fix: use ?? instead of || so empty thumbnail string skips generation

fix: remove unreachable size check inside image branch of generateThumbnailForFile
refactor: consolidate thumbnail rendering onto UIRedesignStaging base
2026-05-05 17:50:09 +01:00 · 2026-05-05 17:49:18 +01:00 · 2026-05-05 17:31:04 +01:00 · 2026-05-05 17:25:31 +01:00 · 2026-05-05 11:54:46 +01:00 · 2026-05-01 18:54:21 +01:00
2232 changed files with 8607 additions and 47805 deletions
@@ -34,8 +34,8 @@ frontend/playwright-report/
 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
-frontend/editor/src-tauri/target/
-frontend/editor/src-tauri/dist/
+frontend/src-tauri/target/
+frontend/src-tauri/dist/

 # IDE and editor
 .idea/
@@ -1,34 +0,0 @@
-###############################################################################
-# Stirling-PDF SaaS local environment template.
-#
-# Copy this file to `.env.saas.local` (gitignored) and fill in real values.
-# Loaded by `task backend:dev:saas` via Taskfile's `dotenv:` directive, then
-# read by Spring Boot's `${...}` placeholders in application-saas.properties
-# and application-dev.properties.
-#
-# DO NOT commit `.env.saas.local`. Only `.env.saas.example` is checked in.
-###############################################################################
-
-# ---------- Supabase project ----------
-# Project reference (the subdomain part of <ref>.supabase.co). Required.
-# Example dev project:
-SAAS_DB_PROJECT_REF=
-
-# Edge function secret used by billing/license rollup calls.
-SUPABASE_EDGE_FUNCTION_SECRET=
-
-# ---------- Database (saas profile) ----------
-# Direct JDBC URL to the Supabase Postgres. Required when running the plain
-# `saas` profile (i.e. without `--spring.profiles.include=dev`).
-# Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
-SAAS_DB_URL=
-SAAS_DB_USERNAME=postgres
-SAAS_DB_PASSWORD=
-
-# ---------- Database (dev profile overrides) ----------
-# Used when `--spring.profiles.include=dev` is active. The dev profile
-# defaults the URL/username to the shared dev Supabase project, but the
-# password must still be provided here.
-SAAS_DEV_DB_URL=
-SAAS_DEV_DB_USERNAME=postgres
-SAAS_DEV_DB_PASSWORD=
@@ -22,7 +22,7 @@ runs:
  steps:
    - name: Generate a GitHub App Token
      id: generate-token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
      with:
        app-id: ${{ inputs.app-id }}
        private-key: ${{ inputs.private-key }}
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.11.0
+pkgver=2.10.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.11.0
+pkgver=2.10.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
@@ -8,6 +8,7 @@ openapi: &openapi

 docker-base: &docker-base
  - docker/base/Dockerfile
+  - ".github/workflows/push-docker-base.yml"

 docker: &docker
  - docker/embedded/Dockerfile
@@ -57,12 +58,12 @@ frontend: &frontend
 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
 tauri: &tauri
-  - frontend/editor/src-tauri/**
-  - frontend/editor/src/desktop/**
-  - frontend/editor/tsconfig.desktop.vite.json
+  - frontend/src-tauri/**
+  - frontend/src/desktop/**
+  - frontend/tsconfig.desktop.json
  - frontend/package.json
  - frontend/package-lock.json
-  - frontend/editor/vite.config.ts
+  - frontend/vite.config.ts
  - .github/workflows/tauri-build.yml

 # Files that affect the AI engine (Python tool models, fixers, tests). Gate
@@ -77,7 +78,7 @@ licenses-frontend: &licenses-frontend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - "frontend/package.json"
  - "frontend/package-lock.json"
-  - "frontend/editor/scripts/generate-licenses.js"
+  - "frontend/scripts/generate-licenses.js"

 licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -87,8 +88,8 @@ licenses-backend: &licenses-backend
 # Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
  - app/proprietary/**
-  - frontend/editor/src/proprietary/**
-  - frontend/editor/src/core/tests/enterprise/**
+  - frontend/src/proprietary/**
+  - frontend/src/core/tests/enterprise/**
  - testing/compose/docker-compose-keycloak-oauth.yml
  - testing/compose/docker-compose-keycloak-saml.yml
  - testing/compose/keycloak-realm-oauth.json
@@ -25,8 +25,6 @@ updates:
      - "/docker/frontend"
      - "/docker/base"
      - "/docker/engine"
-      - "/docker/unoserver"
-      - "/engine"
    schedule:
      interval: "weekly"
    cooldown:
@@ -128,9 +126,9 @@ updates:

  - package-ecosystem: cargo
    directories:
-      - /frontend/editor/src-tauri
-      - /frontend/editor/src-tauri/thumbnail-handler
-      - /frontend/editor/src-tauri/provisioner
+      - /frontend/src-tauri
+      - /frontend/src-tauri/thumbnail-handler
+      - /frontend/src-tauri/provisioner
    schedule:
      interval: "weekly"
    cooldown:
@@ -51,7 +51,7 @@ labels:

  - label: 'Translation'
    files:
-      - 'frontend/editor/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
      - 'scripts/ignore_translation.toml'
      - 'scripts/remove_translation_keys.sh'
      - 'scripts/replace_translation_line.sh'
@@ -69,8 +69,8 @@ labels:

  - label: 'Tauri'
    files:
-      - 'frontend/editor/src-tauri/**'
-      - 'frontend/editor/src-tauri/.*'
+      - 'frontend/src-tauri/**'
+      - 'frontend/src-tauri/.*'

  - label: 'engine'
    files:
@@ -23,13 +23,9 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-pr:
    if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    outputs:
      should_deploy: ${{ steps.decide.outputs.should_deploy }}
      is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -39,7 +35,7 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -101,8 +97,8 @@ jobs:
          echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT

  deploy-v2-pr:
-    needs: [pick, check-pr]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-pr
+    runs-on: ubuntu-latest
    if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
    # Concurrency control - only one deployment per PR at a time
    concurrency:
@@ -112,14 +108,10 @@ jobs:
      contents: read
      issues: write
      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -187,12 +179,7 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0 # Fetch full history for commit hash detection

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -237,20 +224,8 @@ jobs:
            echo "Image needs to be built"
          fi

-      - name: Build and push V2 image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push V2 image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-image.outputs.exists == 'false'
+      - name: Build and push V2 image
+        if: steps.check-image.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -376,8 +351,7 @@ jobs:

  cleanup-v2-deployment:
    if: github.event.action == 'closed'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
@@ -385,7 +359,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -34,12 +34,8 @@ permissions:
  pull-requests: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-comment:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      issues: write
    if: |
@@ -74,7 +70,7 @@ jobs:
      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -179,19 +175,15 @@ jobs:
            }

  deploy-pr:
-    needs: [pick, check-comment]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-comment
+    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -240,12 +232,7 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_PDF_DESKTOP_UI: false

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
@@ -254,22 +241,7 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push PR-specific image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push PR-specific image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push PR-specific image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -283,19 +255,8 @@ jobs:
            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
          platforms: linux/amd64

-      - name: Build and push engine image (Depot)
-        if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
+      - name: Build and push engine image
+        if: needs.check-comment.outputs.enable_prototypes == 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: ./engine
@@ -510,11 +471,10 @@ jobs:

  handle-label-commands:
    if: ${{ github.event.issue.pull_request != null }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -1,70 +0,0 @@
-name: _runner-pick
-
-# Tiny reusable workflow that classifies the trigger as either a "fork PR
-# from an untrusted contributor" or a "trusted commit" so downstream jobs
-# can pick a runner class without each one duplicating the 200-char gate
-# expression in their own `runs-on:`.
-#
-# Caller pattern:
-#
-#   jobs:
-#     pick:
-#       uses: ./.github/workflows/_runner-pick.yml
-#
-#     real-work:
-#       needs: pick
-#       runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-#       steps: [...]
-#
-# Output:
-#   is_fork: "true" when the trigger is a pull_request from a fork or an
-#            untrusted author_association, "false" otherwise.
-
-on:
-  workflow_call:
-    outputs:
-      is_fork:
-        description: '"true" if the trigger is an untrusted fork PR.'
-        value: ${{ jobs.pick.outputs.is_fork }}
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    outputs:
-      is_fork: ${{ steps.decide.outputs.is_fork }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Classify the trigger
-        id: decide
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_REPO_FORK: ${{ github.event.pull_request.head.repo.fork }}
-          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
-        run: |
-          set -eu
-          if [ -z "${PR_NUMBER:-}" ]; then
-            # Not a pull_request event at all (push, schedule, workflow_dispatch,
-            # workflow_call from a non-PR trigger) -> trusted by default.
-            echo "is_fork=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          if [ "${HEAD_REPO_FORK}" = "true" ]; then
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          case "${AUTHOR_ASSOC}" in
-            OWNER|MEMBER|COLLABORATOR)
-              echo "is_fork=false" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "is_fork=true" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
@@ -17,16 +17,14 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
@@ -19,7 +19,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -26,7 +26,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -70,12 +70,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Update stirling-pdf-desktop PKGBUILD
        env:
@@ -106,7 +106,7 @@ jobs:

      - name: Publish stirling-pdf-desktop to AUR
        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
+        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
        with:
          pkgname: stirling-pdf-desktop
          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
@@ -16,7 +16,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -1,7 +1,7 @@
 name: Backend build, format check, and coverage

-# Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
+# Reusable workflow called from build.yml. Runs the full backend build matrix
+# (JDK 21/25 × spring-security on/off), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
 on:
  workflow_call:
@@ -13,22 +13,16 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  build:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
-        jdk-version: [25]
+        jdk-version: [21, 25]
        spring-security: [true, false]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -41,7 +35,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/wrapper
@@ -17,23 +17,11 @@ name: Enterprise E2E (Playwright)

 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
  push:
    branches: ["main"]
  schedule:
    - cron: "0 4 * * *"
  workflow_dispatch:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 # No `concurrency:` block here on purpose. When this workflow is called via
 # workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
@@ -47,21 +35,16 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e-enterprise:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
      PREMIUM_ENABLED: "true"
      SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -80,15 +63,7 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (needed for playwright's vite preview webServer)
-        # Enterprise tests target :8080 (Spring Boot's bundled frontend), but
-        # playwright's webServer config still launches `vite preview --port 5173`
-        # before any test run, which needs dist/ to exist. VITE_BUILD_FOR_PREVIEW
-        # forces absolute asset paths so vite preview can serve deep SPA routes.
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
+        run: task frontend:test:e2e:install -- chromium

      - name: Resolve kubernetes.docker.internal to localhost
        # The compose stacks set KC_HOSTNAME=kubernetes.docker.internal so
@@ -165,7 +140,7 @@ jobs:
          wait_for_backend
      - name: Run enterprise OAuth Playwright tests
        id: oauth-tests
-        run: task e2e:enterprise -- --grep "OAuth"
+        run: task frontend:test:e2e -- --project=enterprise --grep "OAuth"
      - name: Stop backend + tear down OAuth Keycloak
        if: always()
        run: |
@@ -238,7 +213,7 @@ jobs:
          wait_for_backend
      - name: Run enterprise SAML Playwright tests
        id: saml-tests
-        run: task e2e:enterprise -- --grep "SAML"
+        run: task frontend:test:e2e -- --project=enterprise --grep "SAML"
      - name: Stop backend + tear down SAML Keycloak
        if: always()
        run: |
@@ -268,7 +243,7 @@ jobs:
          wait_for_backend
      - name: Run enterprise feature Playwright tests
        id: feature-tests
-        run: task e2e:enterprise -- --grep "Enterprise license"
+        run: task frontend:test:e2e -- --project=enterprise --grep "Enterprise license"
      - name: Print backend log on failure
        if: failure()
        run: |
@@ -285,5 +260,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -46,7 +46,7 @@ jobs:
      proprietary: ${{ steps.changes.outputs.proprietary }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -135,7 +135,6 @@ jobs:
    permissions:
      contents: read
      packages: read
-      id-token: write
    uses: ./.github/workflows/test-build-docker.yml
    secrets: inherit
    with:
@@ -198,11 +197,6 @@ jobs:
      - dependency-review
    runs-on: ubuntu-latest
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
      - name: Verify every required job passed (or was legitimately skipped)
        env:
          RESULTS: |
@@ -11,11 +11,9 @@ permissions:
 jobs:
  check-licence:
    runs-on: ubuntu-latest
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -29,7 +27,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/wrapper
@@ -10,17 +10,11 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-generate-openapi-docs:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -34,7 +28,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/wrapper
@@ -6,7 +6,7 @@ on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - ".github/scripts/check_language_toml.py"
      - ".github/workflows/check_toml.yml"

@@ -27,7 +27,7 @@ jobs:
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -76,7 +76,7 @@ jobs:
            exit 1
          fi
          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
@@ -166,12 +166,12 @@ jobs:

            // Determine reference file
            let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-GB/translation.toml")) {
+            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
              console.log("Using PR branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
-                path: "frontend/editor/public/locales/en-GB/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                ref: branch,
              });

@@ -183,7 +183,7 @@ jobs:
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: repoOwner,
                repo: repoName,
-                path: "frontend/editor/public/locales/en-GB/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                ref: "main",
              });

@@ -14,13 +14,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: "Checkout Repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Dependency Review"
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          config-file: "./.github/config/dependency-review-config.yml"
@@ -10,37 +10,22 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  deploy-v2-on-push:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    concurrency:
      group: deploy-v2-push-V2
      cancel-in-progress: true
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get commit hashes for frontend and backend
@@ -105,22 +90,8 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push frontend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push frontend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-frontend.outputs.exists == 'false'
+      - name: Build and push frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -134,22 +105,8 @@ jobs:
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

-      - name: Build and push backend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-backend.outputs.exists == 'false'
+      - name: Build and push backend image
+        if: steps.check-backend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -11,32 +11,21 @@ on:
        required: false
        type: string
        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 4 because bench showed 16 was within noise of 4."
-        required: false
-        type: string
-        default: "4"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  docker-compose-tests:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') }}
+    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
      checks: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -50,7 +39,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/wrapper
@@ -5,27 +5,17 @@ name: Playwright E2E (live backend)
 # server.
 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e-live:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -44,31 +34,63 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
+        run: task frontend:test:e2e:install -- chromium
+      - name: Start Spring Boot backend (background)
        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
+          # Suppress the analytics opt-in modal that fires on first admin login when
+          # enableAnalytics is null (see Onboarding.tsx). The modal renders a Mantine
+          # overlay that intercepts pointer events on every tool page until dismissed,
+          # which causes every "click run button" assertion in the live suite to fail.
+          SYSTEM_ENABLEANALYTICS: "false"
+        # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
+        # The live-setup project's bootstrap spec performs the real first-login
+        # flow against the backend's default admin/stirling user, exercising the
+        # forced-password-change UI and leaving the DB at admin/adminadmin for
+        # the rest of the live suite. This is both real coverage of the first-
+        # login flow and a stronger seed than env-var-driven user creation.
+        run: |
+          nohup ./gradlew :stirling-pdf:bootRun > /tmp/backend.log 2>&1 &
+          echo $! > /tmp/backend.pid
+      - name: Wait for backend to become ready
+        run: |
+          start=$SECONDS
+          # 300 iterations × 2s = 10 minute ceiling
+          for i in $(seq 1 300); do
+            if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then
+              echo "Backend up after $((SECONDS - start))s"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Backend did not become ready in $((SECONDS - start))s"
+          tail -200 /tmp/backend.log || true
+          exit 1
      - name: Run live E2E tests (chromium)
        id: live-tests
-        run: task e2e:live
+        run: task frontend:test:e2e -- --project=live
      - name: Print backend log on failure
        if: failure() && steps.live-tests.conclusion == 'failure'
        run: |
          echo "::group::Spring Boot backend log (last 500 lines)"
-          tail -500 .test-state/playwright/backend.log || echo "no backend log found"
+          tail -500 /tmp/backend.log || echo "no backend log found"
          echo "::endgroup::"
+      - name: Stop backend
+        if: always()
+        run: |
+          if [ -f /tmp/backend.pid ]; then
+            kill "$(cat /tmp/backend.pid)" 2>/dev/null || true
+          fi
      - name: Upload backend log
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: backend-log-live-${{ github.run_id }}
-          path: .test-state/playwright/backend.log
+          path: /tmp/backend.log
          retention-days: 7
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-live-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -5,26 +5,16 @@ name: Playwright E2E (stubbed)
 # mocks API responses in the browser.
 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 8 to match the other playwright workflows; bench showed flat scaling above 8."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -38,17 +28,13 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
+        run: task frontend:test:e2e:install -- chromium
      - name: Run stubbed E2E tests (chromium)
-        run: task e2e:stubbed -- --workers=3
+        run: task frontend:test:e2e -- --project=stubbed --workers=3
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -19,20 +19,16 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  files-changed:
    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -48,15 +44,15 @@ jobs:
  generate-frontend-license-report:
    if: needs.files-changed.outputs.licenses-frontend == 'true'
    name: Generate Frontend License Report
-    needs: [pick, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: files-changed
+    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -118,23 +114,23 @@ jobs:
        env:
          PR_IS_FORK: "true"
        run: |
-          node base/frontend/editor/scripts/generate-licenses.js \
-            --input frontend/editor/src/assets/3rdPartyLicenses.json
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json

      - name: Copy postprocessed artifacts back (fork PRs)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        run: |
-          mkdir -p frontend/editor/src/assets
-          if [ -f "base/frontend/editor/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/editor/src/assets/3rdPartyLicenses.json frontend/editor/src/assets/3rdPartyLicenses.json
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
          fi
-          if [ -f "base/frontend/editor/src/assets/license-warnings.json" ]; then
-            cp base/frontend/editor/src/assets/license-warnings.json frontend/editor/src/assets/license-warnings.json
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
          fi

      - name: Check for license warnings
        run: |
-          if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
          else
            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
@@ -182,10 +178,10 @@ jobs:
            echo ""
            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
                echo ""
                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/editor/src/assets/license-warnings.json || true
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
              fi
            else
              echo "✅ **Passed** – no license warnings detected."
@@ -211,7 +207,7 @@ jobs:
              const fs = require('fs');
              let warningDetails = '';
              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/editor/src/assets/license-warnings.json', 'utf8'));
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
              } catch (e) {
                warningDetails = 'Unable to read warning details';
@@ -251,7 +247,7 @@ jobs:
      - name: Commit changes (Push only)
        if: github.event_name == 'push'
        run: |
-          git add frontend/editor/src/assets/3rdPartyLicenses.json
+          git add frontend/src/assets/3rdPartyLicenses.json
          # Note: Do NOT commit license-warnings.json - it's only for PR review
          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV

@@ -269,7 +265,7 @@ jobs:

          The following licenses may require review for corporate compatibility:

-          $(cat frontend/editor/src/assets/license-warnings.json | jq -r '.warnings[].message')
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')

