new AtomicReference<>(null);
-        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
-        byte[] payload = "alice's async result".getBytes();
-        String id;
-        try {
-            JobContext.setOwner("alice");
-            id = fs.storeBytes(payload, "x.bin");
-        } finally {
-            JobContext.clear();
-        }
-        user.set("alice");
-        assertArrayEquals(payload, fs.retrieveBytes(id));
-        user.set("bob");
-        assertThrows(SecurityException.class, () -> fs.retrieveBytes(id));
-    }
-}

app/common/src/test/java/stirling/software/common/service/FileStorageTest.java

@@ -9,8 +9,6 @@ import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.Optional;
-import java.util.UUID;
 import java.util.stream.Stream;
 
 import org.junit.jupiter.api.BeforeEach;
@@ -39,10 +37,7 @@ class FileStorageTest {
     void setUp() throws IOException {
         MockitoAnnotations.openMocks(this);
         fileStorage =
-                new FileStorage(
-                        fileOrUploadService,
-                        new LocalDiskFileStore(tempDir.toString()),
-                        Optional.empty());
+                new FileStorage(fileOrUploadService, new LocalDiskFileStore(tempDir.toString()));
 
         // Create a mock MultipartFile
         mockFile = mock(MultipartFile.class);
@@ -84,7 +79,7 @@ class FileStorageTest {
     void testRetrieveFile() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = UUID.randomUUID().toString();
+        String fileId = "test-file-1";
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -104,7 +99,7 @@ class FileStorageTest {
     void testRetrieveBytes() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = UUID.randomUUID().toString();
+        String fileId = "test-file-2";
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -118,7 +113,7 @@ class FileStorageTest {
     @Test
     void testRetrieveFile_FileNotFound() {
         // Arrange
-        String nonExistentFileId = UUID.randomUUID().toString();
+        String nonExistentFileId = "non-existent-file";
 
         // Act & Assert
         assertThrows(IOException.class, () -> fileStorage.retrieveFile(nonExistentFileId));
@@ -127,7 +122,7 @@ class FileStorageTest {
     @Test
     void testRetrieveBytes_FileNotFound() {
         // Arrange
-        String nonExistentFileId = UUID.randomUUID().toString();
+        String nonExistentFileId = "non-existent-file";
 
         // Act & Assert
         assertThrows(IOException.class, () -> fileStorage.retrieveBytes(nonExistentFileId));
@@ -137,7 +132,7 @@ class FileStorageTest {
     void testDeleteFile() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = UUID.randomUUID().toString();
+        String fileId = "test-file-3";
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -152,7 +147,7 @@ class FileStorageTest {
     @Test
     void testDeleteFile_FileNotFound() {
         // Arrange
-        String nonExistentFileId = UUID.randomUUID().toString();
+        String nonExistentFileId = "non-existent-file";
 
         // Act
         boolean result = fileStorage.deleteFile(nonExistentFileId);
@@ -165,7 +160,7 @@ class FileStorageTest {
     void testFileExists() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = UUID.randomUUID().toString();
+        String fileId = "test-file-4";
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -179,7 +174,7 @@ class FileStorageTest {
     @Test
     void testFileExists_FileNotFound() {
         // Arrange
-        String nonExistentFileId = UUID.randomUUID().toString();
+        String nonExistentFileId = "non-existent-file";
 
         // Act
         boolean result = fileStorage.fileExists(nonExistentFileId);

app/common/src/test/java/stirling/software/common/service/InternalApiClientTest.java

@@ -59,53 +59,6 @@ class InternalApiClientTest {
                 servletContext, userService, tempFileManager, environment, applicationProperties);
     }
 
-    @Test
-    void postTagsRequestAsAutomation() throws Exception {
-        // Every InternalApiClient.post() caller is a parent automation flow dispatching a child
-        // tool (pipeline executor, AI workflow, policy runner). Tagging the sub-step here means
-        // the saas PaygChargeInterceptor classifies it as BillingCategory.AUTOMATION regardless of
-        // the dispatched controller's @RequiresFeature — so an AI-OCR step inside a policy run
-        // bills as AUTOMATION, not AI. The header value is the literal string "true" because the
-        // interceptor compares case-insensitively-trimmed against that token.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        Path tempPath = Files.createTempFile("internal-api-automation-test", ".tmp");
-        TempFile tempFile = mock(TempFile.class);
-        when(tempFile.getPath()).thenReturn(tempPath);
-        when(tempFile.getFile()).thenReturn(tempPath.toFile());
-        when(tempFileManager.createManagedTempFile("internal-api")).thenReturn(tempFile);
-
-        HttpHeaders[] captured = {null};
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenAnswer(
-                                            inv -> {
-                                                HttpEntity<?> entity = inv.getArgument(0);
-                                                captured[0] = entity.getHeaders();
-                                                return (RequestCallback) req -> {};
-                                            });
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
-                        })) {
-
-            InternalApiClient mockedClient = newClient();
-            mockedClient.post("/api/v1/general/merge-pdfs", body);
-
-            assertNotNull(captured[0]);
-            assertEquals(
-                    "true",
-                    captured[0].getFirst(InternalApiClient.AUTOMATION_HEADER),
-                    "Sub-step dispatch must carry the automation marker header");
-        } finally {
-            Files.deleteIfExists(tempPath);
-        }
-    }
-
     @Test
     void postDoesNotForceContentType() throws Exception {
         MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();