          Please review these licenses to ensure they are acceptable for your use case."
          fi
@@ -311,18 +307,16 @@ jobs:

  generate-backend-license-report:
    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: [pick, files-changed]
+    needs: files-changed
    name: Generate Backend License Report
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -11,15 +11,11 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  frontend-validation:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -89,29 +85,9 @@ jobs:
          echo "to see what still needs fixing manually."
          echo "============================================"
          exit 1
-      - name: Remove frontend check comment on success
-        if: steps.frontend-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
      - name: Upload frontend build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-build
-          path: frontend/editor/dist/
+          path: frontend/dist/
          retention-days: 3
@@ -15,7 +15,7 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -36,19 +36,15 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  determine-matrix:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -61,7 +57,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/caches
@@ -94,28 +90,26 @@ jobs:
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            case "${{ github.event.inputs.platform }}" in
              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
            esac
          else
            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
          fi

  build-jars:
-    needs: [pick, determine-matrix]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    needs: determine-matrix
+    runs-on: ubuntu-latest
    strategy:
      matrix:
        variant:
@@ -133,7 +127,7 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -195,10 +189,9 @@ jobs:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
          allowed-endpoints: >
@@ -225,23 +218,7 @@ jobs:
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: stable
-          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      # x86_64 JDK is set up first so the aarch64 step below can leave its
-      # JAVA_HOME as the active one. The macOS universal JRE build needs
-      # jmods from both arches; the x64 path is captured into the env
-      # before the second setup-java overwrites JAVA_HOME.
-      - name: Set up x86_64 JDK 25 (macOS universal JRE)
-        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-          architecture: "x64"
-
-      - name: Capture x86_64 JAVA_HOME
-        if: matrix.platform == 'macos-15'
-        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -257,23 +234,13 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

-      # Build the universal JRE before desktop:prepare so the jlink:runtime
-      # task short-circuits on its `test -d runtime/jre` status check.
-      - name: Build universal macOS JRE
-        if: matrix.platform == 'macos-15'
-        env:
-          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:jlink:universal-mac
-
      - name: Prepare desktop build
+        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
@@ -354,7 +321,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -375,7 +342,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -427,7 +394,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -440,11 +407,7 @@ jobs:
          }
          EOF
          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
-
-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json

      - name: Import release GPG signing key (Linux)
        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -492,7 +455,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

@@ -518,7 +481,7 @@ jobs:
          $allSigned = $true

          # Check MSI installer (outer wrapper - what users download)
-          $msiFiles = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
          if ($msiFiles.Count -eq 0) {
            Write-Host "[ERROR] No MSI found under target/"
            exit 1
@@ -587,14 +550,14 @@ jobs:
        shell: bash
        run: |
          mkdir -p ./dist
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
            # are not the user-facing installer - the MSI contains the signed inner exe.
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
@@ -613,13 +576,13 @@ jobs:

  create-release:
    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-    needs: [pick, determine-matrix, build, build-jars]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [determine-matrix, build, build-jars]
+    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -651,7 +614,7 @@ jobs:
        run: ls -R ./artifacts

      - name: Upload binaries to Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
@@ -13,16 +13,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-all-browsers:
    name: Playwright (chromium + firefox + webkit)
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -39,15 +35,15 @@ jobs:
      - name: Install Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install all Playwright browsers
-        run: task e2e:install
+        run: task frontend:test:e2e:install

      - name: Run E2E tests (all browsers)
-        run: task e2e:cross-browser
+        run: task frontend:test:e2e

      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 14
@@ -2,7 +2,7 @@ name: Update Package Manager Manifests

 on:
  release:
-    types: [released]
+    types: [ released ]
  workflow_dispatch:
    inputs:
      version:
@@ -22,13 +22,14 @@ jobs:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.info.outputs.version }}
-      dmg_sha256: ${{ steps.hashes.outputs.dmg_sha256 }}
+      dmg_arm64_sha256: ${{ steps.hashes.outputs.dmg_arm64_sha256 }}
+      dmg_x86_64_sha256: ${{ steps.hashes.outputs.dmg_x86_64_sha256 }}
      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -62,15 +63,17 @@ jobs:
            sha256sum "$file" | awk '{print $1}'
          }

-          DMG_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-universal.dmg")
+          DMG_ARM64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-aarch64.dmg")
+          DMG_X64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-x86_64.dmg")
          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")

-          echo "dmg_sha256=$DMG_SHA" >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA" >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
+          echo "dmg_arm64_sha256=$DMG_ARM64_SHA" >> "$GITHUB_OUTPUT"
+          echo "dmg_x86_64_sha256=$DMG_X64_SHA"  >> "$GITHUB_OUTPUT"
+          echo "msi_sha256=$MSI_SHA"              >> "$GITHUB_OUTPUT"
+          echo "deb_sha256=$DEB_SHA"              >> "$GITHUB_OUTPUT"
+          echo "jar_sha256=$JAR_SHA"              >> "$GITHUB_OUTPUT"

  update-homebrew-and-scoop:
    needs: get-release-info
@@ -79,32 +82,33 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          repository: Stirling-Tools/homebrew-stirling-pdf
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap

-      # Stirling-PDF now ships a single universal DMG, so the Cask should
-      # have one sha256 line rather than separate on_arm/on_intel blocks.
-      # We rewrite every `sha256 "..."` in the Cask to the same value so
-      # the workflow keeps working through the Cask migration: pre-migration
-      # both arch blocks get the universal SHA (still correct, since both
-      # would resolve to the same DMG), post-migration the lone sha256 line
-      # is updated.
      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
        env:
          VERSION: ${{ needs.get-release-info.outputs.version }}
-          DMG_SHA: ${{ needs.get-release-info.outputs.dmg_sha256 }}
+          ARM64_SHA: ${{ needs.get-release-info.outputs.dmg_arm64_sha256 }}
+          X64_SHA: ${{ needs.get-release-info.outputs.dmg_x86_64_sha256 }}
        run: |
          CASK="tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$CASK"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${DMG_SHA}\"/g" "$CASK"
+          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$CASK"
+          awk -v arm="$ARM64_SHA" -v x64="$X64_SHA" '
+            /on_arm/     { in_arm=1 }
+            /on_intel/   { in_arm=0; in_intel=1 }
+            /end/        { in_arm=0; in_intel=0 }
+            in_arm  && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" arm "\"") }
+            in_intel && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" x64 "\"") }
+            { print }
+          ' "$CASK" > tmp && mv tmp "$CASK"

      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
        env:
@@ -112,8 +116,8 @@ jobs:
          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
        run: |
          FORMULA="tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
+          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$FORMULA"
+          sed -i "s/sha256 \".*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"

      - name: Update Scoop stirling-pdf.json
        env:
@@ -19,7 +19,7 @@ jobs:
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -43,7 +43,7 @@ jobs:
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -100,7 +100,7 @@ jobs:
          sbom: true

      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v2.4.1"

@@ -2,22 +2,6 @@ name: Push Docker Image with VersionNumber

 on:
  workflow_dispatch:
-    inputs:
-      build_main_app:
-        description: "Build & push the main Stirling-PDF image (latest, fat, ultra-lite)."
-        required: false
-        type: boolean
-        default: true
-      build_unoserver:
-        description: "Build & push the standalone stirling-unoserver image."
-        required: false
-        type: boolean
-        default: true
-      force_unoserver_rebuild:
-        description: "Rebuild stirling-unoserver even if its source hash is unchanged."
-        required: false
-        type: boolean
-        default: false
  push:
    branches:
      - master
@@ -47,13 +31,9 @@ jobs:
    permissions:
      packages: write
      id-token: write
-    # On push events these stay 'true'; on workflow_dispatch they follow the inputs.
-    env:
-      RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
-      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -66,7 +46,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/caches
@@ -96,13 +76,13 @@ jobs:

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v2.4.1"

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v2.4.1"

@@ -128,7 +108,6 @@ jobs:

      - name: Generate tags for latest
        id: meta
-        if: env.RUN_MAIN_APP == 'true'
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
@@ -143,8 +122,6 @@ jobs:

      - name: Build and push Unified Dockerfile (latest variant)
        id: build-push-latest
-        # Empty-tag guard: build-push-action errors when asked to push with no tags.
-        if: env.RUN_MAIN_APP == 'true' && steps.meta.outputs.tags != ''
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -163,7 +140,7 @@ jobs:
          sbom: true

      - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        env:
          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
@@ -179,7 +156,7 @@ jobs:
      - name: Generate tags for latest-fat
        id: meta-fat
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -193,7 +170,7 @@ jobs:
      - name: Build and push Unified Dockerfile (fat variant)
        id: build-push-fat
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-fat.outputs.tags != ''
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -209,7 +186,7 @@ jobs:
          sbom: true

      - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        env:
          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
          TAGS: ${{ steps.meta-fat.outputs.tags }}
@@ -223,7 +200,7 @@ jobs:
      - name: Generate tags for ultra-lite
        id: meta-lite
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -237,7 +214,7 @@ jobs:
      - name: Build and push Unified Dockerfile (ultra-lite variant)
        id: build-push-lite
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-lite.outputs.tags != ''
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: .
@@ -253,7 +230,7 @@ jobs:
          sbom: true

      - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
        env:
          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
          TAGS: ${{ steps.meta-lite.outputs.tags }}
@@ -263,136 +240,3 @@ jobs:
          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
          done
-
-      # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
-      # only when the version is new. main/testMain: republish :alpha only
-      # when the source hash differs from the published image's annotation.
-      - name: Read unoserver image version
-        id: unoserverVersion
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          version=$(tr -d '[:space:]' < docker/unoserver/VERSION)
-          if [ -z "$version" ]; then
-            echo "docker/unoserver/VERSION is empty"; exit 1
-          fi
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver image version (from file): ${version}"
-
-      - name: Compute unoserver image source hash
-        id: unoserverHash
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          set -eu
-          hash=$(cat \
-            docker/unoserver/Dockerfile \
-            docker/unoserver/entrypoint.sh \
-            docker/unoserver/healthcheck.sh \
-            docker/unoserver/VERSION \
-            | sha256sum | cut -d' ' -f1)
-          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver source hash: ${hash}"
-
-      - name: Decide whether to publish unoserver image
-        id: unoserverDecision
-        if: env.RUN_UNOSERVER == 'true'
-        env:
-          UNOSERVER_VERSION: ${{ steps.unoserverVersion.outputs.version }}
-          UNOSERVER_HASH: ${{ steps.unoserverHash.outputs.hash }}
-          UNOSERVER_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-unoserver
-          UNOSERVER_HASH_ANNOTATION: org.stirlingpdf.unoserver-source-hash
-          FORCE_REBUILD: ${{ inputs.force_unoserver_rebuild }}
-          GH_REF: ${{ github.ref }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -eu
-          mode="skip"
-          tags=""
-
-          read_published_hash() {
-            local ref="$1"
-            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
-              | jq -r --arg key "$UNOSERVER_HASH_ANNOTATION" \
-                  '.annotations[$key] // empty' \
-              2>/dev/null || true
-          }
-
-          # Manual dispatch from any branch routes to the :alpha publish path.
-          EFFECTIVE_REF="$GH_REF"
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            EFFECTIVE_REF="refs/heads/testMain"
-          fi
-
-          case "$EFFECTIVE_REF" in
-            refs/heads/master|refs/heads/V2-master)
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — building stable regardless"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              elif docker manifest inspect "${UNOSERVER_IMAGE}:${UNOSERVER_VERSION}" >/dev/null 2>&1; then
-                echo "stirling-unoserver:${UNOSERVER_VERSION} already on GHCR — skipping"
-              else
-                echo "stirling-unoserver:${UNOSERVER_VERSION} is new — will publish"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              fi
-              ;;
-            refs/heads/main|refs/heads/testMain)
-              published_hash=$(read_published_hash "${UNOSERVER_IMAGE}:alpha")
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — rebuilding :alpha regardless"
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              elif [ -n "$published_hash" ] && [ "$published_hash" = "$UNOSERVER_HASH" ]; then
-                echo "Published :alpha source hash matches (${published_hash}) — skipping"
-              else
-                if [ -z "$published_hash" ]; then
-                  echo ":alpha has no source-hash annotation (first publish or pre-tracking image) — will publish"
-                else
-                  echo "Source hash changed (was ${published_hash}, now ${UNOSERVER_HASH}) — will publish"
-                fi
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              fi
-              ;;
-            *)
-              echo "Branch ${GH_REF} does not publish unoserver image"
-              ;;
-          esac
-          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
-          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push unoserver image
-        id: build-push-unoserver
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode != 'skip'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          tags: ${{ steps.unoserverDecision.outputs.tags }}
-          # Manifest annotation read by the decision step above to detect drift.
-          annotations: |
-            index:org.stirlingpdf.unoserver-source-hash=${{ steps.unoserverHash.outputs.hash }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign unoserver image
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode == 'stable'
-        env:
-          DIGEST: ${{ steps.build-push-unoserver.outputs.digest }}
-          TAGS: ${{ steps.unoserverDecision.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
-          fi
@@ -18,7 +18,7 @@ jobs:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -35,7 +35,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.29.5
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -17,7 +17,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -22,18 +22,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -11,7 +11,7 @@ on:
      - "app/core/build.gradle"
      - "app/proprietary/build.gradle"
      - "README.md"
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
      - "scripts/ignore_translation.toml"

@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -62,7 +62,7 @@ jobs:

      - name: Sync translation TOML files
        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-GB/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

      - name: pre-commit run
        run: |
@@ -70,7 +70,7 @@ jobs:

      - name: Commit translation files
        run: |
-          git add frontend/editor/public/locales/*/translation.toml
+          git add frontend/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

      - name: Sync README.md
@@ -100,7 +100,7 @@ jobs:
            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:

            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
            - Ensured consistency and synchronization across all supported language files.
            - Highlighted any missing or incomplete translations.
            - **Format**: TOML
@@ -125,5 +125,5 @@ jobs:
          sign-commits: true
          add-paths: |
            README.md
-            frontend/editor/public/locales/*/translation.toml
+            frontend/public/locales/*/translation.toml
            scripts/ignore_translation.toml
@@ -1,13 +1,9 @@
 name: Build Tauri Applications

-# Multi-OS Tauri desktop bundle build matrix (Windows / macOS universal /
+# Multi-OS Tauri desktop bundle build matrix (Windows / macOS arm+intel /
 # Linux). Called from build.yml on PRs that touch desktop sources (gated
 # via the `tauri` filter in .github/config/.files.yaml). Also runnable
 # on demand via workflow_dispatch with a per-platform selector.
-#
-# Note: editing this file is itself enough to make the `tauri` path filter
-# match, which is how non-desktop PRs (e.g. backend-only fixes) opt into a
-# desktop smoke build.
 on:
  workflow_call:
    inputs:
@@ -41,7 +37,7 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -51,15 +47,18 @@ jobs:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          PLATFORM: ${{ inputs.platform }}
        run: |
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
-          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'
+          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
+          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
+          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
+          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'

+          # Resolve requested platform — populated by either workflow_dispatch
+          # or workflow_call inputs; both paths default to "all".
          case "$PLATFORM" in
            windows) ENTRIES=("$WINDOWS") ;;
-            macos)   ENTRIES=("$MACOS") ;;
+            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
            linux)   ENTRIES=("$LINUX") ;;
-            *)       ENTRIES=("$WINDOWS" "$MACOS" "$LINUX") ;;
+            *)       ENTRIES=("$WINDOWS" "$MACOS_ARM" "$MACOS_INTEL" "$LINUX") ;;
          esac

          # Drop macOS entries when Apple certificate secret is unavailable
@@ -86,10 +85,9 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -113,19 +111,7 @@ jobs:
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          toolchain: stable
-          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up x86_64 JDK 25 (macOS universal JRE)
-        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-          architecture: "x64"
-
-      - name: Capture x86_64 JAVA_HOME
-        if: matrix.platform == 'macos-15'
-        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -140,22 +126,13 @@ jobs:

      - name: Setup Task
        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
-      - name: Build universal macOS JRE
-        if: matrix.platform == 'macos-15'
-        env:
-          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:jlink:universal-mac
-
      - name: Prepare desktop build
+        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
@@ -236,7 +213,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -257,7 +234,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -268,12 +245,8 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
-
      - name: Check DMG creation dependencies (macOS only)
-        if: matrix.platform == 'macos-15'
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        run: |
          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
@@ -302,7 +275,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -360,7 +333,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          # Linux: build deb+rpm only here. AppImage runs in its own
          # continue-on-error step below so its persistent linuxdeploy
@@ -385,7 +358,7 @@ jobs:
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: --bundles appimage

@@ -400,10 +373,10 @@ jobs:
          fi

      - name: Verify notarization (macOS only)
-        if: matrix.platform == 'macos-15'
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
        run: |
          echo "🔍 Verifying notarization status..."
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          DMG_FILE=$(find . -name "*.dmg" | head -1)
          if [ -n "$DMG_FILE" ]; then
            echo "Found DMG: $DMG_FILE"
@@ -418,14 +391,14 @@ jobs:
        shell: bash
        run: |
          mkdir -p ./dist
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
            # Only ship the MSI installer. The loose exe and WiX toolset exes
            # are not the user-facing installer - the MSI contains the signed inner exe.
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
@@ -508,7 +481,7 @@ jobs:
      - name: Verify build artifacts
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Check for expected artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
@@ -518,7 +491,7 @@ jobs:
              echo "❌ No Windows executable found"
              exit 1
            fi
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            echo "Checking for macOS artifacts..."
            find . -name "*.dmg" | head -5
            if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
@@ -539,7 +512,7 @@ jobs:
      - name: Test artifact sizes
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
@@ -560,7 +533,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -583,7 +556,8 @@ jobs:
            // Map of expected artifact names to display info
            const artifactMap = {
              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-macos-universal': { icon: '🍎', platform: 'macOS Universal', files: '.dmg' },
+              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
+              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
            };

@@ -651,7 +625,7 @@ jobs:
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -12,19 +12,11 @@ on:
        required: false
        type: string
        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  # TODO: extract a pre-matrix `prepare` job that runs once and produces
  # shared artifacts for the three matrix entries below to consume:
  #   1. `task backend:build` — currently runs 3× in parallel with
@@ -40,14 +32,7 @@ jobs:
  # spring-security=true matrix entry if `task backend:build` and
  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
  test-build-docker-images:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
@@ -63,7 +48,7 @@ jobs:
            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -95,7 +80,7 @@ jobs:
          distribution: "temurin"

      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.gradle/wrapper
@@ -120,16 +105,10 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true
          STIRLING_PDF_DESKTOP_UI: false

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

@@ -155,22 +134,7 @@ jobs:
            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
          fi