app/common/src/test/java/stirling/software/common/service/MobileScannerServiceTest.java

@@ -1,471 +0,0 @@
-package stirling.software.common.service;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-import org.springframework.mock.web.MockMultipartFile;
-import org.springframework.test.util.ReflectionTestUtils;
-import org.springframework.web.multipart.MultipartFile;
-
-import stirling.software.common.service.MobileScannerService.FileMetadata;
-import stirling.software.common.service.MobileScannerService.SessionInfo;
-
-/**
- * Unit tests for {@link MobileScannerService}. The service stores uploaded files in a temp
- * directory. To keep tests isolated and deterministic, the {@code tempDirectory} field is
- * redirected to a JUnit {@link TempDir} via reflection after construction.
- */
-class MobileScannerServiceTest {
-
-    @TempDir Path tempDir;
-
-    private MobileScannerService service;
-
-    @BeforeEach
-    void setUp() throws IOException {
-        service = new MobileScannerService();
-        // Redirect the service's temp directory to the isolated test temp dir.
-        ReflectionTestUtils.setField(service, "tempDirectory", tempDir);
-    }
-
-    private MultipartFile file(String name, String content) {
-        return new MockMultipartFile(
-                "file", name, "text/plain", content.getBytes(StandardCharsets.UTF_8));
-    }
-
-    private MultipartFile emptyFile(String name) {
-        return new MockMultipartFile("file", name, "text/plain", new byte[0]);
-    }
-
-    @Nested
-    @DisplayName("createSession")
-    class CreateSession {
-
-        @Test
-        @DisplayName("creates a session and returns coherent SessionInfo")
-        void createsSession() {
-            SessionInfo info = service.createSession("abc-123");
-
-            assertNotNull(info);
-            assertEquals("abc-123", info.getSessionId());
-            assertTrue(info.getCreatedAt() > 0);
-            assertEquals(10 * 60 * 1000L, info.getTimeoutMs());
-            assertEquals(info.getCreatedAt() + info.getTimeoutMs(), info.getExpiresAt());
-        }
-
-        @Test
-        @DisplayName("session is retrievable via validateSession after creation")
-        void createdSessionIsValid() {
-            service.createSession("sess1");
-            assertNotNull(service.validateSession("sess1"));
-        }
-
-        @Test
-        @DisplayName("rejects null session ID")
-        void rejectsNull() {
-            assertThrows(IllegalArgumentException.class, () -> service.createSession(null));
-        }
-
-        @Test
-        @DisplayName("rejects blank session ID")
-        void rejectsBlank() {
-            assertThrows(IllegalArgumentException.class, () -> service.createSession("   "));
-        }
-
-        @Test
-        @DisplayName("rejects session ID with invalid characters")
-        void rejectsInvalidChars() {
-            assertThrows(IllegalArgumentException.class, () -> service.createSession("bad/id"));
-            assertThrows(IllegalArgumentException.class, () -> service.createSession("bad id"));
-            assertThrows(IllegalArgumentException.class, () -> service.createSession("bad_id"));
-        }
-
-        @Test
-        @DisplayName("accepts alphanumeric and hyphen session IDs")
-        void acceptsValidChars() {
-            assertNotNull(service.createSession("ABC-def-123"));
-        }
-    }
-
-    @Nested
-    @DisplayName("validateSession")
-    class ValidateSession {
-
-        @Test
-        @DisplayName("returns null for unknown session")
-        void unknownReturnsNull() {
-            assertNull(service.validateSession("does-not-exist"));
-        }
-
-        @Test
-        @DisplayName("returns SessionInfo for an existing session")
-        void existingReturnsInfo() {
-            service.createSession("s1");
-            SessionInfo info = service.validateSession("s1");
-
-            assertNotNull(info);
-            assertEquals("s1", info.getSessionId());
-            assertEquals(10 * 60 * 1000L, info.getTimeoutMs());
-        }
-
-        @Test
-        @DisplayName("expires and removes a session whose last access is in the past")
-        void expiredSessionRemoved() {
-            service.createSession("expired");
-
-            // Force the underlying session's last access far into the past.
-            forceLastAccess("expired", System.currentTimeMillis() - (20 * 60 * 1000L));
-
-            assertNull(service.validateSession("expired"));
-            // After expiry the session should be gone entirely.
-            assertNull(service.validateSession("expired"));
-        }
-    }
-
-    @Nested
-    @DisplayName("uploadFiles")
-    class UploadFiles {
-
-        @Test
-        @DisplayName("stores files and records metadata")
-        void storesFiles() throws IOException {
-            service.createSession("up1");
-            service.uploadFiles("up1", List.of(file("scan.txt", "hello")));
-
-            List<FileMetadata> metas = service.getSessionFiles("up1");
-            assertEquals(1, metas.size());
-            FileMetadata meta = metas.get(0);
-            assertEquals("scan.txt", meta.getFilename());
-            assertEquals(5, meta.getSize());
-            assertEquals("text/plain", meta.getContentType());
-
-            // File physically exists on disk.
-            Path stored = tempDir.resolve("up1").resolve("scan.txt");
-            assertTrue(Files.exists(stored));
-            assertEquals("hello", Files.readString(stored));
-        }
-
-        @Test
-        @DisplayName("auto-creates a session when uploading to an unregistered session ID")
-        void autoCreatesSession() throws IOException {
-            service.uploadFiles("new-session", List.of(file("a.txt", "data")));
-
-            List<FileMetadata> metas = service.getSessionFiles("new-session");
-            assertEquals(1, metas.size());
-        }
-
-        @Test
-        @DisplayName("skips empty files")
-        void skipsEmptyFiles() throws IOException {
-            service.createSession("up2");
-            service.uploadFiles("up2", List.of(emptyFile("empty.txt"), file("real.txt", "x")));
-
-            List<FileMetadata> metas = service.getSessionFiles("up2");
-            assertEquals(1, metas.size());
-            assertEquals("real.txt", metas.get(0).getFilename());
-        }
-
-        @Test
-        @DisplayName("sanitizes dangerous filename characters")
-        void sanitizesFilename() throws IOException {
-            service.createSession("up3");
-            service.uploadFiles("up3", List.of(file("we ird@na#me.txt", "x")));
-
-            List<FileMetadata> metas = service.getSessionFiles("up3");
-            assertEquals(1, metas.size());
-            String stored = metas.get(0).getFilename();
-            // Disallowed chars replaced with underscores; allowed set is [a-zA-Z0-9._-].
-            assertTrue(stored.matches("[a-zA-Z0-9._-]+"), "unexpected filename: " + stored);
-            assertTrue(Files.exists(tempDir.resolve("up3").resolve(stored)));
-        }
-
-        @Test
-        @DisplayName("handles duplicate filenames by appending a counter")
-        void handlesDuplicateFilenames() throws IOException {
-            service.createSession("up4");
-            service.uploadFiles("up4", List.of(file("dup.txt", "one")));
-            service.uploadFiles("up4", List.of(file("dup.txt", "two")));
-
-            List<FileMetadata> metas = service.getSessionFiles("up4");
-            assertEquals(2, metas.size());
-
-            Path original = tempDir.resolve("up4").resolve("dup.txt");
-            Path renamed = tempDir.resolve("up4").resolve("dup-1.txt");
-            assertTrue(Files.exists(original));
-            assertTrue(Files.exists(renamed));
-            assertEquals("one", Files.readString(original));
-            assertEquals("two", Files.readString(renamed));
-        }
-
-        @Test
-        @DisplayName("falls back to a generated name when original filename is null")
-        void generatesNameWhenNull() throws IOException {
-            service.createSession("up5");
-            MultipartFile noName =
-                    new MockMultipartFile("file", null, "text/plain", "x".getBytes());
-            service.uploadFiles("up5", List.of(noName));
-
-            List<FileMetadata> metas = service.getSessionFiles("up5");
-            assertEquals(1, metas.size());
-            assertTrue(metas.get(0).getFilename().startsWith("upload-"));
-        }
-
-        @Test
-        @DisplayName("rejects invalid session ID before any storage")
-        void rejectsInvalidSessionId() {
-            assertThrows(
-                    IllegalArgumentException.class,
-                    () -> service.uploadFiles("bad/id", List.of(file("a.txt", "x"))));
-        }
-
-        @Test
-        @DisplayName("uploading an empty list leaves no files")