-      - name: Build ${{ matrix.docker-rev }} (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      - name: Build ${{ matrix.docker-rev }} (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build ${{ matrix.docker-rev }}
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -196,86 +160,3 @@ jobs:
            build/reports/problems/
          retention-days: 3
          if-no-files-found: warn
-
-  test-build-unoserver-image:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
-      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Build docker/unoserver/Dockerfile (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Build docker/unoserver/Dockerfile (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Smoke test the built image
-        run: |
-          set -eu
-          docker run -d --name unoserver-smoke \
-            -e UNOSERVER_RECYCLE_INTERVAL_SECONDS=0 \
-            stirling-unoserver:pr-test
-          deadline=$((SECONDS + 60))
-          while [ $SECONDS -lt $deadline ]; do
-            status=$(docker inspect -f '{{.State.Health.Status}}' unoserver-smoke 2>/dev/null || echo "starting")
-            if [ "$status" = "healthy" ]; then
-              echo "unoserver became healthy"
-              docker logs unoserver-smoke | tail -30
-              docker rm -f unoserver-smoke
-              exit 0
-            fi
-            sleep 3
-          done
-          echo "unoserver did not become healthy in time"
-          docker logs unoserver-smoke || true
-          docker rm -f unoserver-smoke || true
-          exit 1
@@ -20,22 +20,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  deploy:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -61,12 +51,7 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -81,20 +66,7 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push test image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64
-
-      - name: Build and push test image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push test image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -153,14 +125,13 @@ jobs:
  files-changed:
    if: always()
    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -174,11 +145,12 @@ jobs:

  test:
    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [pick, deploy, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, files-changed]
+    runs-on: ubuntu-latest
+
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -208,13 +180,13 @@ jobs:
          FORCE_COLOR: "3"

  cleanup:
-    needs: [pick, deploy, test]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

@@ -32,7 +32,6 @@ exampleYmlFiles/stirling/
 /testing/cucumber/junit/
 /testing/cucumber/report.html
 /testing/.failed_tests
-/.test-state/
 SwaggerDoc.json

 # Runtime storage for uploaded files and user data (not Java source code)
@@ -158,8 +157,6 @@ common/build
 proprietary/build
 stirling-pdf/build
 frontend/src-tauri/provisioner/target
-frontend/src-tauri/target
-frontend/src-tauri/runtime/

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -267,11 +264,5 @@ docs/type3/signatures/
 # Type3 sample PDFs (development only)
 **/type3/samples/

-**/application-dev-local.properties
-
 # Claude
 .claude/
-
-# Playwright MCP screenshots / traces
-.playwright-mcp/
-*.playwright-mcp.png
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.14
+    rev: v0.15.11
    hooks:
      - id: ruff
        args:
@@ -20,7 +20,7 @@ repos:
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
-        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/editor/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.0
    hooks:
@@ -38,7 +38,7 @@ repos:
    rev: v0.24.4
    hooks:
      - id: toml-sort-fix
-        files: frontend/editor/public/locales/.*\.toml$
+        files: frontend/public/locales/.*\.toml$
        args: ['--in-place', '--all', '--ignore-case']
  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
  #   rev: v16.21.1
@@ -1,20 +1,5 @@
 version: '3'

-# Gradle invocation strategy:
-#   - Linux/macOS: `./gradlew` runs the POSIX shell wrapper natively.
-#   - Windows:     `cmd /c ".\gradlew.bat ..."` invokes the .bat wrapper through
-#                  cmd.exe so it inherits the user's Windows-side `JAVA_HOME`
-#                  and PATH. Routing through `bash gradlew` on Windows ends up
-#                  under WSL or Git-Bash, neither of which inherits
-#                  Adoptium/Temurin's default Windows-only Java env - gradlew
-#                  then errors with "JAVA_HOME is not set and no 'java' command
-#                  could be found".
-#
-#                  The entire `.\gradlew.bat ...` payload is double-quoted so
-#                  the leading `.\` survives mvdan/sh's POSIX backslash
-#                  stripping; cmd.exe also requires `.\` (not bare `gradlew.bat`)
-#                  because modern Windows excludes cwd from cmd's search path.
-
 tasks:
  dev:
    desc: "Start backend dev server"
@@ -25,43 +10,15 @@ tasks:
    env:
      SERVER_PORT: '{{.PORT}}'
    cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true AIENGINE_TIMEOUTSECONDS=120 {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}set "AIENGINE_URL={{.AIENGINE_URL}}" && set "AIENGINE_ENABLED=true" && {{end}}cmd /c gradlew.bat :stirling-pdf:bootRun'
        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true AIENGINE_TIMEOUTSECONDS=120 {{end}}./gradlew :stirling-pdf:bootRun'
-        platforms: [linux, darwin]
-
-  dev:bundled:
-    desc: "Clean + bootRun with frontend bundled into the backend (single :8080 server)"
-    ignore_error: true
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean bootRun -PbuildWithFrontend=true"
-        platforms: [windows]
-      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
-        platforms: [linux, darwin]
-
-  dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase (loads .env.saas.local)"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`. Drop the file at the repo root.
-    dotenv: ['.env.saas.local']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
-      PROFILES: '{{.PROFILES | default "dev"}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-      STIRLING_FLAVOR: saas
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
        platforms: [linux, darwin]

  build:
    desc: "Full backend build"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build"
+      - cmd: cmd /c gradlew.bat clean build
        platforms: [windows]
      - cmd: ./gradlew clean build
        platforms: [linux, darwin]
@@ -69,7 +26,7 @@ tasks:
  build:fast:
    desc: "Build without tests"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build -x test"
+      - cmd: cmd /c gradlew.bat clean build -x test
        platforms: [windows]
      - cmd: ./gradlew clean build -x test
        platforms: [linux, darwin]
@@ -77,7 +34,7 @@ tasks:
  build:ci:
    desc: "Build for CI (formatting checked separately)"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat build -PnoSpotless"
+      - cmd: cmd /c gradlew.bat build -PnoSpotless
        platforms: [windows]
      - cmd: ./gradlew build -PnoSpotless
        platforms: [linux, darwin]
@@ -85,7 +42,7 @@ tasks:
  test:
    desc: "Run backend tests"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat test"
+      - cmd: cmd /c gradlew.bat test
        platforms: [windows]
      - cmd: ./gradlew test
        platforms: [linux, darwin]
@@ -93,7 +50,7 @@ tasks:
  format:
    desc: "Auto-fix code formatting"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessApply"
+      - cmd: cmd /c gradlew.bat spotlessApply
        platforms: [windows]
      - cmd: ./gradlew spotlessApply
        platforms: [linux, darwin]
@@ -101,7 +58,7 @@ tasks:
  format:check:
    desc: "Check code formatting"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessCheck"
+      - cmd: cmd /c gradlew.bat spotlessCheck
        platforms: [windows]
      - cmd: ./gradlew spotlessCheck
        platforms: [linux, darwin]
@@ -114,7 +71,7 @@ tasks:
  swagger:
    desc: "Generate OpenAPI docs"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
+      - cmd: cmd /c gradlew.bat :stirling-pdf:copySwaggerDoc
        platforms: [windows]
      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
        platforms: [linux, darwin]
@@ -135,7 +92,7 @@ tasks:
    desc: "Print project version"
    silent: true
    cmds:
-      - cmd: cmd /c ".\gradlew.bat printVersion --quiet" | tail -1
+      - cmd: cmd /c gradlew.bat printVersion --quiet | tail -1
        platforms: [windows]
      - cmd: ./gradlew printVersion --quiet | tail -1
        platforms: [linux, darwin]
@@ -143,7 +100,7 @@ tasks:
  licenses:check:
    desc: "Check dependency licenses"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense --no-parallel"
+      - cmd: cmd /c gradlew.bat checkLicense --no-parallel
        platforms: [windows]
      - cmd: ./gradlew checkLicense --no-parallel
        platforms: [linux, darwin]
@@ -151,7 +108,7 @@ tasks:
  licenses:generate:
    desc: "Check and generate dependency license report"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense generateLicenseReport --no-parallel"
+      - cmd: cmd /c gradlew.bat checkLicense generateLicenseReport --no-parallel
        platforms: [windows]
      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
        platforms: [linux, darwin]
@@ -159,7 +116,7 @@ tasks:
  clean:
    desc: "Clean build artifacts"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean"
+      - cmd: cmd /c gradlew.bat clean
        platforms: [windows]
      - cmd: ./gradlew clean
        platforms: [linux, darwin]
@@ -3,22 +3,6 @@ version: '3'
 vars:
  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"

-  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
-  JPDFIUM_PLATFORMS:
-    sh: |
-      if [ -n "${JPDFIUM_PLATFORMS:-}" ]; then
-          echo "$JPDFIUM_PLATFORMS"
-      else
-          case "{{OS}}-{{ARCH}}" in
-              darwin-arm64)  echo "darwin-arm64";;
-              darwin-amd64)  echo "darwin-x64";;
-              linux-amd64)   echo "linux-x64";;
-              linux-arm64)   echo "linux-arm64";;
-              windows-amd64) echo "windows-x64";;
-              *)             echo "all";;
-          esac
-      fi
-
 tasks:
  prepare:
    desc: "Prepare desktop build dependencies"
@@ -31,7 +15,6 @@ tasks:
  provisioner:
    desc: "Build installer provisioner"
    platforms: [windows]
-    dir: editor
    cmds:
      - node scripts/build-provisioner.mjs

@@ -39,48 +22,41 @@ tasks:
    desc: "Start Tauri desktop dev mode"
    deps: [prepare]
    ignore_error: true
-    dir: editor
    cmds:
      - npx tauri dev --no-watch

  build:
    desc: "Build Tauri desktop app (production)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build

  build:dev:
    desc: "Build Tauri desktop app (dev, no bundling)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --no-bundle

  build:dev:mac:
    desc: "Build Tauri desktop .app bundle (macOS)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --bundles app

  build:dev:windows:
    desc: "Build Tauri desktop NSIS installer (Windows)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --bundles nsis

  build:dev:linux:
    desc: "Build Tauri desktop AppImage (Linux)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --bundles appimage

  clean:
    desc: "Clean Tauri/Cargo build artifacts"
-    dir: editor
    cmds:
      - task: jlink:clean
      - cd src-tauri && cargo clean
@@ -95,58 +71,39 @@ tasks:
    deps: [jlink:jar, jlink:runtime]

  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling (host-OS natives only by default)"
+    desc: "Build backend JAR for Tauri bundling"
    run: once
    dir: ..
    env:
      DISABLE_ADDITIONAL_FEATURES: "true"
    cmds:
-      - echo "Building bootJar with JPDFium natives for {{.JPDFIUM_PLATFORMS}}"
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
+      - cmd: cmd /c gradlew.bat bootJar --no-daemon
        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
+      - cmd: ./gradlew bootJar --no-daemon
        platforms: [linux, darwin]
-      - mkdir -p frontend/editor/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/editor/src-tauri/libs/
+      - mkdir -p frontend/src-tauri/libs
+      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
    status:
-      - test -f frontend/editor/src-tauri/libs/stirling-pdf-*.jar
+      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar

  jlink:runtime:
    desc: "Create custom JRE with jlink"
    deps: [jlink:jar]
-    dir: editor/src-tauri
    cmds:
-      - rm -rf runtime/jre
-      - mkdir -p runtime
+      - rm -rf src-tauri/runtime/jre
+      - mkdir -p src-tauri/runtime
      - >-
        jlink
        --add-modules {{.JLINK_MODULES}}
        --strip-debug
-        --compress=zip-6
+        --compress=2
        --no-header-files
        --no-man-pages
-        --output runtime/jre
+        --output src-tauri/runtime/jre
    status:
-      - test -d editor/src-tauri/runtime/jre
+      - test -d src-tauri/runtime/jre

  jlink:clean:
    desc: "Remove JLink runtime and bundled JARs"
-    dir: editor/src-tauri
    cmds:
-      - rm -rf libs runtime
-
-  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
-  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
-  # jlink under Rosetta on Apple Silicon, so it is opt-in and not part of
-  # the default desktop:build flow. Requires AARCH64_JAVA_HOME and
-  # X64_JAVA_HOME to point at matching JDK installations with jmods/.
-  jlink:universal-mac:
-    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
-    deps: [jlink:jar]
-    platforms: [darwin]
-    dir: editor
-    env:
-      JLINK_MODULES: "{{.JLINK_MODULES}}"
-      OUTPUT_DIR: src-tauri/runtime/jre
-    cmds:
-      - scripts/build-universal-mac-jre.sh
+      - rm -rf src-tauri/libs src-tauri/runtime
@@ -55,9 +55,3 @@ tasks:
    desc: "Tail docker compose logs"
    cmds:
      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
-
-  test:
-    desc: "Run full Docker integration test suite (builds all variants and tests them)"
-    ignore_error: true
-    cmds:
-      - bash testing/test.sh {{.CLI_ARGS}}
@@ -1,204 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install Playwright browsers"
-    dir: frontend/editor
-    deps: [ ':frontend:install' ]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
-
-  stubbed:
-    desc: "Run stubbed E2E tests"
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed {{.CLI_ARGS}}
-
-  live:
-    desc: "Run live E2E tests"
-    summary: |
-      Auto-spawns a Spring Boot backend with isolated state under
-      .test-state/playwright/ (purged on every run) so the suite doesn't
-      touch your local DB, settings.yml, backups or customFiles. The
-      backend is stopped automatically when the runner exits.
-
-      Pass extra Playwright flags via -- :
-        task e2e:live -- --headed --grep merge
-    deps:
-      - live:backend
-      - live:runner
-
-  live:backend:
-    internal: true
-    ignore_error: true
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    env:
-      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
-      # Suppress the analytics opt-in modal that fires on first admin login.
-      # It renders a Mantine overlay that intercepts pointer events and blocks
-      # FirstLoginSlide from rendering, so the bootstrap spec times out waiting
-      # for the password-change prompt.
-      SYSTEM_ENABLEANALYTICS: "false"
-      # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
-      # The live-setup project's bootstrap spec performs the real first-login
-      # flow against the backend's default admin/stirling user, exercising the
-      # forced-password-change UI and leaving the DB at admin/adminadmin for
-      # the rest of the live suite. This is both real coverage of the first-
-      # login flow and a stronger seed than env-var-driven user creation.
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) doesn't
-      # support `&` + `$!` + `wait` reliably (gradle was never actually
-      # backgrounded, so `$!` recorded a stale PID and the runner saw an
-      # immediate "backend died"). Real bash backgrounds gradle properly and
-      # gives us a stable PID to clean up.
-      - |
-        bash -c '
-          set -e
-          rm -rf "{{.BASE_DIR}}"
-          mkdir -p "{{.BASE_DIR}}"
-          # Background gradle and record its PID so the runner can clean up
-          # the exact process tree (wrapper + forked Spring Boot JVM) without
-          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
-          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
-          # synchronised.
-          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
-          GRADLE_PID=$!
-          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
-          wait $GRADLE_PID
-        '
-
-  live:runner:
-    internal: true
-    deps: [ ':frontend:prepare' ]
-    dir: frontend/editor
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) only
-      # supports `EXIT`/`ERR` in `trap`, not `INT`/`TERM`. CLI_ARGS are
-      # passed positionally so quoted args like --grep "foo bar" survive.
-      - |
-        bash -c '
-          set +e
-          # bootRun forks a separate Spring Boot JVM as a child of the gradle
-          # wrapper; killing only the wrapper leaves that JVM orphaned holding
-          # :8080. Walk the recorded PID'"'"'s process tree via pgrep so we kill
-          # every descendant, then lsof as a last-resort backstop.
-          kill_tree() {
-            local pid=$1
-            for child in $(pgrep -P "$pid" 2>/dev/null); do
-              kill_tree "$child"
-            done
-            kill "$pid" 2>/dev/null || true
-          }
-          cleanup() {
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              echo "Stopping backend..."
-              kill_tree "$(cat "{{.BASE_DIR}}/backend.pid")"
-              sleep 1
-              lsof -ti:8080 2>/dev/null | xargs kill 2>/dev/null || true
-              echo "Backend stopped"
-            fi
-          }
-          # Trap so cleanup runs on every exit path: tests pass, tests fail,
-          # backend never starts, user Ctrl-Cs. Without this the gradle JVM
-          # is left orphaned holding :8080 whenever the wait loop times out.
-          trap cleanup EXIT INT TERM
-
-          echo "Waiting for backend on :8080 (up to 10min; first compile can be slow)..."
-          WAITED=0
-          while [ $WAITED -lt 600 ]; do
-            if curl -sf http://localhost:8080/api/v1/info/status 2>/dev/null | grep -q UP; then
-              echo "Backend ready, starting Playwright"
-              break
-            fi
-            # Bail early if the backend already died: no point waiting 10min.
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              BACKEND_PID=$(cat "{{.BASE_DIR}}/backend.pid")
-              if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
-                echo "Backend process exited before becoming ready; last 100 log lines:"
-                tail -100 "{{.BASE_DIR}}/backend.log" 2>/dev/null || true
-                exit 1
-              fi
-            fi
-            sleep 2
-            WAITED=$((WAITED + 2))
-          done
-          if [ $WAITED -ge 600 ]; then
-            echo "Backend did not become ready within 10min, aborting"
-            exit 1
-          fi
-
-          npx playwright test --project=live "$@"
-        ' bash {{.CLI_ARGS}}
-
-  enterprise:
-    desc: "Run enterprise E2E tests"
-    summary: |
-      Requires an already-running keycloak compose stack on :8080. Bring one
-      up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=enterprise {{.CLI_ARGS}}
-
-  cross-browser:
-    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend/editor
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
-
-  check:
-    desc: "Run all E2E tests not requiring Docker"
-    cmds:
-      - task: stubbed
-      - task: live
-
-  check:all:
-    desc: "Run all E2E tests"
-    summary: |
-      Includes the enterprise project, which requires a keycloak compose
-      stack on :8080. Bring one up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    cmds:
-      - task: stubbed
-      - task: live
-      - task: enterprise
-
-  oauth:up:
-    desc: "Start the OAuth keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:oauth:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:oauth:up -- --auto --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-oauth-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  oauth:down:
-    desc: "Stop the OAuth keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-oauth.yml down -v
-
-  saml:up:
-    desc: "Start the SAML keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:saml:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:saml:up -- --auto --with-storage --nobuild --language sv-SE
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-saml-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  saml:down:
-    desc: "Stop the SAML keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
@@ -86,9 +86,8 @@ tasks:
  fix:
    desc: "Auto-fix lint + format"
    cmds:
-      - task: format  # Can auto-fix some things that `lint:fix` can't like line length violations
      - task: lint:fix
-      - task: format  # Ensure that after lint fixing that the code is still formatted correctly
+      - task: format

  check:
    desc: "Full engine quality gate"
@@ -1,10 +1,5 @@
 version: '3'