-        void emptyListNoFiles() throws IOException {
-            service.createSession("up6");
-            service.uploadFiles("up6", List.of());
-
-            assertTrue(service.getSessionFiles("up6").isEmpty());
-        }
-    }
-
-    @Nested
-    @DisplayName("getSessionFiles")
-    class GetSessionFiles {
-
-        @Test
-        @DisplayName("returns empty list for unknown session")
-        void unknownReturnsEmpty() {
-            assertTrue(service.getSessionFiles("nope").isEmpty());
-        }
-
-        @Test
-        @DisplayName("returns a defensive copy of the metadata list")
-        void returnsDefensiveCopy() throws IOException {
-            service.createSession("g1");
-            service.uploadFiles("g1", List.of(file("a.txt", "x")));
-
-            List<FileMetadata> first = service.getSessionFiles("g1");
-            first.clear();
-
-            // Mutating the returned list must not affect the service's internal state.
-            assertEquals(1, service.getSessionFiles("g1").size());
-        }
-    }
-
-    @Nested
-    @DisplayName("getFile")
-    class GetFile {
-
-        @Test
-        @DisplayName("returns the path of an uploaded file")
-        void returnsPath() throws IOException {
-            service.createSession("f1");
-            service.uploadFiles("f1", List.of(file("doc.txt", "body")));
-
-            Path path = service.getFile("f1", "doc.txt");
-            assertTrue(Files.exists(path));
-            assertEquals("body", Files.readString(path));
-        }
-
-        @Test
-        @DisplayName("throws when the session does not exist")
-        void unknownSessionThrows() {
-            IOException ex =
-                    assertThrows(IOException.class, () -> service.getFile("ghost", "doc.txt"));
-            assertTrue(ex.getMessage().contains("Session not found"));
-        }
-
-        @Test
-        @DisplayName("throws when the file does not exist in an existing session")
-        void unknownFileThrows() throws IOException {
-            service.createSession("f2");
-            service.uploadFiles("f2", List.of(file("present.txt", "x")));
-
-            IOException ex =
-                    assertThrows(IOException.class, () -> service.getFile("f2", "missing.txt"));
-            assertTrue(ex.getMessage().contains("File not found"));
-        }
-
-        @Test
-        @DisplayName("rejects filenames containing path separators")
-        void rejectsPathSeparators() throws IOException {
-            service.createSession("f3");
-            service.uploadFiles("f3", List.of(file("ok.txt", "x")));
-
-            assertThrows(IOException.class, () -> service.getFile("f3", "../escape.txt"));
-            assertThrows(IOException.class, () -> service.getFile("f3", "sub/file.txt"));
-            assertThrows(IOException.class, () -> service.getFile("f3", "sub\\file.txt"));
-        }
-
-        @Test
-        @DisplayName("rejects blank filename")
-        void rejectsBlankFilename() throws IOException {
-            service.createSession("f4");
-            service.uploadFiles("f4", List.of(file("ok.txt", "x")));
-
-            assertThrows(IOException.class, () -> service.getFile("f4", "  "));
-        }
-    }
-
-    @Nested
-    @DisplayName("deleteFileAfterDownload")
-    class DeleteFileAfterDownload {
-
-        @Test
-        @DisplayName("deletes a single file but keeps the session if others remain")
-        void deletesOneFile() throws IOException {
-            service.createSession("d1");
-            service.uploadFiles("d1", List.of(file("a.txt", "x"), file("b.txt", "y")));
-
-            service.deleteFileAfterDownload("d1", "a.txt");
-
-            assertFalse(Files.exists(tempDir.resolve("d1").resolve("a.txt")));
-            // Session still present because not all files have been downloaded.
-            assertNotNull(service.validateSession("d1"));
-        }
-
-        @Test
-        @DisplayName("deletes the entire session once all files are marked downloaded")
-        void deletesSessionWhenAllDownloaded() throws IOException {
-            service.createSession("d2");
-            service.uploadFiles("d2", List.of(file("only.txt", "x")));
-
-            // Mark the file as downloaded via getFile, then delete it.
-            service.getFile("d2", "only.txt");
-            service.deleteFileAfterDownload("d2", "only.txt");
-
-            assertNull(service.validateSession("d2"));
-            assertFalse(Files.exists(tempDir.resolve("d2")));
-        }
-
-        @Test
-        @DisplayName("does not throw for an unknown session")
-        void unknownSessionNoThrow() {
-            assertDoesNotThrow(() -> service.deleteFileAfterDownload("ghost", "a.txt"));
-        }
-
-        @Test
-        @DisplayName("swallows invalid filename input without throwing")
-        void invalidFilenameNoThrow() throws IOException {
-            service.createSession("d3");
-            service.uploadFiles("d3", List.of(file("a.txt", "x")));
-
-            assertDoesNotThrow(() -> service.deleteFileAfterDownload("d3", "../escape.txt"));
-            // Original file untouched.
-            assertTrue(Files.exists(tempDir.resolve("d3").resolve("a.txt")));
-        }
-    }
-
-    @Nested
-    @DisplayName("deleteSession")
-    class DeleteSession {
-
-        @Test
-        @DisplayName("removes the session and all its files")
-        void removesSessionAndFiles() throws IOException {
-            service.createSession("x1");
-            service.uploadFiles("x1", List.of(file("a.txt", "x"), file("b.txt", "y")));
-
-            assertTrue(Files.exists(tempDir.resolve("x1")));
-
-            service.deleteSession("x1");
-
-            assertNull(service.validateSession("x1"));
-            assertFalse(Files.exists(tempDir.resolve("x1")));
-        }
-
-        @Test
-        @DisplayName("is a no-op for an unknown session")
-        void unknownSessionNoOp() {
-            assertDoesNotThrow(() -> service.deleteSession("never-existed"));
-        }
-    }
-
-    @Nested
-    @DisplayName("cleanupExpiredSessions")
-    class CleanupExpiredSessions {
-
-        @Test
-        @DisplayName("removes sessions past the timeout")
-        void removesExpired() throws IOException {
-            service.createSession("old");
-            service.uploadFiles("old", List.of(file("a.txt", "x")));
-            forceLastAccess("old", System.currentTimeMillis() - (20 * 60 * 1000L));
-
-            service.cleanupExpiredSessions();
-
-            assertNull(service.validateSession("old"));
-            assertFalse(Files.exists(tempDir.resolve("old")));
-        }
-
-        @Test
-        @DisplayName("keeps sessions that are still fresh")
-        void keepsFresh() {
-            service.createSession("fresh");
-
-            service.cleanupExpiredSessions();
-
-            assertNotNull(service.validateSession("fresh"));
-        }
-
-        @Test
-        @DisplayName("does not throw when there are no sessions")
-        void noSessionsNoThrow() {
-            assertDoesNotThrow(() -> service.cleanupExpiredSessions());
-        }
-    }
-
-    @Nested
-    @DisplayName("SessionInfo accessors")
-    class SessionInfoAccessors {
-
-        @Test
-        @DisplayName("exposes all constructor values")
-        void exposesValues() {
-            SessionInfo info = new SessionInfo("id", 100L, 200L, 50L);
-            assertEquals("id", info.getSessionId());
-            assertEquals(100L, info.getCreatedAt());
-            assertEquals(200L, info.getExpiresAt());
-            assertEquals(50L, info.getTimeoutMs());
-        }
-    }
-
-    @Nested
-    @DisplayName("FileMetadata accessors")
-    class FileMetadataAccessors {
-
-        @Test
-        @DisplayName("exposes all constructor values")
-        void exposesValues() {
-            FileMetadata meta = new FileMetadata("name.pdf", 1234L, "application/pdf");
-            assertEquals("name.pdf", meta.getFilename());
-            assertEquals(1234L, meta.getSize());
-            assertEquals("application/pdf", meta.getContentType());
-        }
-    }
-
-    /**
-     * Reaches into the internal SessionData for a given session and forces its lastAccessTime, used
-     * to deterministically simulate expiry without sleeping.
-     */
-    @SuppressWarnings("unchecked")
-    private void forceLastAccess(String sessionId, long lastAccessTime) {
-        java.util.Map<String, Object> sessions =
-                (java.util.Map<String, Object>)
-                        ReflectionTestUtils.getField(service, "activeSessions");
-        assertNotNull(sessions);
-        Object sessionData = sessions.get(sessionId);
-        assertNotNull(sessionData, "session not found: " + sessionId);
-        ReflectionTestUtils.setField(sessionData, "lastAccessTime", lastAccessTime);
-    }
-}