-# Tasks operate from the workspace root (frontend/). Editor commands pass
-# `editor` as the vite project root (positional after `build` / before the
-# mode flag) or use `--project editor/...` for tsc — so the editor lives
-# under frontend/editor/ without each task needing a cd.
-
 tasks:
  install:
    desc: "Install dependencies"
@@ -26,19 +21,19 @@ tasks:
    vars:
      MODE: '{{.MODE | default ""}}'
    cmds:
-      - npx tsx editor/scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
+      - npx tsx scripts/setup-env.ts{{if .MODE}} --{{.MODE}}{{end}}
    sources:
-      - editor/scripts/setup-env.mts
+      - scripts/setup-env.ts
    generates:
-      - editor/.env.local
-      - editor/.env{{if .MODE}}.{{.MODE}}{{end}}.local
+      - .env.local
+      - .env{{if .MODE}}.{{.MODE}}{{end}}.local

  prepare:icons:
    internal: true
    run: once
    deps: [install]
    cmds:
-      - node editor/scripts/generate-icons.js
+      - node scripts/generate-icons.js

  prepare:
    desc: "Set up dev environment"
@@ -65,7 +60,7 @@ tasks:
    env:
      BACKEND_URL: '{{.BACKEND_URL}}'
    cmds:
-      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
+      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}

  dev:
    desc: "Start frontend dev server"
@@ -120,19 +115,19 @@ tasks:
    desc: "Production build (default mode)"
    deps: [prepare]
    cmds:
-      - npx vite build editor
+      - npx vite build

  build:core:
    desc: "Build for core mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode core
+      - npx vite build --mode core

  build:proprietary:
    desc: "Build for proprietary mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode proprietary
+      - npx vite build --mode proprietary

  build:saas:
    desc: "Build for SaaS mode"
@@ -140,7 +135,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx vite build editor --mode saas
+      - npx vite build --mode saas

  build:desktop:
    desc: "Build for desktop mode"
@@ -148,13 +143,13 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx vite build editor --mode desktop
+      - npx vite build --mode desktop

  build:prototypes:
    desc: "Build for prototypes mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode prototypes
+      - npx vite build --mode prototypes

  # ============================================================
  # Code quality
@@ -165,7 +160,7 @@ tasks:
    deps: [install]
    cmds:
      - npx eslint --max-warnings=0
-      - npx dpdm editor/src --circular --no-warning --no-tree --exit-code circular:1
+      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1

  lint:fix:
    desc: "Auto-fix lint issues"
@@ -200,13 +195,13 @@ tasks:
    desc: "Typecheck core build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/src/core/tsconfig.json
+      - npx tsc --noEmit --project src/core/tsconfig.json

  typecheck:proprietary:
    desc: "Typecheck proprietary build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/src/proprietary/tsconfig.json
+      - npx tsc --noEmit --project src/proprietary/tsconfig.json

  typecheck:saas:
    desc: "Typecheck SaaS build variant"
@@ -214,7 +209,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx tsc --noEmit --project editor/src/saas/tsconfig.json
+      - npx tsc --noEmit --project src/saas/tsconfig.json

  typecheck:desktop:
    desc: "Typecheck desktop build variant"
@@ -222,19 +217,19 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx tsc --noEmit --project editor/src/desktop/tsconfig.json
+      - npx tsc --noEmit --project src/desktop/tsconfig.json

  typecheck:scripts:
    desc: "Typecheck scripts"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/scripts/tsconfig.json
+      - npx tsc --noEmit --project scripts/tsconfig.json

  typecheck:prototypes:
    desc: "Typecheck prototypes build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/src/prototypes/tsconfig.json
+      - npx tsc --noEmit --project src/prototypes/tsconfig.json

  typecheck:all:
    desc: "Typecheck all build variants"
@@ -257,7 +252,6 @@ tasks:
      - task: lint
      - task: format:check
      - task: test
-      - task: theme:check-unused-vars

  check:all:
    desc: "Full CI quality gate"
@@ -276,19 +270,31 @@ tasks:
    desc: "Run tests"
    deps: [install]
    cmds:
-      - npx vitest run --root editor
+      - npx vitest run

  test:watch:
    desc: "Run tests in watch mode"
    deps: [install]
    cmds:
-      - npx vitest --watch --root editor
+      - npx vitest --watch

  test:coverage:
    desc: "Run tests with coverage"
    deps: [install]
    cmds:
-      - npx vitest --coverage --root editor
+      - npx vitest --coverage
+
+  test:e2e:
+    desc: "Run E2E tests"
+    deps: [prepare]
+    cmds:
+      - npx playwright test {{.CLI_ARGS}}
+
+  test:e2e:install:
+    desc: "Install E2E test browsers"
+    deps: [install]
+    cmds:
+      - npx playwright install {{.CLI_ARGS}} --with-deps

  # ============================================================
  # Code Generation
@@ -298,18 +304,4 @@ tasks:
    desc: "Generate frontend license report"
    deps: [install]
    cmds:
-      - node editor/scripts/generate-licenses.js
-
-  theme:clean-unused-vars:
-    desc: "Remove unused CSS variables from theme.css"
-    deps: [install]
-    vars:
-      REMOVE: '{{.REMOVE | default "false"}}'
-    cmds:
-      - node editor/scripts/clean-unused-theme-vars.js{{if eq .REMOVE "true"}} --remove{{end}} {{.CLI_ARGS}}
-
-  theme:check-unused-vars:
-    desc: "Fail if theme.css contains unused CSS variables"
-    deps: [install]
-    cmds:
-      - node editor/scripts/clean-unused-theme-vars.js --check
+      - node scripts/generate-licenses.js
@@ -10,14 +10,14 @@ When adding tools, follow this systematic approach using the established pattern

 Create these files in the correct directories:
 ```
-frontend/editor/src/hooks/tools/[toolName]/
+frontend/src/hooks/tools/[toolName]/
  ├── use[ToolName]Parameters.ts     # Parameter definitions and validation
  └── use[ToolName]Operation.ts      # Tool operation logic using useToolOperation

-frontend/editor/src/components/tools/[toolName]/
+frontend/src/components/tools/[toolName]/
  └── [ToolName]Settings.tsx         # Settings UI component (if needed)

-frontend/editor/src/tools/
+frontend/src/tools/
  └── [ToolName].tsx                 # Main tool component
 ```

@@ -128,7 +128,7 @@ export default [ToolName] as ToolComponent;
 ## 3. Register Tool in System
 Update these files to register your new tool:

-**Tool Registry** (`frontend/editor/src/data/useTranslatedToolRegistry.tsx`):
+**Tool Registry** (`frontend/src/data/useTranslatedToolRegistry.tsx`):
 1. Add imports at the top:
 ```typescript
 import [ToolName] from "../tools/[ToolName]";
@@ -155,7 +155,7 @@ import [ToolName]Settings from "../components/tools/[toolName]/[ToolName]Setting
 ## 4. Add Tooltips (Optional but Recommended)
 Create user-friendly tooltips to help non-technical users understand your tool. **Use simple, clear language - avoid technical jargon:**

-**Tooltip Hook** (`frontend/editor/src/components/tooltips/use[ToolName]Tips.ts`):
+**Tooltip Hook** (`frontend/src/components/tooltips/use[ToolName]Tips.ts`):
 ```typescript
 import { useTranslation } from 'react-i18next';
 import { TooltipContent } from '../../types/tips';
@@ -202,7 +202,7 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.

-**File to update:** `frontend/editor/public/locales/en-GB/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.toml`

 **Required Translation Keys**:
 ```toml
@@ -139,9 +139,9 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie

 #### Environment Variables
 - All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/editor/.env` — core, proprietary, and shared vars
-  - `frontend/editor/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/editor/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
+  - `frontend/.env` — core, proprietary, and shared vars
+  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
+  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
 - These files are committed to Git and must not contain private keys
 - Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
 - Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
@@ -152,7 +152,7 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 #### Import Paths - CRITICAL
 **ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.

-For a broader explanation of the frontend layering and override architecture, see [frontend/editor/DeveloperGuide.md](frontend/editor/DeveloperGuide.md).
+For a broader explanation of the frontend layering and override architecture, see [frontend/DeveloperGuide.md](frontend/DeveloperGuide.md).

 ```typescript
 // ✅ CORRECT - Use @app/* for all imports
@@ -183,26 +183,26 @@ Use this pattern for desktop-specific or proprietary-specific features WITHOUT r
 **Example - Desktop-specific footer:**

 ```typescript
-// core/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (stub)
-interface WorkbenchBarFooterExtensionsProps {
+// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
+interface RightRailFooterExtensionsProps {
  className?: string;
 }

-export function WorkbenchBarFooterExtensions(_props: WorkbenchBarFooterExtensionsProps) {
+export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
  return null; // Stub - does nothing in web builds
 }
 ```

 ```tsx
-// desktop/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (real implementation)
+// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
 import { Box } from '@mantine/core';
 import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';

-interface WorkbenchBarFooterExtensionsProps {
+interface RightRailFooterExtensionsProps {
  className?: string;
 }

-export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterExtensionsProps) {
+export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
  return (
    <Box className={className}>
      <BackendHealthIndicator />
@@ -212,15 +212,15 @@ export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterEx
 ```

 ```tsx
-// core/components/shared/WorkbenchBar.tsx (usage - works in ALL builds)
-import { WorkbenchBarFooterExtensions } from '@app/components/workbenchBar/WorkbenchBarFooterExtensions';
+// core/components/shared/RightRail.tsx (usage - works in ALL builds)
+import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';

-export function WorkbenchBar() {
+export function RightRail() {
  return (
    <div>
      {/* In web builds: renders nothing (stub returns null) */}
      {/* In desktop builds: renders BackendHealthIndicator */}
-      <WorkbenchBarFooterExtensions className="workbench-bar-footer" />
+      <RightRailFooterExtensions className="right-rail-footer" />
    </div>
  );
 }
@@ -243,7 +243,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `frontend/editor/src/core/contexts/FileContext.tsx`
+**Location**: `frontend/src/core/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -268,7 +268,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -356,7 +356,7 @@ return useToolOperation({
 ### Frontend Directory Structure
 The frontend is organized with a clear separation of concerns:

- **`frontend/editor/src/core/`**: Main application code (shared, production-ready components)
+- **`frontend/src/core/`**: Main application code (shared, production-ready components)
  - **`core/components/`**: React components organized by feature
    - `core/components/tools/`: Individual PDF tool implementations
    - `core/components/viewer/`: PDF viewer components
@@ -374,17 +374,17 @@ The frontend is organized with a clear separation of concerns:
  - **`core/data/`**: Static data (tool taxonomy, etc.)
  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)

- **`frontend/editor/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/editor/src/proprietary/`**: Proprietary/licensed features
- **`frontend/editor/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/editor/public/`**: Static assets served directly
+- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/src/proprietary/`**: Proprietary/licensed features
+- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/public/`**: Static assets served directly
  - `public/locales/`: Translation JSON files

 ### Component Architecture
- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/editor/public/` (modern)
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/editor/public/locales/` (converted from .properties)
+  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
  - Conversion Script: `scripts/convert_properties_to_json.py`

 ### Configuration Modes
@@ -409,7 +409,7 @@ The frontend is organized with a clear separation of concerns:
 4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
 5. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/editor/public/locales/` or use conversion script
+   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
 6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status
@@ -427,11 +427,11 @@ The frontend is organized with a clear separation of concerns:
 ## Translation Rules

 - **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
- Translation files are located in `frontend/editor/public/locales/`
+- Translation files are located in `frontend/public/locales/`

 ## Important Notes

- **Java Version**: Requires JDK 25.
+- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
 - **Lombok**: Used extensively - ensure IDE plugin is installed
 - **File Persistence**:
  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
@@ -458,26 +458,3 @@ The frontend is organized with a clear separation of concerns:
 - Confirm approach before making structural changes
 - Request guidance on preferences (cross-platform vs specific tools, etc.)
 - Verify understanding of requirements before proceeding
-
-
-## Stack reality check (don't trust LLM training data) <!-- bleeding-edge-stack-note -->
-
-This codebase is on bleeding-edge versions of its core JVM stack: **Spring Boot 4.0.6**,
-**Jackson 3 (`tools.jackson`)**, **JDK 21/25 source/target with JDK 25 toolchain**.
-All three are *post*-2024 releases and your training corpus is overwhelmingly Spring Boot 2/3 and
-Jackson 2 patterns — those patterns will compile, run differently, or hallucinate APIs that no
-longer exist.
-
-Before writing or editing Spring / Jackson / JDK code:
-
-1. Open an existing module in `app/core/` or `app/common/` and grep for the actual imports being
-   used — `import tools.jackson...` not `import com.fasterxml.jackson...`, and the new
-   `org.springframework.boot` 4.x package layout.
-2. If you're not sure whether an API exists in this stack version, **check the source on disk
-   first** (the dependency JARs are downloaded under `~/.gradle/caches/modules-2/`).
-3. Do not silently downgrade a Spring Boot 4 pattern to a Spring Boot 3 equivalent. If something
-   doesn't work, surface it to the human — don't guess.
-
-Same goes for Jackson 3's API surface (renamed `ObjectMapper` builder methods, new
-`tools.jackson.databind` namespace) and JDK 25 preview features. Ground your code in this repo's
-actual imports, not what worked three years ago.
@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:

 **Backend:**
- Spring Boot (requires JDK 25)
+- Spring Boot (Java 21+, JDK 25 recommended)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -45,7 +45,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
- Java JDK 25
+- Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
 - [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
@@ -61,7 +61,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
   cd Stirling-PDF
   ```

-2. Install Docker and JDK 25 if not already installed.
+2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.

 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
   1. Only VSCode
@@ -128,26 +128,24 @@ See [the frontend README](frontend/README.md#tauri) for detailed build instructi
 Stirling-PDF/
 ├── .github/               # GitHub-specific files (workflows, issue templates)
 ├── configs/               # Configuration files used by stirling at runtime (generated at runtime)
-├── frontend/              # Frontend workspace (Stirling 2.0)
-│   ├── editor/            # PDF editor app (the original React SPA)
-│   │   ├── src/
-│   │   │   ├── components/    # React components
-│   │   │   ├── tools/         # Tool-specific React components
-│   │   │   ├── hooks/         # Custom React hooks
-│   │   │   ├── services/      # API and utility services
-│   │   │   ├── types/         # TypeScript type definitions
-│   │   │   └── utils/         # Utility functions
-│   │   ├── src-tauri/     # Tauri desktop app configuration
-│   │   │   ├── src/           # Rust backend code
-│   │   │   ├── libs/          # JAR files (generated by build scripts)
-│   │   │   ├── runtime/       # Bundled JRE (generated by build scripts)
-│   │   │   ├── Cargo.toml     # Rust dependencies
-│   │   │   └── tauri.conf.json # Tauri configuration
-│   │   ├── public/
-│   │   │   └── locales/       # Internationalization files (JSON)
-│   │   └── vite.config.ts     # Vite configuration
-│   ├── package.json       # Shared workspace dependencies
-│   └── eslint.config.mjs  # Shared lint config
+├── frontend/              # React SPA frontend (Stirling 2.0)
+│   ├── src/
+│   │   ├── components/    # React components
+│   │   ├── tools/         # Tool-specific React components
+│   │   ├── hooks/         # Custom React hooks
+│   │   ├── services/      # API and utility services
+│   │   ├── types/         # TypeScript type definitions
+│   │   └── utils/         # Utility functions
+│   ├── src-tauri/         # Tauri desktop app configuration
+│   │   ├── src/           # Rust backend code
+│   │   ├── libs/          # JAR files (generated by build scripts)
+│   │   ├── runtime/       # Bundled JRE (generated by build scripts)
+│   │   ├── Cargo.toml     # Rust dependencies
+│   │   └── tauri.conf.json # Tauri configuration
+│   ├── public/
+│   │   └── locales/       # Internationalization files (JSON)
+│   ├── package.json       # Frontend dependencies
+│   └── vite.config.ts     # Vite configuration
 ├── customFiles/           # Custom static files and templates (generated at runtime used to replace existing files)
 ├── docs/                  # Documentation files
 ├── exampleYmlFiles/       # Example YAML configuration files
@@ -447,7 +445,7 @@ For Stirling 2.0, new features are built as React components:

 1. **Create the React Component:**
   ```typescript
-   // frontend/editor/src/tools/NewTool.tsx
+   // frontend/src/tools/NewTool.tsx
   import { useState } from 'react';
   import { Button, FileInput, Container } from '@mantine/core';

@@ -6,8 +6,6 @@ Portions of this software are licensed as follows:

 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "app/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
 * All content that resides under the "frontend/src/proprietary/" directory of this repository,
@@ -3,7 +3,7 @@ version: '3'
 output: prefixed

 vars:
-  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts/find-free-port.ps1
+  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts\find-free-port.ps1 -Preferred
  FIND_FREE_PORT_SH: bash scripts/find-free-port.sh

 includes:
@@ -22,9 +22,6 @@ includes:
  desktop:
    taskfile: .taskfiles/desktop.yml
    dir: frontend
-  e2e:
-    taskfile: .taskfiles/e2e.yml
-    dir: .

 tasks:
  # ============================================================
@@ -45,7 +42,7 @@ tasks:
    desc: "Start backend + frontend concurrently on free ports"
    vars:
      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
    deps:
@@ -62,7 +59,7 @@ tasks:
    desc: "Start backend + frontend + engine concurrently on free ports"
    vars:
      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173,5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
      ENGINE_PORT: '{{index (splitList "\n" .PORTS) 2}}'
@@ -74,7 +71,7 @@ tasks:
        vars:
          PORT: '{{.BACKEND_PORT}}'
          AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-      - task: frontend:dev
+      - task: frontend:dev:prototypes
        vars:
          PORT: '{{.FRONTEND_PORT}}'
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
@@ -86,7 +86,7 @@ If you're using Tauri's built-in updater feature:

 ## Configuration Files

-### 1. Tauri Configuration (frontend/editor/src-tauri/tauri.conf.json)
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)

 The Windows signing configuration is already set up:

@@ -51,33 +51,4 @@ dependencies {
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
    api 'jakarta.mail:jakarta.mail-api:2.1.5'
    runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
-
-    // Tabula table extraction — used by the shared PDF parser and directly by downstream modules.
-    // api-scoped so downstream modules (core, proprietary) retain it on their compile classpath.
-    api ('technology.tabula:tabula:1.0.5') {
-        exclude group: 'org.slf4j', module: 'slf4j-simple'
-        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
-        exclude group: 'com.google.code.gson', module: 'gson'
-    }
-
-    api 'com.stirling:jpdfium:1.0.1'
-
-    // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
-    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
-    def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
-    def jpdfiumPlatforms = jpdfiumPlatformsProp == 'all'
-            ? jpdfiumAllPlatforms
-            : jpdfiumPlatformsProp.split(',').collect { it.trim() }.findAll { it }
-    def jpdfiumInvalid = jpdfiumPlatforms.findAll { !jpdfiumAllPlatforms.contains(it) }
-    if (jpdfiumInvalid) {
-        throw new GradleException("Unknown jpdfiumPlatforms value(s): ${jpdfiumInvalid.join(', ')}. " +
-                "Valid: ${jpdfiumAllPlatforms.join(', ')} or 'all'.")
-    }
-    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
-    jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1"
-    }
-
-    // ArchUnit: enforces module dependency direction (see ArchitectureTest)
-    testImplementation 'com.tngtech.archunit:archunit-junit5:1.4.2'
 }
@@ -1,73 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.context.annotation.Primary;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
- * LineAlignmentTableParser}. The first parser returning a result above {@link
- * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
- */
-@Service
-@Primary
-@RequiredArgsConstructor
-@Slf4j
-public class CompositeTableParser implements TableParser {
-
-    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
-    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
-
-    private final TabulaTableParser tabulaParser;
-    private final LineAlignmentTableParser lineAlignmentParser;
-
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        // Step 1: Tabula lattice mode (ruled/bordered tables).
-        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
-        if (!latticeResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using Tabula lattice ({} table(s))",
-                    rawPage.pageNumber(),
-                    latticeResults.size());
-            return latticeResults;
-        }
-
-        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
-        // parseStream is not on the TableParser interface — this intentionally couples to the
-        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
-        List<TableFragment> streamResults =
-                filterConfident(tabulaParser.parseStream(document, rawPage));
-        if (!streamResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using Tabula stream ({} table(s))",
-                    rawPage.pageNumber(),
-                    streamResults.size());
-            return streamResults;
-        }
-
-        // Step 3: Geometry-based line-alignment fallback.
-        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
-        if (!lineResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using LineAlignment ({} table(s))",
-                    rawPage.pageNumber(),
-                    lineResults.size());
-            return lineResults;
-        }
-
-        return List.of();
-    }
-
-    private List<TableFragment> filterConfident(List<TableFragment> tables) {
-        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
-    }
-}
@@ -1,528 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.TreeMap;
-import java.util.regex.Pattern;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Fallback {@link TableParser} for borderless financial tables using text geometry.
- *
- * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
- * positions, groups vertically proximate anchor lines into table candidates, then scores each group
- * on column consistency and anchor density (confidence ceiling 0.85).
- */
-@Service
-@Slf4j
-public class LineAlignmentTableParser implements TableParser {
-
-    /** Width in points of each column position bucket. */
-    static final float COLUMN_BUCKET_PT = 5f;
-
-    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
-    private static final int COLUMN_MATCH_BUCKETS = 2;
-
-    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
-    private static final float MAX_GAP_FACTOR = 2.5f;
-
-    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
-    static final int MIN_TABLE_ROWS = 3;
-
-    /** Minimum confirmed column positions to form a valid table. */
-    static final int MIN_COLUMNS = 2;
-
-    /**
-     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
-     * rows).
-     */
-    private static final double COLUMN_MIN_FREQUENCY = 0.40;
-
-    /**
-     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
-     * percent, nil dashes.
-     */
-    private static final Pattern NUMERIC =
-            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
-
-    /**
-     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
-     * column-gap logic).
-     */
-    static final float ROW_MERGE_TOLERANCE_PT = 2f;
-
-    // ── public API ───────────────────────────────────────────────────────────────────────────────
-
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        List<RawLine> lines = rawPage.lines();
-        if (lines.size() < MIN_TABLE_ROWS) return List.of();
-
-        float modalSpacing = computeModalSpacing(lines);
-        List<TokenizedLine> tokenized =
-                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
-
-        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
-
-        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
-
-        List<Float> columnGrid = buildColumnGrid(anchors);
-        if (columnGrid.size() < MIN_COLUMNS) {
-            log.debug(
-                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
-                    rawPage.pageNumber(),
-                    MIN_COLUMNS);
-            return List.of();
-        }
-
-        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
-
-        List<TableFragment> results = new ArrayList<>();
-        for (int i = 0; i < groups.size(); i++) {
-            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
-                    .ifPresent(results::add);
-        }
-
-        log.debug(
-                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
-                rawPage.pageNumber(),
-                results.size(),
-                anchors.size(),
-                columnGrid.size());
-        return results;
-    }
-
-    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
-
-    /**
-     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
-     * split by LineBuilder.
-     */
-    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
-        if (tokenized.size() < 2) return tokenized;
-
-        List<TokenizedLine> result = new ArrayList<>();
-        int i = 0;
-
-        while (i < tokenized.size()) {
-            float baseY = tokenized.get(i).line().bounds().y();
-            int j = i + 1;
-            while (j < tokenized.size()
-                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
-                            <= ROW_MERGE_TOLERANCE_PT) {
-                j++;
-            }
-
-            if (j == i + 1) {
-                result.add(tokenized.get(i));
-            } else {
-                result.add(mergeGroup(tokenized.subList(i, j)));
-            }
-            i = j;
-        }
-
-        return result;
-    }
-
-    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
-        List<TextFragment> mergedFragments =
-                group.stream()
-                        .flatMap(tl -> tl.line().fragments().stream())
-                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
-                        .toList();
-
-        Bounds mergedBounds =
-                group.stream()
-                        .map(tl -> tl.line().bounds())
-                        .reduce(Bounds::merge)
-                        .orElse(group.get(0).line().bounds());
-
-        RawLine mergedLine =
-                new RawLine(
-                        group.get(0).line().lineId(),
-                        mergedFragments,
-                        mergedBounds,
-                        group.get(0).line().pageNumber());
-
-        return tokenize(mergedLine);
-    }
-
-    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
-     * fragment.
-     */
-    TokenizedLine tokenize(RawLine line) {
-        List<LineToken> tokens = new ArrayList<>();
-        for (TextFragment frag : line.fragments()) {
-            tokens.addAll(tokensFromFragment(frag));
-        }
-        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
-        return new TokenizedLine(line, tokens, numeric);
-    }
-
-    private List<LineToken> tokensFromFragment(TextFragment frag) {
-        String raw = frag.text();
-        if (raw == null || raw.isBlank()) return List.of();
-
-        float fragX = frag.bounds().x();
-        float fragWidth = frag.bounds().width();
-        int rawLen = raw.length();
-
-        List<LineToken> result = new ArrayList<>();
-        int offset = 0;
-        for (String part : raw.split("\\s+")) {
-            if (part.isEmpty()) {
-                offset++;
-                continue;
-            }
-            int idx = raw.indexOf(part, offset);
-            if (idx < 0) idx = offset;
-
-            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
-            float tokenRight =
-                    rawLen > 0
-                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
-                            : fragX + fragWidth;
-
-            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
-            offset = idx + part.length();
-        }
-        return result;
-    }
-
-    // ── column grid ──────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
-     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
-     */
-    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
-        // bucket → set of line indices that contributed a numeric token to that bucket
-        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
-        for (int i = 0; i < anchors.size(); i++) {
-            for (LineToken t : anchors.get(i).numeric()) {
-                int bucket = bucket(t.right());
-                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
-            }
-        }
-
-        int minHits =
-                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
-
-        // Confirmed buckets → average right-edge for that bucket
-        TreeMap<Integer, Float> confirmed = new TreeMap<>();
-        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
-            // Count distinct lines
-            long distinctLines = entry.getValue().stream().distinct().count();
-            if (distinctLines >= minHits) {
-                double avg =
-                        entry.getValue().stream()
-                                .distinct() // weight each line equally regardless of token count
-                                .mapToDouble(
-                                        lineIdx ->
-                                                avgRightEdgeForBucket(
-                                                        anchors, lineIdx, entry.getKey()))
-                                .average()
-                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
-                confirmed.put(entry.getKey(), (float) avg);
-            }
-        }
-
-        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
-    }
-
-    /**
-     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
-     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
-     */
-    private double avgRightEdgeForBucket(
-            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
-        return anchors.get(lineIdx).numeric().stream()
-                .filter(t -> bucket(t.right()) == targetBucket)
-                .mapToDouble(LineToken::right)
-                .average()
-                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
-    }
-
-    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
-     * MAX_GAP_FACTOR × modal spacing splits groups.
-     */
-    private List<List<TokenizedLine>> groupRows(
-            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
-        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
-
-        List<List<TokenizedLine>> groups = new ArrayList<>();
-        List<TokenizedLine> current = new ArrayList<>();
-
-        for (int i = 0; i < all.size(); i++) {
-            TokenizedLine tl = all.get(i);
-            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
-
-            if (current.isEmpty()) {
-                if (fits) current.add(tl);
-                continue;
-            }
-
-            float gap =
-                    tl.line().bounds().y()
-                            - current.get(current.size() - 1).line().bounds().bottom();
-
-            if (gap > maxGap) {
-                groups.add(current);
-                current = new ArrayList<>();
-                if (fits) current.add(tl);
-                continue;
-            }
-
-            if (fits) {
-                current.add(tl);
-            } else if (!tl.line().text().isBlank()) {
-                // Include non-anchor lines (labels) only if they have text and are within
-                // proximity.
-                current.add(tl);
-            }
-        }
-
-        if (!current.isEmpty()) groups.add(current);
-
-        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
-    }
-
-    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
-        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
-                >= MIN_TABLE_ROWS;
-    }
-
-    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
-    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
-        if (tl.numeric().isEmpty()) return false;
-        long matches =
-                tl.numeric().stream()
-                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
-                        .count();
-        return (double) matches / tl.numeric().size() >= 0.60;
-    }
-
-    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
-        if (tl.numeric().isEmpty()) return false;
-        long hits =
-                tl.numeric().stream()
-                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
-                        .count();
-        return (double) hits / tl.numeric().size() < 0.60;
-    }
-
-    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
-
-    private Optional<TableFragment> buildFragment(
-            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
-
-        long anchorCount =
-                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
-        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
-
-        List<String> warnings = new ArrayList<>();
-        List<List<String>> rawRows = new ArrayList<>();
-        List<TableRow> rows = new ArrayList<>();
-
-        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
-            TokenizedLine tl = group.get(rowIdx);
-            List<String> rawRow = buildRawRow(tl, columnGrid);
-            rawRows.add(Collections.unmodifiableList(rawRow));
-            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
-        }
-
-        // Column count = 1 label column + confirmed numeric columns
-        int colCount = columnGrid.size() + 1;
-        Bounds bounds = computeGroupBounds(group);
-        float confidence = computeConfidence(group, columnGrid, warnings);
-
-        return Optional.of(
-                new TableFragment(
-                        "tbl-la-p" + pageNumber + "-" + tableIndex,
-                        pageNumber,
-                        bounds,
-                        List.of(),
-                        Collections.unmodifiableList(rows),
-                        Collections.unmodifiableList(rawRows),
-                        colCount,
-                        confidence,
-                        Collections.unmodifiableList(warnings),
-                        null));
-    }
-
-    /**
-     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
-     */
-    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
-        String[] cells = new String[columnGrid.size() + 1];
-        Arrays.fill(cells, "");
-
-        // Separate label tokens (those not landing in any confirmed column) from column tokens.
-        List<String> labelParts = new ArrayList<>();
-        for (LineToken token : tl.all()) {
-            int col = nearestColumnIndex(token.right(), columnGrid);
-            if (col >= 0 && token.numeric()) {
-                int cellIdx = col + 1;
-                cells[cellIdx] =
-                        cells[cellIdx].isEmpty()
-                                ? token.text()
-                                : cells[cellIdx] + " " + token.text();
-            } else {
-                labelParts.add(token.text());
-            }
-        }
-        cells[0] = String.join(" ", labelParts).trim();
-        return Arrays.asList(cells);
-    }
-
-    private TableRow buildTableRow(
-            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
-        List<TableCell> cells = new ArrayList<>(rawRow.size());
-
-        // Label cell: use the line's full bounds as an approximation.
-        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
-
-        for (int col = 0; col < columnGrid.size(); col++) {
-            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
-            float right = columnGrid.get(col);
-            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
-            Bounds cellBounds =
-                    new Bounds(
-                            left,
-                            tl.line().bounds().y(),
-                            right - left,
-                            tl.line().bounds().height());
-            cells.add(TableCell.of(col + 1, text, cellBounds));
-        }
-        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
-    }
-
-    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
-
-    /**
-     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
-     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
-     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
-     */
-    private float computeConfidence(
-            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
-        float score = 0.70f;
-
-        long anchorCount =
-                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
-        long totalRows = group.size();
-
-        // More columns
-        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
-        score += extraCols * 0.05f;
-
-        // More anchor rows
-        if (anchorCount >= 5) score += 0.05f;
-        if (anchorCount >= 8) score += 0.05f;
-
-        // Inconsistent column matching
-        long inconsistent =
-                group.stream()
-                        .filter(TokenizedLine::isAnchor)
-                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
-                        .count();
-        if (inconsistent > anchorCount * 0.30) {
-            score -= 0.15f;
-            warnings.add(
-                    "Column match inconsistent on "
-                            + inconsistent
-                            + "/"
-                            + anchorCount
-                            + " anchor rows");
-        }
-
-        // Label-heavy
-        long nonAnchor = totalRows - anchorCount;
-        if (nonAnchor > anchorCount) {
-            score -= 0.10f;
-            warnings.add(
-                    "Non-anchor rows ("
-                            + nonAnchor
-                            + ") outnumber anchor rows ("
-                            + anchorCount
-                            + ")");
-        }
-
-        return Math.max(0f, Math.min(0.85f, score));
-    }
-
-    // ── utility ──────────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
-     * #COLUMN_MATCH_BUCKETS} buckets.
-     */
-    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
-        int nearest = -1;
-        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
-        for (int i = 0; i < grid.size(); i++) {
-            float dist = Math.abs(rightEdge - grid.get(i));
-            if (dist < minDist) {
-                minDist = dist;
-                nearest = i;
-            }
-        }
-        return nearest;
-    }
-
-    private Bounds computeGroupBounds(List<TokenizedLine> group) {
-        return group.stream()
-                .map(tl -> tl.line().bounds())
-                .reduce(Bounds::merge)
-                .orElse(new Bounds(0, 0, 0, 0));
-    }
-
-    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
-    private float computeModalSpacing(List<RawLine> lines) {
-        if (lines.size() < 2) return 0f;
-        Map<Float, Long> freq = new HashMap<>();
-        for (int i = 1; i < lines.size(); i++) {
-            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
-            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
-        }
-        return freq.entrySet().stream()
-                .max(Map.Entry.comparingByValue())
-                .map(Map.Entry::getKey)
-                .orElse(0f);
-    }
-
-    private static int bucket(float x) {
-        return Math.round(x / COLUMN_BUCKET_PT);
-    }
-
-    // ── private data types ───────────────────────────────────────────────────────────────────────
-
-    /** A word-level token with an approximate right-edge x-position. */
-    record LineToken(String text, float x, float right, boolean numeric) {}
-
-    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
-    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
-        boolean isAnchor() {
-            return numeric.size() >= 2;
-        }
-    }
-}
@@ -1,139 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.List;
-
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
- *
- * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
- * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
- * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
- */
-@Service
-@Slf4j
-public class LineBuilder {
-
-    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
-    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
-
-    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
-    private static final float MIN_BASELINE_TOLERANCE = 2f;
-
-    /**
-     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
-     * two-column gutters.
-     */
-    static final float COLUMN_GAP_RATIO = 0.10f;
-
-    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
-    static final float COLUMN_GAP_MIN_PT = 40f;
-
-    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
-        if (fragments.isEmpty()) return List.of();
-
-        float effectiveWidth = inferEffectiveWidth(fragments);
-        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
-        log.debug(
-                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
-                pageNumber,
-                effectiveWidth,
-                columnGapThreshold);
-
-        // Sort top-to-bottom first, then left-to-right within the same baseline band.
-        List<TextFragment> sorted =
-                fragments.stream()
-                        .sorted(
-                                Comparator.comparingDouble(TextFragment::baseline)
-                                        .thenComparingDouble(f -> f.bounds().x()))
-                        .toList();
-
-        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
-
-        List<RawLine> lines = new ArrayList<>(groups.size());
-        for (int i = 0; i < groups.size(); i++) {
-            List<TextFragment> group =
-                    groups.get(i).stream()
-                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
-                            .toList();
-
-            Bounds lineBounds =
-                    group.stream()
-                            .map(TextFragment::bounds)
-                            .reduce(Bounds::merge)
-                            .orElse(new Bounds(0, 0, 0, 0));
-
-            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
-        }
-        return lines;
-    }
-
-    private List<List<TextFragment>> groupByBaseline(
-            List<TextFragment> sorted, float columnGapThreshold) {
-        List<List<TextFragment>> groups = new ArrayList<>();
-        List<TextFragment> current = new ArrayList<>();
-        float currentBaseline = Float.NaN;
-
-        for (TextFragment fragment : sorted) {
-            if (current.isEmpty()) {
-                current.add(fragment);
-                currentBaseline = fragment.baseline();
-                continue;
-            }
-
-            float maxFontSize =
-                    Math.max(
-                            fragment.fontSize(),
-                            (float)
-                                    current.stream()
-                                            .mapToDouble(TextFragment::fontSize)
-                                            .max()
-                                            .orElse(0));
-            float tolerance =
-                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
-
-            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
-            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
-
-            if (sameBaseline && !columnGap) {
-                current.add(fragment);
-                // Anchor to the weighted mean baseline so long lines stay stable.
-                currentBaseline =
-                        (currentBaseline * (current.size() - 1) + fragment.baseline())
-                                / current.size();
-            } else {
-                groups.add(current);
-                current = new ArrayList<>();
-                current.add(fragment);
-                currentBaseline = fragment.baseline();
-            }
-        }
-
-        if (!current.isEmpty()) groups.add(current);
-        return groups;
-    }
-
-    /**
-     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
-     * threshold}.
-     */
-    private static boolean hasColumnGap(
-            TextFragment next, List<TextFragment> group, float threshold) {
-        float lastRight = group.get(group.size() - 1).bounds().right();
-        return next.bounds().x() - lastRight > threshold;
-    }
-
-    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
-    private static float inferEffectiveWidth(List<TextFragment> fragments) {
-        double maxRight =
-                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
-        return (float) maxRight * 1.10f;
-    }
-}
@@ -1,79 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
- * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
- * {@link PDDocument} lifecycle.
- */
-@Service
-@RequiredArgsConstructor
-@Slf4j
-public class PdfIngester {
-
-    private final LineBuilder lineBuilder;
-    private final TableParser tableParser;
-
-    public List<ParsedPage> parse(PDDocument document) throws IOException {
-        return parse(document, document.getNumberOfPages());
-    }
-
-    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
-        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
-        List<ParsedPage> pages = new ArrayList<>(pageCount);
-        long fragmentsMs = 0;
-        long tablesMs = 0;
-        long t0 = System.currentTimeMillis();
-
-        for (int p = 1; p <= pageCount; p++) {
-            long ft = System.currentTimeMillis();
-            List<TextFragment> fragments = extractFragments(document, p);
-            fragmentsMs += System.currentTimeMillis() - ft;
-
-            PDPage page = document.getPage(p - 1);
-            PDRectangle mediaBox = page.getMediaBox();
-            List<RawLine> lines = lineBuilder.build(fragments, p);
-            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
-
-            long tt = System.currentTimeMillis();
-            List<TableFragment> tables = tableParser.parse(document, rawPage);
-            tablesMs += System.currentTimeMillis() - tt;
-
-            log.debug(
-                    "Page {}: {} fragments → {} lines, {} table(s)",
-                    p,
-                    fragments.size(),
-                    lines.size(),
-                    tables.size());
-            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
-        }
-
-        log.info(
-                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
-                pageCount,
-                System.currentTimeMillis() - t0,
-                fragmentsMs,
-                tablesMs);
-        return pages;
-    }
-
-    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
-            throws IOException {
-        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
-        stripper.getText(document);
-        return stripper.getFragments();
-    }
-}
@@ -1,148 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.io.IOException;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-
-/**
- * All PDF parser model types and the table-parser contract in one place.
- *
- * <p>Import as {@code import static stirling.software.SPDF.pdf.parser.PdfModels.*;} to use all
- * nested types without qualification.
- */
-public final class PdfModels {
-
-    private PdfModels() {}
-
-    // ── Geometry ──────────────────────────────────────────────────────────────
-
-    public record Bounds(float x, float y, float width, float height) {
-
-        public float right() {
-            return x + width;
-        }
-
-        public float bottom() {
-            return y + height;
-        }
-
-        public static Bounds merge(Bounds a, Bounds b) {
-            float x = Math.min(a.x, b.x);
-            float y = Math.min(a.y, b.y);
-            return new Bounds(
-                    x, y, Math.max(a.right(), b.right()) - x, Math.max(a.bottom(), b.bottom()) - y);
-        }
-    }
-
-    // ── Text fragments and lines ──────────────────────────────────────────────
-
-    /**
-     * A contiguous run of text from a single PDF content-stream string operation. {@code baseline}
-     * is preserved separately from bounds for line-grouping — characters of different sizes on the
-     * same visual line share a baseline but differ in top Y.
-     */
-    public record TextFragment(
-            String fragmentId,
-            String text,
-            Bounds bounds,
-            float baseline,
-            float fontSize,
-            String fontName,
-            boolean bold) {}
-
-    public record RawLine(
-            String lineId, List<TextFragment> fragments, Bounds bounds, int pageNumber) {
-
-        public String text() {
-            if (fragments.isEmpty()) return "";
-            StringBuilder sb = new StringBuilder();
-            TextFragment prev = null;
-            for (TextFragment f : fragments) {
-                if (prev != null) {
-                    float gap = f.bounds().x() - prev.bounds().right();
-                    float avgCharWidth = prev.bounds().width() / Math.max(prev.text().length(), 1);
-                    if (gap > avgCharWidth * 0.5f) sb.append(' ');
-                }
-                sb.append(f.text());
-                prev = f;
-            }
-            return sb.toString();
-        }
-
-        public float dominantFontSize() {
-            return fragments.stream()
-                    .collect(Collectors.groupingBy(TextFragment::fontSize, Collectors.counting()))
-                    .entrySet()
-                    .stream()
-                    .max(Map.Entry.comparingByValue())
-                    .map(Map.Entry::getKey)
-                    .orElse(0f);
-        }
-
-        public boolean hasBold() {
-            return fragments.stream().anyMatch(TextFragment::bold);
-        }
-    }
-
-    public record RawPage(int pageNumber, float widthPt, float heightPt, List<RawLine> lines) {}
-
-    // ── Table model ───────────────────────────────────────────────────────────
-
-    /**
-     * A single cell within a {@link TableRow}. {@code colSpan} and {@code rowSpan} are always 1 in
-     * v1 — span detection is deferred but the fields keep the schema stable.
-     */
-    public record TableCell(int colIndex, String text, Bounds bounds, int colSpan, int rowSpan) {
-
-        public static TableCell of(int colIndex, String text, Bounds bounds) {
-            return new TableCell(colIndex, text, bounds, 1, 1);
-        }
-    }
-
-    public record TableRow(int rowIndex, List<TableCell> cells) {}
-
-    /**
-     * A table as it appears on a single page. {@code headers} is empty in v1 — all rows are in
-     * {@code rows}. {@code rawRows} preserves exact Tabula text output for diagnostics. {@code
-     * confidence} is a heuristic score in [0.0, 1.0]. {@code continuedFromPage} is null in v1.
-     */
-    public record TableFragment(
-            String tableId,
-            int pageNumber,
-            Bounds bounds,
-            List<TableRow> headers,
-            List<TableRow> rows,
-            List<List<String>> rawRows,
-            int columnCount,
-            float confidence,
-            List<String> warnings,
-            Integer continuedFromPage) {}
-
-    // ── Page output ───────────────────────────────────────────────────────────
-
-    public record ParsedPage(
-            int pageNumber,
-            float widthPt,
-            float heightPt,
-            List<TableFragment> tables,
-            List<RawLine> layoutLines) {}
-
-    // ── Parser contract ───────────────────────────────────────────────────────
-
-    /**
-     * Extracts tables from a single page of a PDF. The caller owns the document lifecycle;
-     * implementations must not close it.
-     */
-    public interface TableParser {
-
-        /**
-         * @param document open PDF; must not be closed by the implementation
-         * @param rawPage page metadata and lines for the page to process
-         * @return zero or more table fragments found on the page, never null
-         */
-        List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException;
-    }
-}
@@ -1,256 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-import technology.tabula.ObjectExtractor;
-import technology.tabula.Page;
-import technology.tabula.RectangularTextContainer;
-import technology.tabula.Table;
-import technology.tabula.extractors.BasicExtractionAlgorithm;
-import technology.tabula.extractors.ExtractionAlgorithm;
-import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
-
-/**
- * Primary {@link TableParser} implementation using Tabula's lattice-mode extraction.
- *
- * <h3>Algorithm</h3>
- *
- * Uses {@link SpreadsheetExtractionAlgorithm} (lattice mode), which detects tables from ruled lines
- * (horizontal and vertical PDF path operators). This is reliable for tables with visible borders.
- * Borderless or whitespace-delimited tables will not be detected — that requires stream mode, which
- * is deferred to a later iteration.
- *
- * <h3>Coordinate system</h3>
- *
- * Tabula normalises page coordinates so that (0,0) is the top-left corner and Y increases downward,
- * matching the {@link Bounds} convention used throughout this parser. No coordinate transformation
- * is needed when mapping Tabula cell bounds to {@link Bounds}.
- *
- * <h3>Known limitations</h3>
- *
- * <ul>
- *   <li>Borderless tables are not detected (use stream mode, deferred).
- *   <li>Colspan and rowspan are not detected; all cells report colSpan=1, rowSpan=1.
- *   <li>Header rows are not identified; all rows appear in {@code rows}, headers is empty.
- *   <li>Cross-page table linking is not performed; each page is independent.
- *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
- * </ul>
- */
-@Service
-@Slf4j
-public class TabulaTableParser implements TableParser {
-
-    /** Lattice mode — reliable for tables with visible ruled borders. */
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        return parseWithAlgorithm(
-                document, rawPage, new SpreadsheetExtractionAlgorithm(), "lattice");
-    }
-
-    /**
-     * Convenience overload for callers that only have a page number, not a full {@link RawPage}.
-     */
-    public List<TableFragment> parse(PDDocument document, int pageNumber) throws IOException {
-        return parse(document, new RawPage(pageNumber, 0f, 0f, List.of()));
-    }
-
-    /** Stream mode — whitespace-based column detection for borderless tables. */
-    public List<TableFragment> parseStream(PDDocument document, RawPage rawPage)
-            throws IOException {
-        return parseWithAlgorithm(document, rawPage, new BasicExtractionAlgorithm(), "stream");
-    }
-
-    private List<TableFragment> parseWithAlgorithm(
-            PDDocument document, RawPage rawPage, ExtractionAlgorithm algorithm, String modeName)
-            throws IOException {
-        int pageNumber = rawPage.pageNumber();
-
-        List<Table> tabulaTables;
-        try {
-            // Do NOT use try-with-resources: ObjectExtractor.close() closes the underlying
-            // PDDocument, which we don't own. The extractor holds no resources of its own.
-            ObjectExtractor extractor = new ObjectExtractor(document);
-            Page page = extractor.extract(pageNumber);
-            tabulaTables = new ArrayList<>(algorithm.extract(page));
-        } catch (Exception e) {
-            log.warn(
-                    "Tabula {} extraction failed on page {}: {}",
-                    modeName,
-                    pageNumber,
-                    e.getMessage());
-            return List.of();
-        }
-
-        if (tabulaTables.isEmpty()) {
-            log.debug("Page {}: no tables detected by Tabula ({})", pageNumber, modeName);
-            return List.of();
-        }
-
-        log.debug(
-                "Page {}: Tabula ({}) detected {} table(s)",
-                pageNumber,
-                modeName,
-                tabulaTables.size());
-
-        List<TableFragment> fragments = new ArrayList<>(tabulaTables.size());
-        for (int i = 0; i < tabulaTables.size(); i++) {
-            fragments.add(toFragment(tabulaTables.get(i), pageNumber, i));
-        }
-        return fragments;
-    }
-
-    // ── private helpers ──────────────────────────────────────────────────────────────────────────
-
-    private TableFragment toFragment(Table table, int pageNumber, int tableIndex) {
-        List<List<RectangularTextContainer>> tabulaRows = table.getRows();
-        List<String> warnings = new ArrayList<>();
-
-        List<List<String>> rawRows = buildRawRows(tabulaRows);
-        int colCount = inferColumnCount(rawRows, warnings);
-        List<TableRow> rows = buildRows(tabulaRows, colCount, warnings);
-        float confidence = computeConfidence(rawRows, colCount, warnings);
-        Bounds bounds = tableBounds(table);
-
-        String tableId = "tbl-p" + pageNumber + "-" + tableIndex;
-
-        if (!warnings.isEmpty()) {
-            log.warn("Page {}, table {}: {}", pageNumber, tableIndex, warnings);
-        }
-
-        return new TableFragment(
-                tableId,
-                pageNumber,
-                bounds,
-                List.of(), // headers: deferred to v2
-                rows,
-                rawRows,
-                colCount,
-                confidence,
-                Collections.unmodifiableList(warnings),
-                null); // continuedFromPage: deferred to v2
-    }
-
-    private List<List<String>> buildRawRows(List<List<RectangularTextContainer>> tabulaRows) {
-        List<List<String>> rawRows = new ArrayList<>(tabulaRows.size());
-        for (List<RectangularTextContainer> tabulaRow : tabulaRows) {
-            List<String> cells = new ArrayList<>(tabulaRow.size());
-            for (RectangularTextContainer cell : tabulaRow) {
-                cells.add(normaliseText(cell.getText()));
-            }
-            rawRows.add(Collections.unmodifiableList(cells));
-        }
-        return rawRows;
-    }
-
-    private List<TableRow> buildRows(
-            List<List<RectangularTextContainer>> tabulaRows, int colCount, List<String> warnings) {
-        List<TableRow> rows = new ArrayList<>(tabulaRows.size());
-        for (int rowIdx = 0; rowIdx < tabulaRows.size(); rowIdx++) {
-            List<RectangularTextContainer> tabulaRow = tabulaRows.get(rowIdx);
-            List<TableCell> cells = new ArrayList<>(tabulaRow.size());
-
-            for (int colIdx = 0; colIdx < tabulaRow.size(); colIdx++) {
-                RectangularTextContainer c = tabulaRow.get(colIdx);
-                Bounds cellBounds =
-                        new Bounds(
-                                (float) c.getX(),
-                                (float) c.getY(),
-                                (float) c.getWidth(),
-                                (float) c.getHeight());
-                cells.add(TableCell.of(colIdx, normaliseText(c.getText()), cellBounds));
-            }
-
-            if (tabulaRow.size() != colCount) {
-                warnings.add(
-                        "Row "
-                                + rowIdx
-                                + " has "
-                                + tabulaRow.size()
-                                + " cells; expected "
-                                + colCount);
-            }
-
-            rows.add(new TableRow(rowIdx, Collections.unmodifiableList(cells)));
-        }
-        return rows;
-    }
-
-    /**
-     * The canonical column count for a table is the size of the widest row. Tabula can produce
-     * uneven rows when a cell's ruling lines are partially missing.
-     */
-    private int inferColumnCount(List<List<String>> rawRows, List<String> warnings) {
-        if (rawRows.isEmpty()) return 0;
-        int max = rawRows.stream().mapToInt(List::size).max().orElse(0);
-        int mode =
-                rawRows.stream()
-                        .collect(
-                                java.util.stream.Collectors.groupingBy(
-                                        List::size, java.util.stream.Collectors.counting()))
-                        .entrySet()
-                        .stream()
-                        .max(java.util.Map.Entry.comparingByValue())
-                        .map(java.util.Map.Entry::getKey)
-                        .orElse(0);
-        if (max != mode) {
-            warnings.add("Inconsistent column count: modal=" + mode + " max=" + max);
-        }
-        return mode > 0 ? mode : max;
-    }
-
-    /**
-     * Heuristic confidence score in [0.0, 1.0].
-     *
-     * <ul>
-     *   <li>Starts at 1.0.
-     *   <li>-0.3 if only one column (single-column tables are usually not real tables).
-     *   <li>-0.1 per row with an inconsistent column count, capped at -0.4.
-     *   <li>-0.3 if the empty-cell ratio across all cells exceeds 80%.
-     * </ul>
-     */
-    private float computeConfidence(
-            List<List<String>> rawRows, int colCount, List<String> warnings) {
-        if (rawRows.isEmpty() || colCount == 0) return 0f;
-
-        float score = 1.0f;
-
-        if (colCount == 1) score -= 0.3f;
-
-        long inconsistentRows = rawRows.stream().filter(r -> r.size() != colCount).count();
-        score -= Math.min(inconsistentRows * 0.1f, 0.4f);
-
-        long totalCells = rawRows.stream().mapToLong(List::size).sum();
-        long emptyCells =
-                rawRows.stream().flatMap(Collection::stream).filter(String::isBlank).count();
-        if (totalCells > 0 && (float) emptyCells / totalCells > 0.8f) {
-            score -= 0.3f;
-        }
-
-        return Math.max(0f, Math.min(1f, score));
-    }
-
-    private Bounds tableBounds(Table table) {
-        return new Bounds(
-                (float) table.getX(),
-                (float) table.getY(),
-                (float) table.getWidth(),
-                (float) table.getHeight());
-    }
-
-    private String normaliseText(String raw) {
-        if (raw == null) return "";
-        // Tabula wraps multi-line cell content with \r\n — collapse to a single space.
-        return raw.replace("\r\n", " ").replace("\n", " ").replace("\r", " ").trim();
-    }
-}
@@ -1,113 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.font.PDFont;
-import org.apache.pdfbox.text.PDFTextStripper;
-import org.apache.pdfbox.text.TextPosition;
-
-/**
- * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
- *
- * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
- * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
- * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
- */
-class WordExtractingStripper extends PDFTextStripper {
-
-    private final int targetPage;
-    private final List<TextFragment> fragments = new ArrayList<>();
-    private int fragmentIndex = 0;
-
-    WordExtractingStripper(int pageNumber) throws IOException {
-        this.targetPage = pageNumber;