app/common/src/test/java/stirling/software/common/service/PdfMetadataServiceTest.java

@@ -1,416 +0,0 @@
-package stirling.software.common.service;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.mockito.Mockito.lenient;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import java.time.LocalDateTime;
-import java.time.ZoneId;
-import java.time.ZonedDateTime;
-import java.util.Calendar;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDDocumentInformation;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.Premium;
-import stirling.software.common.model.ApplicationProperties.Premium.ProFeatures;
-import stirling.software.common.model.ApplicationProperties.Premium.ProFeatures.CustomMetadata;
-import stirling.software.common.model.PdfMetadata;
-
-class PdfMetadataServiceTest {
-
-    private static final String LABEL = "Stirling-PDF v1.0.0";
-
-    /**
-     * Builds a service whose pro-features are disabled (real ApplicationProperties, all defaults).
-     */
-    private PdfMetadataService nonProService(UserServiceInterface userService) {
-        return new PdfMetadataService(new ApplicationProperties(), LABEL, false, userService);
-    }
-
-    @Nested
-    @DisplayName("toCalendar(ZonedDateTime)")
-    class ToCalendarTests {
-
-        @Test
-        @DisplayName("returns null for null input")
-        void nullReturnsNull() {
-            assertNull(PdfMetadataService.toCalendar(null));
-        }
-
-        @Test
-        @DisplayName("converts ZonedDateTime preserving the instant")
-        void convertsInstant() {
-            ZonedDateTime zdt = ZonedDateTime.of(2021, 6, 15, 10, 30, 45, 0, ZoneId.of("UTC"));
-            Calendar cal = PdfMetadataService.toCalendar(zdt);
-
-            assertNotNull(cal);
-            assertEquals(zdt.toInstant().toEpochMilli(), cal.getTimeInMillis());
-        }
-    }
-
-    @Nested
-    @DisplayName("parseToCalendar(String)")
-    class ParseToCalendarTests {
-
-        @Test
-        @DisplayName("returns null for null input")
-        void nullReturnsNull() {
-            assertNull(PdfMetadataService.parseToCalendar(null));
-        }
-
-        @Test
-        @DisplayName("returns null for empty / blank input")
-        void blankReturnsNull() {
-            assertNull(PdfMetadataService.parseToCalendar(""));
-            assertNull(PdfMetadataService.parseToCalendar("   "));
-        }
-
-        @Test
-        @DisplayName("returns null for unparsable input")
-        void invalidReturnsNull() {
-            assertNull(PdfMetadataService.parseToCalendar("not a date"));
-            assertNull(PdfMetadataService.parseToCalendar("2021-06-15"));
-            assertNull(PdfMetadataService.parseToCalendar("2021/13/40 99:99:99"));
-        }
-
-        @Test
-        @DisplayName("parses a valid 'yyyy/MM/dd HH:mm:ss' string")
-        void parsesValidDate() {
-            Calendar cal = PdfMetadataService.parseToCalendar("2021/06/15 10:30:45");
-            assertNotNull(cal);
-
-            // Build the expected instant the same way the implementation does so the
-            // assertion is independent of the JVM's default time zone.
-            long expectedMillis =
-                    LocalDateTime.of(2021, 6, 15, 10, 30, 45)
-                            .atZone(ZoneId.systemDefault())
-                            .toInstant()
-                            .toEpochMilli();
-            assertEquals(expectedMillis, cal.getTimeInMillis());
-        }
-    }
-
-    @Nested
-    @DisplayName("extractMetadataFromPdf(PDDocument)")
-    class ExtractMetadataTests {
-
-        @Test
-        @DisplayName("returns all-null fields for a fresh empty document")
-        void emptyDocumentYieldsNulls() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            try (PDDocument doc = new PDDocument()) {
-                PdfMetadata md = service.extractMetadataFromPdf(doc);
-
-                assertNotNull(md);
-                assertNull(md.getAuthor());
-                assertNull(md.getProducer());
-                assertNull(md.getTitle());
-                assertNull(md.getCreator());
-                assertNull(md.getSubject());
-                assertNull(md.getKeywords());
-                assertNull(md.getCreationDate());
-                assertNull(md.getModificationDate());
-            }
-        }
-
-        @Test
-        @DisplayName("reads back string and date fields set on the document")
-        void readsBackPopulatedFields() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            try (PDDocument doc = new PDDocument()) {
-                PDDocumentInformation info = doc.getDocumentInformation();
-                info.setAuthor("Alice");
-                info.setProducer("ProducerX");
-                info.setTitle("My Title");
-                info.setCreator("CreatorY");
-                info.setSubject("Subject Z");
-                info.setKeywords("k1, k2");
-
-                Calendar creation = Calendar.getInstance();
-                creation.setTimeInMillis(1_600_000_000_000L);
-                Calendar modification = Calendar.getInstance();
-                modification.setTimeInMillis(1_700_000_000_000L);
-                info.setCreationDate(creation);
-                info.setModificationDate(modification);
-
-                PdfMetadata md = service.extractMetadataFromPdf(doc);
-
-                assertEquals("Alice", md.getAuthor());
-                assertEquals("ProducerX", md.getProducer());
-                assertEquals("My Title", md.getTitle());
-                assertEquals("CreatorY", md.getCreator());
-                assertEquals("Subject Z", md.getSubject());
-                assertEquals("k1, k2", md.getKeywords());
-
-                assertNotNull(md.getCreationDate());
-                assertNotNull(md.getModificationDate());
-                assertEquals(1_600_000_000_000L, md.getCreationDate().toInstant().toEpochMilli());
-                assertEquals(
-                        1_700_000_000_000L, md.getModificationDate().toInstant().toEpochMilli());
-            }
-        }
-    }
-
-    @Nested
-    @DisplayName("setMetadataToPdf / setDefaultMetadata (non-pro path)")
-    class SetMetadataNonProTests {
-
-        @Test
-        @DisplayName("writes producer label, title, subject, keywords and author from metadata")
-        void writesCommonMetadata() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            PdfMetadata md =
-                    PdfMetadata.builder()
-                            .author("Bob")
-                            .title("Doc Title")
-                            .subject("Doc Subject")
-                            .keywords("a, b, c")
-                            .creationDate(
-                                    ZonedDateTime.of(2020, 1, 1, 0, 0, 0, 0, ZoneId.of("UTC")))
-                            .modificationDate(
-                                    ZonedDateTime.of(2021, 1, 1, 0, 0, 0, 0, ZoneId.of("UTC")))
-                            .build();
-
-            try (PDDocument doc = new PDDocument()) {
-                doc.addPage(new PDPage());
-                service.setMetadataToPdf(doc, md);
-
-                PDDocumentInformation info = doc.getDocumentInformation();
-                assertEquals(LABEL, info.getProducer());
-                assertEquals("Doc Title", info.getTitle());
-                assertEquals("Doc Subject", info.getSubject());
-                assertEquals("a, b, c", info.getKeywords());
-                // Non-pro: author is taken verbatim from the metadata.
-                assertEquals("Bob", info.getAuthor());
-                assertNotNull(info.getModificationDate());
-            }
-        }
-
-        @Test
-        @DisplayName("existing creation date is left untouched when not newly created")
-        void keepsExistingCreationDate() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            ZonedDateTime creation = ZonedDateTime.of(2019, 5, 20, 8, 15, 0, 0, ZoneId.of("UTC"));
-            PdfMetadata md = PdfMetadata.builder().title("T").creationDate(creation).build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md);
-
-                Calendar creationCal = doc.getDocumentInformation().getCreationDate();
-                // creationDate is non-null and newlyCreated=false, so setNewDocumentMetadata
-                // is skipped and no creation date is written.
-                assertNull(creationCal);
-            }
-        }
-
-        @Test
-        @DisplayName("sets a fresh creation date when metadata has none")
-        void setsCreationDateWhenMissing() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            PdfMetadata md = PdfMetadata.builder().title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md);
-
-                Calendar creationCal = doc.getDocumentInformation().getCreationDate();
-                assertNotNull(creationCal);
-                // Non-pro path writes the Stirling label as the creator.
-                assertEquals(LABEL, doc.getDocumentInformation().getCreator());
-            }
-        }
-
-        @Test
-        @DisplayName("newlyCreated=true forces a fresh creation date even if metadata has one")
-        void newlyCreatedForcesCreationDate() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            ZonedDateTime creation = ZonedDateTime.of(2018, 3, 3, 3, 3, 3, 0, ZoneId.of("UTC"));
-            PdfMetadata md = PdfMetadata.builder().title("T").creationDate(creation).build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                Calendar creationCal = doc.getDocumentInformation().getCreationDate();
-                assertNotNull(creationCal);
-                // The supplied creation date must have been honoured (not "now").
-                assertEquals(creation.toInstant().toEpochMilli(), creationCal.getTimeInMillis());
-                assertEquals(LABEL, doc.getDocumentInformation().getCreator());
-            }
-        }
-
-        @Test
-        @DisplayName(
-                "setDefaultMetadata round-trips existing document info through the producer label")
-        void setDefaultMetadataRewritesProducer() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            try (PDDocument doc = new PDDocument()) {
-                PDDocumentInformation info = doc.getDocumentInformation();
-                info.setTitle("Original Title");
-                info.setAuthor("Original Author");
-                info.setProducer("Some Other Producer");
-
-                service.setDefaultMetadata(doc);
-
-                // extract + re-apply keeps title/author but rewrites producer to the label.
-                assertEquals("Original Title", info.getTitle());
-                assertEquals("Original Author", info.getAuthor());
-                assertEquals(LABEL, info.getProducer());
-            }
-        }
-
-        @Test
-        @DisplayName("null string fields in metadata are written through without error")
-        void handlesNullStringFields() throws Exception {
-            PdfMetadataService service = nonProService(null);
-            PdfMetadata md = PdfMetadata.builder().build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                PDDocumentInformation info = doc.getDocumentInformation();
-                assertEquals(LABEL, info.getProducer());
-                assertNull(info.getTitle());
-                assertNull(info.getSubject());
-                assertNull(info.getKeywords());
-                assertNull(info.getAuthor());
-                // newlyCreated=true always stamps a creation date.
-                assertNotNull(info.getCreationDate());