-        setStartPage(pageNumber);
-        setEndPage(pageNumber);
-        setSortByPosition(true);
-    }
-
-    @Override
-    protected void startPage(PDPage page) throws IOException {
-        super.startPage(page);
-        fragments.clear();
-        fragmentIndex = 0;
-    }
-
-    @Override
-    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
-        if (text == null || text.isBlank()) return;
-
-        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
-        // number as its own string operation, so this is the common case).
-        if (text.indexOf(' ') < 0) {
-            emitFragment(text, textPositions);
-            return;
-        }
-
-        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
-        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
-        if (textPositions.size() != text.length()) {
-            emitFragment(text, textPositions);
-            return;
-        }
-
-        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
-        int start = 0;
-        for (int i = 0; i <= text.length(); i++) {
-            if (i == text.length() || text.charAt(i) == ' ') {
-                if (start < i) {
-                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
-                }
-                start = i + 1;
-            }
-        }
-    }
-
-    private void emitFragment(String text, List<TextPosition> positions) {
-        if (positions.isEmpty()) return;
-
-        float minX = Float.MAX_VALUE;
-        float minY = Float.MAX_VALUE;
-        float maxRight = -Float.MAX_VALUE;
-        float maxBaseline = -Float.MAX_VALUE;
-        TextPosition first = null;
-
-        for (TextPosition tp : positions) {
-            if (tp == null) continue;
-            if (first == null) first = tp;
-
-            float x = tp.getX();
-            // getY() is the baseline; top of character = getY() - getHeight().
-            float top = tp.getY() - tp.getHeight();
-            float right = x + tp.getWidth();
-            float baseline = tp.getY();
-
-            minX = Math.min(minX, x);
-            minY = Math.min(minY, top);
-            maxRight = Math.max(maxRight, right);
-            maxBaseline = Math.max(maxBaseline, baseline);
-        }
-
-        if (first == null) return;
-
-        PDFont font = first.getFont();
-        String fontName = font != null ? font.getName() : "";
-        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
-        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
-        float fontSize = first.getHeight();
-
-        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
-        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
-        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
-    }
-
-    List<TextFragment> getFragments() {
-        return Collections.unmodifiableList(fragments);
-    }
-}
@@ -75,8 +75,8 @@ public @interface AutoJobPostMapping {
    boolean queueable() default false;

    /**
-     * Relative resource weight (1-100). See {@link
-     * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
+     * Relative resource weight (1–100) used by the scheduler to prioritise / throttle jobs. Values
+     * below 1 are clamped to&nbsp;1, values above 100 to&nbsp;100.
     */
-    int resourceWeight() default 1;
+    int resourceWeight() default 50;
 }
@@ -59,18 +59,6 @@ public class InstallationPathConfig {
    }

    private static String initializeBasePath() {
-        // Allow tests / harnesses to redirect the entire state tree (configs,
-        // backups, customFiles, pipeline, logs) to an isolated location via
-        // -Dstirling.base-path=... or STIRLING_BASE_PATH=... so a Playwright
-        // run never touches a developer's working state.
-        String override = System.getProperty("stirling.base-path");
-        if (override == null || override.isBlank()) {
-            override = System.getenv("STIRLING_BASE_PATH");
-        }
-        if (override != null && !override.isBlank()) {
-            boolean hasTrailingSeparator = override.endsWith("/") || override.endsWith("\\");
-            return hasTrailingSeparator ? override : override + File.separator;
-        }
        return "." + File.separator;
    }

@@ -1,22 +0,0 @@
-package stirling.software.common.enumeration;
-
-/**
- * Standard resource-weight tiers for {@link
- * stirling.software.common.annotations.AutoJobPostMapping#resourceWeight()}.
- */
-public final class ResourceWeight {
-
-    /** Lightweight: rotate, page numbers, extract pages, permissions, etc. */
-    public static final int SMALL_WEIGHT = 1;
-
-    /** Medium: merge, split, multi-tool batch. */
-    public static final int MEDIUM_WEIGHT = 3;
-
-    /** Heavy: compress, OCR (small), conversions, raster. */
-    public static final int LARGE_WEIGHT = 5;
-
-    /** Extra heavy: OCR on large files, full-document re-render, AI-assisted edits. */
-    public static final int XLARGE_WEIGHT = 10;
-
-    private ResourceWeight() {}
-}
@@ -76,7 +76,6 @@ public class ApplicationProperties {
    private ProcessExecutor processExecutor = new ProcessExecutor();
    private PdfEditor pdfEditor = new PdfEditor();
    private AiEngine aiEngine = new AiEngine();
-    private InternalApi internalApi = new InternalApi();

    @Bean
    public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -97,14 +96,7 @@ public class ApplicationProperties {
        EncodedResource encodedResource = new EncodedResource(resource);
        PropertySource<?> propertySource =
                new YamlPropertySourceFactory().createPropertySource(null, encodedResource);
-
-        boolean saasActive = Arrays.asList(environment.getActiveProfiles()).contains("saas");
-        if (saasActive) {
-            // Saas-pinned values in application-saas.properties must beat settings.yml.
-            environment.getPropertySources().addLast(propertySource);
-        } else {
-            environment.getPropertySources().addFirst(propertySource);
-        }
+        environment.getPropertySources().addFirst(propertySource);

        log.debug("Loaded properties: {}", propertySource.getSource());

@@ -254,19 +246,6 @@ public class ApplicationProperties {
        private int longRunningTimeoutSeconds = 600;
    }

-    /**
-     * HTTP timeouts for loopback calls to internal Stirling API endpoints, used by the AI workflow
-     * executor and the pipeline processor. A bounded read timeout prevents a hung tool (e.g. an
-     * infinite loop in a PDF processing service) from stalling the entire chat workflow forever.
-     * Tools that legitimately need longer than the read timeout should be invoked through the async
-     * job executor instead of synchronously.
-     */
-    @Data
-    public static class InternalApi {
-        private int connectTimeoutSeconds = 10;
-        private int readTimeoutSeconds = 300;
-    }
-
    @Data
    public static class Legal {
        private String termsAndConditions;
@@ -14,6 +14,7 @@ import lombok.NoArgsConstructor;
@Data
@NoArgsConstructor
@EqualsAndHashCode
+@Schema(description = "PDF file input - either upload a file or provide a server-side file ID")
 public class PDFFile {

    @Schema(
@@ -1,19 +0,0 @@
-package stirling.software.common.model.api.general;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-import lombok.EqualsAndHashCode;
-
-@Data
-@EqualsAndHashCode
-public class EditTextOperation {
-
-    @Schema(description = "The literal text to find.", requiredMode = Schema.RequiredMode.REQUIRED)
-    private String find;
-
-    @Schema(
-            description = "The replacement text. May be empty to delete the matched text.",
-            requiredMode = Schema.RequiredMode.REQUIRED)
-    private String replace;
-}
@@ -1,26 +0,0 @@
-package stirling.software.common.model.enumeration;
-
-import lombok.Getter;
-import lombok.RequiredArgsConstructor;
-
-/** Team invitation status */
-@Getter
-@RequiredArgsConstructor
-public enum InvitationStatus {
-    PENDING("PENDING"),
-    ACCEPTED("ACCEPTED"),
-    REJECTED("REJECTED"),
-    CANCELLED("CANCELLED"),
-    EXPIRED("EXPIRED");
-
-    private final String statusName;
-
-    public static InvitationStatus fromString(String statusName) {
-        for (InvitationStatus status : InvitationStatus.values()) {
-            if (status.getStatusName().equalsIgnoreCase(statusName)) {
-                return status;
-            }
-        }
-        throw new IllegalArgumentException("No InvitationStatus defined for name: " + statusName);
-    }
-}
@@ -16,9 +16,6 @@ public enum Role {
    // Unlimited access
    USER("ROLE_USER", Integer.MAX_VALUE, Integer.MAX_VALUE, "adminUserSettings.user"),

-    // Paid tier; set by Stripe webhooks under saas mode.
-    PRO_USER("ROLE_PRO_USER", Integer.MAX_VALUE, Integer.MAX_VALUE, "adminUserSettings.proUser"),
-
    // 40 API calls Per Day, 40 web calls
    LIMITED_API_USER("ROLE_LIMITED_API_USER", 40, 40, "adminUserSettings.apiUser"),

@@ -1,26 +0,0 @@
-package stirling.software.common.model.enumeration;
-
-import lombok.Getter;
-import lombok.RequiredArgsConstructor;
-
-/**
- * Team membership roles LEADER: Can invite/remove members, manage settings, view usage, manage
- * billing MEMBER: Regular team member with standard access
- */
-@Getter
-@RequiredArgsConstructor
-public enum TeamRole {
-    LEADER("LEADER"),
-    MEMBER("MEMBER");
-
-    private final String roleName;
-
-    public static TeamRole fromString(String roleName) {
-        for (TeamRole role : TeamRole.values()) {
-            if (role.getRoleName().equalsIgnoreCase(roleName)) {
-                return role;
-            }
-        }
-        throw new IllegalArgumentException("No TeamRole defined for name: " + roleName);
-    }
-}
@@ -5,7 +5,6 @@ import java.io.UncheckedIOException;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
-import java.time.Duration;
 import java.util.regex.Pattern;

 import org.springframework.beans.factory.annotation.Autowired;
@@ -13,18 +12,15 @@ import org.springframework.core.env.Environment;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
 import org.springframework.http.*;
-import org.springframework.http.client.SimpleClientHttpRequestFactory;
 import org.springframework.stereotype.Service;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.RestTemplate;

 import jakarta.servlet.ServletContext;

 import lombok.extern.slf4j.Slf4j;

-import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
@@ -54,29 +50,16 @@ public class InternalApiClient {
    private final UserServiceInterface userService;
    private final TempFileManager tempFileManager;
    private final Environment environment;
-    private final Duration readTimeout;
-    private final RestTemplate restTemplate;

    public InternalApiClient(
            ServletContext servletContext,
            @Autowired(required = false) UserServiceInterface userService,
            TempFileManager tempFileManager,
-            Environment environment,
-            ApplicationProperties applicationProperties) {
+            Environment environment) {
        this.servletContext = servletContext;
        this.userService = userService;
        this.tempFileManager = tempFileManager;
        this.environment = environment;
-        ApplicationProperties.InternalApi internalApi = applicationProperties.getInternalApi();
-        // A bounded read timeout is what protects the workflow when an internal tool hangs
-        // (e.g. an infinite loop in a PDF processing service). The connect timeout is short
-        // because this is a loopback call; if connecting takes longer than a few seconds the
-        // local server is itself unhealthy.
-        this.readTimeout = Duration.ofSeconds(internalApi.getReadTimeoutSeconds());
-        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
-        factory.setConnectTimeout(Duration.ofSeconds(internalApi.getConnectTimeoutSeconds()));
-        factory.setReadTimeout(readTimeout);
-        this.restTemplate = new RestTemplate(factory);
    }

    /**
@@ -91,6 +74,7 @@ public class InternalApiClient {
        validateUrl(endpointPath);
        String url = getBaseUrl() + endpointPath;

+        RestTemplate restTemplate = new RestTemplate();
        HttpHeaders headers = new HttpHeaders();
        String apiKey = getApiKeyForUser();
        if (apiKey != null && !apiKey.isEmpty()) {
@@ -100,38 +84,26 @@ public class InternalApiClient {
        HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
        RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);

-        try {
-            return restTemplate.execute(
-                    url,
-                    HttpMethod.POST,
-                    requestCallback,
-                    response -> {
-                        try {
-                            TempFile tempFile =
-                                    tempFileManager.createManagedTempFile("internal-api");
-                            Files.copy(
-                                    response.getBody(),
-                                    tempFile.getPath(),
-                                    java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-                            String filename = extractFilename(response.getHeaders());
-                            TempFileResource resource = new TempFileResource(tempFile, filename);
-                            return ResponseEntity.status(response.getStatusCode())
-                                    .headers(response.getHeaders())
-                                    .body(resource);
-                        } catch (IOException e) {
-                            throw new UncheckedIOException(e);
-                        }
-                    });
-        } catch (ResourceAccessException e) {
-            // RestTemplate wraps low-level I/O failures in ResourceAccessException. Only the
-            // SocketTimeoutException-rooted case is a real timeout; other I/O failures (connection
-            // refused, DNS, etc.) propagate as-is so the upstream generic handler can describe
-            // them accurately.
-            if (e.getCause() instanceof java.net.SocketTimeoutException) {
-                throw new InternalApiTimeoutException(endpointPath, readTimeout, e);
-            }
-            throw e;
-        }
+        return restTemplate.execute(
+                url,
+                HttpMethod.POST,
+                requestCallback,
+                response -> {
+                    try {
+                        TempFile tempFile = tempFileManager.createManagedTempFile("internal-api");
+                        Files.copy(
+                                response.getBody(),
+                                tempFile.getPath(),
+                                java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                        String filename = extractFilename(response.getHeaders());
+                        TempFileResource resource = new TempFileResource(tempFile, filename);
+                        return ResponseEntity.status(response.getStatusCode())
+                                .headers(response.getHeaders())
+                                .body(resource);
+                    } catch (IOException e) {
+                        throw new UncheckedIOException(e);
+                    }
+                });
    }

    /**
@@ -1,36 +0,0 @@
-package stirling.software.common.service;
-
-import java.time.Duration;
-
-/**
- * Thrown when an internal Stirling tool invocation exceeds its configured read timeout or otherwise
- * fails at the transport layer. Distinguishes a hung/timed-out tool from a tool that returned a
- * non-2xx HTTP response (which is reported via the response status itself), so callers can present
- * a clear "the tool didn't respond in time" message to the user instead of a generic stack trace.
- */
-public class InternalApiTimeoutException extends RuntimeException {
-
-    private final String endpointPath;
-    private final Duration readTimeout;
-
-    public InternalApiTimeoutException(String endpointPath, Duration readTimeout, Throwable cause) {
-        super(buildMessage(endpointPath, readTimeout, cause), cause);
-        this.endpointPath = endpointPath;
-        this.readTimeout = readTimeout;
-    }
-
-    public String getEndpointPath() {
-        return endpointPath;
-    }
-
-    public Duration getReadTimeout() {
-        return readTimeout;
-    }
-
-    private static String buildMessage(String endpointPath, Duration readTimeout, Throwable cause) {
-        String reason = cause != null && cause.getMessage() != null ? cause.getMessage() : "";
-        return String.format(
-                "Internal tool %s did not respond within %ds (%s)",
-                endpointPath, readTimeout.toSeconds(), reason);
-    }
-}
@@ -2289,85 +2289,6 @@ public class FormUtils {
        acroForm.getFields().add(field);
    }

-    /** Drops AcroForm fields whose widgets are no longer on any page of {@code document}. */
-    public void pruneOrphanedFormFields(PDDocument document) {
-        if (document == null) {
-            return;
-        }
-        PDDocumentCatalog catalog = document.getDocumentCatalog();
-        if (catalog == null) {
-            return;
-        }
-        PDAcroForm form = catalog.getAcroForm(null);
-        if (form == null) {
-            return;
-        }
-        List<PDField> fields = form.getFields();
-        if (fields.isEmpty()) {
-            return;
-        }
-
-        Set<COSDictionary> liveWidgets = collectLiveWidgetDictionaries(document);
-        List<PDField> kept = pruneFieldList(fields, liveWidgets);
-        if (kept.isEmpty()) {
-            catalog.setAcroForm(null);
-        } else if (kept.size() != fields.size()) {
-            form.setFields(kept);
-        }
-    }
-
-    private Set<COSDictionary> collectLiveWidgetDictionaries(PDDocument document) {
-        Set<COSDictionary> live = new HashSet<>();
-        int pageCount = document.getNumberOfPages();
-        for (int i = 0; i < pageCount; i++) {
-            try {
-                for (PDAnnotation annotation : document.getPage(i).getAnnotations()) {
-                    if (annotation instanceof PDAnnotationWidget) {
-                        live.add(annotation.getCOSObject());
-                    }
-                }
-            } catch (IOException e) {
-                log.debug("Failed reading page {} annotations: {}", i, e.getMessage());
-            }
-        }
-        return live;
-    }
-
-    private List<PDField> pruneFieldList(List<PDField> fields, Set<COSDictionary> liveWidgets) {
-        List<PDField> kept = new ArrayList<>(fields.size());
-        for (PDField field : fields) {
-            if (field instanceof PDNonTerminalField nonTerminal) {
-                List<PDField> children = nonTerminal.getChildren();
-                List<PDField> remaining = pruneFieldList(children, liveWidgets);
-                if (remaining.isEmpty()) {
-                    continue;
-                }
-                if (remaining.size() != children.size()) {
-                    nonTerminal.setChildren(remaining);
-                }
-                kept.add(nonTerminal);
-            } else if (field instanceof PDTerminalField terminal) {
-                List<PDAnnotationWidget> widgets = terminal.getWidgets();
-                List<PDAnnotationWidget> liveOnes = new ArrayList<>(widgets.size());
-                for (PDAnnotationWidget widget : widgets) {
-                    if (liveWidgets.contains(widget.getCOSObject())) {
-                        liveOnes.add(widget);
-                    }
-                }
-                if (liveOnes.isEmpty()) {
-                    continue;
-                }
-                if (liveOnes.size() != widgets.size()) {
-                    terminal.setWidgets(liveOnes);
-                }
-                kept.add(terminal);
-            } else {
-                kept.add(field);
-            }
-        }
-        return kept;
-    }
-
    // Delegation methods to GeneralFormCopyUtils for form field transformation
    public boolean hasAnyRotatedPage(PDDocument document) {
        return stirling.software.common.util.GeneralFormCopyUtils.hasAnyRotatedPage(document);
@@ -15,7 +15,6 @@ import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Semaphore;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;

 import io.github.pixee.security.BoundedLineReader;

@@ -203,15 +202,7 @@ public class ProcessExecutor {
        boolean useSemaphore = true;
        List<String> commandToRun = command;
        if (shouldUseUnoServerPool(command)) {
-            try {
-                unoLease = unoServerPool.acquireEndpoint(timeoutDuration, TimeUnit.MINUTES);
-            } catch (TimeoutException e) {
-                throw new IOException(
-                        "All unoserver endpoints busy; request timed out after "
-                                + timeoutDuration
-                                + " minutes",
-                        e);
-            }
+            unoLease = unoServerPool.acquireEndpoint();
            commandToRun = applyUnoServerEndpoint(command, unoLease.getEndpoint());
            useSemaphore = false;
        }
@@ -172,7 +172,7 @@ public class RequestUriUtils {
                        "/api/v1/ui-data/footer-info") // Public footer configuration
                || trimmedUri.startsWith("/api/v1/invite/validate")
                || trimmedUri.startsWith("/api/v1/invite/accept")
-                // Health Endpoints
+                // Health Endoints
                || trimmedUri.startsWith("/actuator/health")
                || trimmedUri.startsWith("/health")
                || trimmedUri.startsWith("/healthz")
@@ -3,11 +3,8 @@ package stirling.software.common.util;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
-import java.util.Locale;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicBoolean;

 import stirling.software.common.model.ApplicationProperties;
@@ -45,27 +42,6 @@ public class UnoServerPool {
        return new UnoServerLease(endpoints.get(index), index, this);
    }

-    /** Fail-fast variant; non-positive timeout falls back to unbounded acquire. */
-    public UnoServerLease acquireEndpoint(long timeout, TimeUnit unit)
-            throws InterruptedException, TimeoutException {
-        if (endpoints.isEmpty()) {
-            return new UnoServerLease(defaultEndpoint(), null, this);
-        }
-        if (timeout <= 0) {
-            return acquireEndpoint();
-        }
-
-        Integer index = availableIndices.poll(timeout, unit);
-        if (index == null) {
-            throw new TimeoutException(
-                    "Timed out waiting for a free unoserver endpoint after "
-                            + timeout
-                            + " "
-                            + unit.name().toLowerCase(Locale.ROOT));
-        }
-        return new UnoServerLease(endpoints.get(index), index, this);
-    }
-
    private void releaseEndpoint(Integer index) {
        if (index != null) {
            availableIndices.offer(index);
@@ -6,18 +6,15 @@ import java.util.List;

 import lombok.extern.slf4j.Slf4j;

+import stirling.software.common.model.api.security.RedactionArea;
+
+import tools.jackson.core.type.TypeReference;
 import tools.jackson.databind.DeserializationFeature;
-import tools.jackson.databind.JavaType;
 import tools.jackson.databind.ObjectMapper;
 import tools.jackson.databind.json.JsonMapper;

-/**
- * Spring property editor that decodes a JSON string into a typed {@link ArrayList}. Used to bind
- * complex list parameters (e.g. {@code List<RedactionArea>}, {@code List<EditTextOperation>}) from
- * multipart form fields, where Spring's default binding cannot deserialize a JSON array.