-                assertNotNull(info.getModificationDate());
-            }
-        }
-    }
-
-    @Nested
-    @DisplayName("setMetadataToPdf (pro path with custom metadata)")
-    class SetMetadataProTests {
-
-        private ApplicationProperties propsWithCustomMetadata(
-                boolean autoUpdate, String author, String creator) {
-            ApplicationProperties props = mock(ApplicationProperties.class);
-            Premium premium = mock(Premium.class);
-            ProFeatures proFeatures = mock(ProFeatures.class);
-            CustomMetadata customMetadata = mock(CustomMetadata.class);
-
-            lenient().when(props.getPremium()).thenReturn(premium);
-            lenient().when(premium.getProFeatures()).thenReturn(proFeatures);
-            lenient().when(proFeatures.getCustomMetadata()).thenReturn(customMetadata);
-            lenient().when(customMetadata.isAutoUpdateMetadata()).thenReturn(autoUpdate);
-            lenient().when(customMetadata.getAuthor()).thenReturn(author);
-            lenient().when(customMetadata.getCreator()).thenReturn(creator);
-            return props;
-        }
-
-        @Test
-        @DisplayName("uses custom author and creator when pro and auto-update enabled")
-        void appliesCustomAuthorAndCreator() throws Exception {
-            ApplicationProperties props =
-                    propsWithCustomMetadata(true, "Custom Author", "Custom Creator");
-            PdfMetadataService service = new PdfMetadataService(props, LABEL, true, null);
-
-            PdfMetadata md = PdfMetadata.builder().author("Ignored").title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                PDDocumentInformation info = doc.getDocumentInformation();
-                assertEquals("Custom Author", info.getAuthor());
-                assertEquals("Custom Creator", info.getCreator());
-                // Producer is set to the label by both setNewDocumentMetadata and
-                // setCommonMetadata.
-                assertEquals(LABEL, info.getProducer());
-            }
-        }
-
-        @Test
-        @DisplayName("replaces 'username' token with the current user when userService present")
-        void replacesUsernameToken() throws Exception {
-            ApplicationProperties props =
-                    propsWithCustomMetadata(true, "Report by username", "Creator");
-            UserServiceInterface userService = mock(UserServiceInterface.class);
-            when(userService.getCurrentUsername()).thenReturn("alice");
-
-            PdfMetadataService service = new PdfMetadataService(props, LABEL, true, userService);
-            PdfMetadata md = PdfMetadata.builder().title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                assertEquals("Report by alice", doc.getDocumentInformation().getAuthor());
-            }
-        }
-
-        @Test
-        @DisplayName("leaves 'username' token intact when current user is null")
-        void keepsTokenWhenUsernameNull() throws Exception {
-            ApplicationProperties props =
-                    propsWithCustomMetadata(true, "Report by username", "Creator");
-            UserServiceInterface userService = mock(UserServiceInterface.class);
-            when(userService.getCurrentUsername()).thenReturn(null);
-
-            PdfMetadataService service = new PdfMetadataService(props, LABEL, true, userService);
-            PdfMetadata md = PdfMetadata.builder().title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                assertEquals("Report by username", doc.getDocumentInformation().getAuthor());
-            }
-        }
-
-        @Test
-        @DisplayName("custom author applied even without a userService")
-        void appliesCustomAuthorWithoutUserService() throws Exception {
-            ApplicationProperties props = propsWithCustomMetadata(true, "Static Author", "Creator");
-            PdfMetadataService service = new PdfMetadataService(props, LABEL, true, null);
-            PdfMetadata md = PdfMetadata.builder().title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                assertEquals("Static Author", doc.getDocumentInformation().getAuthor());
-            }
-        }
-
-        @Test
-        @DisplayName("pro flag without auto-update keeps metadata author and label creator")
-        void proButAutoUpdateDisabledUsesMetadata() throws Exception {
-            ApplicationProperties props =
-                    propsWithCustomMetadata(false, "Custom Author", "Custom Creator");
-            PdfMetadataService service = new PdfMetadataService(props, LABEL, true, null);
-            PdfMetadata md = PdfMetadata.builder().author("Metadata Author").title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                PDDocumentInformation info = doc.getDocumentInformation();
-                assertEquals("Metadata Author", info.getAuthor());
-                assertEquals(LABEL, info.getCreator());
-            }
-        }
-
-        @Test
-        @DisplayName("auto-update enabled but not pro keeps metadata author and label creator")
-        void autoUpdateButNotProUsesMetadata() throws Exception {
-            ApplicationProperties props =
-                    propsWithCustomMetadata(true, "Custom Author", "Custom Creator");
-            PdfMetadataService service = new PdfMetadataService(props, LABEL, false, null);
-            PdfMetadata md = PdfMetadata.builder().author("Metadata Author").title("T").build();
-
-            try (PDDocument doc = new PDDocument()) {
-                service.setMetadataToPdf(doc, md, true);
-
-                PDDocumentInformation info = doc.getDocumentInformation();
-                assertEquals("Metadata Author", info.getAuthor());
-                assertEquals(LABEL, info.getCreator());
-            }
-        }
-    }
-}