- */
@Slf4j
-public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
+public class StringToArrayListPropertyEditor extends PropertyEditorSupport {

    private final ObjectMapper objectMapper =
            JsonMapper.builder()
@@ -25,12 +22,6 @@ public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
                    .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
                    .build();

-    private final Class<T> elementType;
-
-    public StringToArrayListPropertyEditor(Class<T> elementType) {
-        this.elementType = elementType;
-    }
-
    @Override
    public void setAsText(String text) throws IllegalArgumentException {
        if (text == null || text.trim().isEmpty()) {
@@ -38,11 +29,8 @@ public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
            return;
        }
        try {
-            JavaType listType =
-                    objectMapper
-                            .getTypeFactory()
-                            .constructCollectionType(ArrayList.class, elementType);
-            List<T> list = objectMapper.readValue(text, listType);
+            TypeReference<ArrayList<RedactionArea>> typeRef = new TypeReference<>() {};
+            List<RedactionArea> list = objectMapper.readValue(text, typeRef);
            setValue(list);
        } catch (Exception e) {
            log.error("Exception while converting {}", e);
@@ -1,153 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.util.List;
-
-import org.junit.jupiter.api.Test;
-
-/**
- * Unit tests for {@link LineAlignmentTableParser}, focused on the coincident-line merge logic and
- * column-grid construction.
- */
-class LineAlignmentTableParserTest {
-
-    private final LineAlignmentTableParser parser = new LineAlignmentTableParser();
-
-    // ── mergeCoincidentLines ─────────────────────────────────────────────────────────────────────
-
-    @Test
-    void mergeCoincidentLines_singleLine_unchanged() {
-        var lines = List.of(tokenized(rawLine(10f, 100f, "Revenue")));
-        assertThat(parser.mergeCoincidentLines(lines)).hasSize(1);
-    }
-
-    @Test
-    void mergeCoincidentLines_distinctYLines_unchanged() {
-        // Two lines at different y positions — must NOT be merged.
-        var lines =
-                List.of(
-                        tokenized(rawLine(10f, 100f, "Revenue")),
-                        tokenized(rawLine(10f, 115f, "Cost")));
-        assertThat(parser.mergeCoincidentLines(lines)).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_sameY_merged() {
-        // Simulates a financial-table row split by LineBuilder at the column gap:
-        //   label fragment at x=72  → "Revenue"
-        //   value fragment at x=350 → "1,234"
-        // Both have y=100. After merge they should form one TokenizedLine.
-        var label = rawLine(72f, 100f, "Revenue");
-        var value = rawLine(350f, 100f, "1,234");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
-
-        assertThat(merged).hasSize(1);
-        // The merged line should contain tokens from both halves.
-        var tokens = merged.get(0).all();
-        assertThat(tokens.stream().map(t -> t.text()).toList())
-                .containsExactlyInAnyOrder("Revenue", "1,234");
-    }
-
-    @Test
-    void mergeCoincidentLines_sameY_mergedLineHasCorrectBounds() {
-        var label = rawLine(72f, 100f, "Revenue"); // 7 chars × 6pt = 42pt wide → right = 114
-        var value = rawLine(350f, 100f, "1,234"); // 5 chars × 6pt = 30pt wide → right = 380
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
-
-        var bounds = merged.get(0).line().bounds();
-        assertThat(bounds.x()).isEqualTo(72f);
-        assertThat(bounds.right()).isEqualTo(380f);
-    }
-
-    @Test
-    void mergeCoincidentLines_withinTolerance_merged() {
-        // Lines 1.5pt apart (within ROW_MERGE_TOLERANCE_PT = 2pt) should merge.
-        var a = rawLine(10f, 100.0f, "Alpha");
-        var b = rawLine(200f, 101.5f, "99");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
-        assertThat(merged).hasSize(1);
-    }
-
-    @Test
-    void mergeCoincidentLines_beyondTolerance_notMerged() {
-        // Lines 3pt apart (beyond ROW_MERGE_TOLERANCE_PT = 2pt) should NOT merge.
-        var a = rawLine(10f, 100.0f, "Alpha");
-        var b = rawLine(200f, 103.0f, "99");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
-        assertThat(merged).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_threeCoincident_allMerged() {
-        // Three fragments at the same y (e.g. wide financial table with two value columns).
-        var a = rawLine(72f, 100f, "Revenue");
-        var b = rawLine(300f, 100f, "1,234");
-        var c = rawLine(400f, 100f, "5,678");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
-        assertThat(merged).hasSize(1);
-        assertThat(merged.get(0).all()).hasSize(3);
-    }
-
-    @Test
-    void mergeCoincidentLines_coincidentPairFollowedByDistinctLine_twoGroups() {
-        var a = rawLine(72f, 100f, "Revenue");
-        var b = rawLine(350f, 100f, "1,234"); // same y as a → merges with a
-        var c = rawLine(10f, 115f, "Expenses"); // different y → stays separate
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
-        assertThat(merged).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_numericAnchorStatus_correctAfterMerge() {
-        // After merging, the combined line should be an anchor (≥2 numeric tokens).
-        // "Revenue" alone → not an anchor. "1,234  567" alone → anchor.
-        // Merged → anchor with at least 2 numerics.
-        var label = rawLine(72f, 100f, "Revenue");
-        var values = rawLineMultiWord(350f, 100f, "1,234", 30f, "567", 30f);
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(values)));
-
-        assertThat(merged).hasSize(1);
-        assertThat(merged.get(0).isAnchor()).isTrue();
-    }
-
-    // ── helpers ──────────────────────────────────────────────────────────────────────────────────
-
-    /** Creates a RawLine with a single TextFragment of the given text at the given position. */
-    private static RawLine rawLine(float x, float y, String text) {
-        float width = text.length() * 6f; // ~6pt per char — rough but consistent
-        float height = 12f;
-        Bounds bounds = new Bounds(x, y, width, height);
-        TextFragment fragment =
-                new TextFragment("tf-test", text, bounds, y + height, 11f, "Helvetica", false);
-        return new RawLine("ln-test", List.of(fragment), bounds, 1);
-    }
-
-    /**
-     * Creates a RawLine with two TextFragments representing two words separated by a small gap.
-     * Used to simulate a values-only line with multiple numeric tokens.
-     */
-    private static RawLine rawLineMultiWord(
-            float x, float y, String word1, float w1, String word2, float w2) {
-        float height = 12f;
-        Bounds b1 = new Bounds(x, y, w1, height);
-        Bounds b2 = new Bounds(x + w1 + 5f, y, w2, height);
-        TextFragment f1 = new TextFragment("tf-1", word1, b1, y + height, 11f, "Helvetica", false);
-        TextFragment f2 = new TextFragment("tf-2", word2, b2, y + height, 11f, "Helvetica", false);
-        Bounds lineBounds = new Bounds(x, y, x + w1 + 5f + w2 - x, height);
-        return new RawLine("ln-test", List.of(f1, f2), lineBounds, 1);
-    }
-
-    /** Tokenises a RawLine via the parser's own tokenise logic (package-private access). */
-    private LineAlignmentTableParser.TokenizedLine tokenized(RawLine line) {
-        return parser.tokenize(line);
-    }
-}
@@ -1,59 +0,0 @@
-package stirling.software.common.architecture;
-
-import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
-
-import org.junit.jupiter.api.Test;
-
-import com.tngtech.archunit.core.domain.JavaClasses;
-import com.tngtech.archunit.core.importer.ClassFileImporter;
-import com.tngtech.archunit.core.importer.ImportOption;
-import com.tngtech.archunit.lang.ArchRule;
-
-/**
- * Module dependency-direction guardrails. Allowed direction: {@code saas → proprietary → common}
- * and {@code stirling-pdf → proprietary → common}.
- */
-class ArchitectureTest {
-
-    private static final JavaClasses commonClasses =
-            new ClassFileImporter()
-                    .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_JARS)
-                    .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS)
-                    .importPackages("stirling.software.common");
-
-    @Test
-    void commonDoesNotDependOnCore() {
-        ArchRule rule =
-                noClasses()
-                        .that()
-                        .resideInAPackage("stirling.software.common..")
-                        .should()
-                        .dependOnClassesThat()
-                        .resideInAPackage("stirling.software.SPDF..");
-        rule.check(commonClasses);
-    }
-
-    @Test
-    void commonDoesNotDependOnProprietary() {
-        ArchRule rule =
-                noClasses()
-                        .that()
-                        .resideInAPackage("stirling.software.common..")
-                        .should()
-                        .dependOnClassesThat()
-                        .resideInAPackage("stirling.software.proprietary..");
-        rule.check(commonClasses);
-    }
-
-    @Test
-    void commonDoesNotDependOnSaas() {
-        ArchRule rule =
-                noClasses()
-                        .that()
-                        .resideInAPackage("stirling.software.common..")
-                        .should()
-                        .dependOnClassesThat()
-                        .resideInAPackage("stirling.software.saas..");
-        rule.check(commonClasses);
-    }
-}
@@ -1,32 +0,0 @@
-package stirling.software.common.jpdfium;
-
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import stirling.software.jpdfium.PdfDocument;
-
-class JPDFiumSmokeTest {
-
-    @Test
-    void opensExamplePdfAndReadsPageCount(@TempDir Path tmp) throws IOException {
-        Path pdf = tmp.resolve("example.pdf");
-        try (InputStream in = getClass().getResourceAsStream("/example.pdf")) {
-            assertNotNull(in, "example.pdf must exist under src/test/resources");
-            Files.copy(in, pdf);
-        }
-
-        try (PdfDocument doc = PdfDocument.open(pdf)) {
-            assertTrue(
-                    doc.pageCount() >= 1,
-                    "PdfDocument should report at least one page for example.pdf");
-        }
-    }
-}
@@ -22,13 +22,11 @@ import org.springframework.mock.env.MockEnvironment;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.ResponseExtractor;
 import org.springframework.web.client.RestTemplate;

 import jakarta.servlet.ServletContext;

-import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;

@@ -44,19 +42,8 @@ class InternalApiClientTest {
    @BeforeEach
    void setUp() {
        lenient().when(servletContext.getContextPath()).thenReturn("");
-        client = newClient();
-    }
-
-    /**
-     * Build a fresh client. Tests that use {@link org.mockito.Mockito#mockConstruction} to
-     * intercept {@link RestTemplate} must call this from inside their {@code mockConstruction}
-     * block, since the client now caches one RestTemplate per instance at construction time.
-     */
-    private InternalApiClient newClient() {
        MockEnvironment environment = new MockEnvironment().withProperty("server.port", "8080");
-        ApplicationProperties applicationProperties = new ApplicationProperties();
-        return new InternalApiClient(
-                servletContext, userService, tempFileManager, environment, applicationProperties);
+        client = new InternalApiClient(servletContext, userService, tempFileManager, environment);
    }

    @Test
@@ -88,10 +75,7 @@ class InternalApiClientTest {
                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
                        })) {

-            // Reconstruct the client so its cached RestTemplate is the mocked one.
-            InternalApiClient mockedClient = newClient();
-            ResponseEntity<Resource> response =
-                    mockedClient.post("/api/v1/general/merge-pdfs", body);
+            ResponseEntity<Resource> response = client.post("/api/v1/general/merge-pdfs", body);

            assertNotNull(response);
            assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -102,72 +86,6 @@ class InternalApiClientTest {
        }
    }

-    @Test
-    void postWrapsSocketTimeoutAsInternalApiTimeoutException() {
-        // Simulates the read-timeout case: RestTemplate wraps SocketTimeoutException in
-        // ResourceAccessException when the underlying socket times out. The client must repackage
-        // that into a typed timeout exception that carries the failing endpoint and the configured
-        // read timeout, so the workflow layer can surface a clean "tool didn't respond" message
-        // to the user.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenAnswer(inv -> (RequestCallback) req -> {});
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenThrow(
-                                            new ResourceAccessException(
-                                                    "I/O error on POST request: Read timed out",
-                                                    new java.net.SocketTimeoutException(
-                                                            "Read timed out")));
-                        })) {
-
-            InternalApiClient mockedClient = newClient();
-            InternalApiTimeoutException thrown =
-                    assertThrows(
-                            InternalApiTimeoutException.class,
-                            () -> mockedClient.post("/api/v1/general/merge-pdfs", body));
-
-            assertEquals("/api/v1/general/merge-pdfs", thrown.getEndpointPath());
-            assertNotNull(thrown.getReadTimeout());
-            assertTrue(thrown.getMessage().contains("/api/v1/general/merge-pdfs"));
-        }
-    }
-
-    @Test
-    void postRethrowsNonTimeoutResourceAccessExceptionAsIs() {
-        // ResourceAccessException covers more than just timeouts (e.g. connection refused, DNS
-        // failure). Only SocketTimeoutException-rooted failures are timeouts; everything else
-        // must propagate so the upstream generic handler can label it correctly instead of lying
-        // about a "tool didn't respond" timeout.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenAnswer(inv -> (RequestCallback) req -> {});
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenThrow(
-                                            new ResourceAccessException(
-                                                    "I/O error on POST request: Connection refused",
-                                                    new java.net.ConnectException(
-                                                            "Connection refused")));
-                        })) {
-
-            InternalApiClient mockedClient = newClient();
-            assertThrows(
-                    ResourceAccessException.class,
-                    () -> mockedClient.post("/api/v1/general/merge-pdfs", body));
-        }
-    }
-
    @Test
    void postRejectsDisallowedPath() {
        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
@@ -207,10 +125,8 @@ class InternalApiClientTest {
                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
                        })) {

-            // Reconstruct the client so its cached RestTemplate is the mocked one.
-            InternalApiClient mockedClient = newClient();
            ResponseEntity<Resource> response =
-                    mockedClient.post("/api/v1/ai/tools/pdf-comment-agent", body);
+                    client.post("/api/v1/ai/tools/pdf-comment-agent", body);

            assertNotNull(response);
            assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -1,229 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.Loader;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDResources;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
-import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
-import org.apache.pdfbox.pdmodel.interactive.form.PDField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDNonTerminalField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDTextField;
-import org.junit.jupiter.api.Test;
-
-class FormUtilsPruneOrphanedFieldsTest {
-
-    @Test
-    void noAcroFormIsNoOp() throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            document.addPage(new PDPage(PDRectangle.A4));
-            FormUtils.pruneOrphanedFormFields(document);
-            assertNull(document.getDocumentCatalog().getAcroForm(null));
-        }
-    }
-
-    @Test
-    void dropsFieldsWhoseWidgetsAreAllOnRemovedPages() throws IOException {
-        byte[] pdfBytes = buildPdfWithFieldPerPage(3);
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(2);
-            document.removePage(0);
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            PDAcroForm form = document.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            List<String> remainingNames = new ArrayList<>();
-            for (PDField field : form.getFields()) {
-                remainingNames.add(field.getPartialName());
-            }
-            assertEquals(List.of("field_1"), remainingNames);
-        }
-    }
-
-    @Test
-    void dropsAcroFormEntirelyWhenNoFieldsSurvive() throws IOException {
-        byte[] pdfBytes = buildPdfWithFieldPerPage(2);
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(1);
-            document.removePage(0);
-            document.addPage(new PDPage(PDRectangle.A4));
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            assertNull(document.getDocumentCatalog().getAcroForm(null));
-        }
-    }
-
-    @Test
-    void keepsLiveWidgetsAndDropsOrphanWidgetsFromMultiWidgetField() throws IOException {
-        byte[] pdfBytes = buildPdfWithMultiWidgetField();
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(0);
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            PDAcroForm form = document.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            assertEquals(1, form.getFields().size());
-            PDField field = form.getFields().get(0);
-            assertEquals("multi", field.getPartialName());
-            assertEquals(2, field.getWidgets().size(), "two widgets remain after one is dropped");
-        }
-    }
-
-    @Test
-    void survivesRoundTripWithoutOrphanPagesInOutput() throws IOException {
-        byte[] pdfBytes = buildPdfWithFieldPerPage(3);
-
-        byte[] writtenBytes;
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(2);
-            document.removePage(1);
-            FormUtils.pruneOrphanedFormFields(document);
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                writtenBytes = out.toByteArray();
-            }
-        }
-
-        try (PDDocument reloaded = Loader.loadPDF(writtenBytes)) {
-            assertEquals(1, reloaded.getNumberOfPages());
-            PDAcroForm form = reloaded.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            assertEquals(1, form.getFields().size());
-            assertEquals("field_0", form.getFields().get(0).getPartialName());
-        }
-    }
-
-    @Test
-    void prunesNestedNonTerminalFields() throws IOException {
-        byte[] pdfBytes = buildPdfWithNestedFields();
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(1);
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            PDAcroForm form = document.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            assertEquals(1, form.getFields().size());
-            PDField group = form.getFields().get(0);
-            assertEquals("group", group.getPartialName());
-            assertTrue(group instanceof PDNonTerminalField);
-            PDNonTerminalField nonTerminal = (PDNonTerminalField) group;
-            assertEquals(1, nonTerminal.getChildren().size());
-            assertEquals("kept", nonTerminal.getChildren().get(0).getPartialName());
-        }
-    }
-
-    private static byte[] buildPdfWithFieldPerPage(int pageCount) throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            PDAcroForm acroForm = new PDAcroForm(document);
-            acroForm.setDefaultResources(new PDResources());
-            document.getDocumentCatalog().setAcroForm(acroForm);
-
-            for (int i = 0; i < pageCount; i++) {
-                PDPage page = new PDPage(PDRectangle.A4);
-                document.addPage(page);
-
-                PDTextField field = new PDTextField(acroForm);
-                field.setPartialName("field_" + i);
-                PDAnnotationWidget widget = new PDAnnotationWidget();
-                widget.setRectangle(new PDRectangle(50, 50, 100, 20));
-                widget.setPage(page);
-                field.setWidgets(List.of(widget));
-                acroForm.getFields().add(field);
-                page.getAnnotations().add(widget);
-            }
-
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                return out.toByteArray();
-            }
-        }
-    }
-
-    private static byte[] buildPdfWithMultiWidgetField() throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            PDAcroForm acroForm = new PDAcroForm(document);
-            acroForm.setDefaultResources(new PDResources());
-            document.getDocumentCatalog().setAcroForm(acroForm);
-
-            List<PDAnnotationWidget> widgets = new ArrayList<>();
-            for (int i = 0; i < 3; i++) {
-                PDPage page = new PDPage(PDRectangle.A4);
-                document.addPage(page);
-                PDAnnotationWidget widget = new PDAnnotationWidget();
-                widget.setRectangle(new PDRectangle(50, 50, 100, 20));
-                widget.setPage(page);
-                page.getAnnotations().add(widget);
-                widgets.add(widget);
-            }
-
-            PDTextField field = new PDTextField(acroForm);
-            field.setPartialName("multi");
-            field.setWidgets(widgets);
-            acroForm.getFields().add(field);
-
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                return out.toByteArray();
-            }
-        }
-    }
-
-    private static byte[] buildPdfWithNestedFields() throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            PDAcroForm acroForm = new PDAcroForm(document);
-            acroForm.setDefaultResources(new PDResources());
-            document.getDocumentCatalog().setAcroForm(acroForm);
-
-            PDPage pageA = new PDPage(PDRectangle.A4);
-            PDPage pageB = new PDPage(PDRectangle.A4);
-            document.addPage(pageA);
-            document.addPage(pageB);
-
-            PDNonTerminalField group = new PDNonTerminalField(acroForm);
-            group.setPartialName("group");
-
-            PDTextField kept = new PDTextField(acroForm);
-            kept.setPartialName("kept");
-            PDAnnotationWidget keptWidget = new PDAnnotationWidget();
-            keptWidget.setRectangle(new PDRectangle(50, 50, 100, 20));
-            keptWidget.setPage(pageA);
-            kept.setWidgets(List.of(keptWidget));
-            pageA.getAnnotations().add(keptWidget);
-
-            PDTextField dropped = new PDTextField(acroForm);
-            dropped.setPartialName("dropped");
-            PDAnnotationWidget droppedWidget = new PDAnnotationWidget();
-            droppedWidget.setRectangle(new PDRectangle(50, 100, 100, 20));
-            droppedWidget.setPage(pageB);
-            dropped.setWidgets(List.of(droppedWidget));
-            pageB.getAnnotations().add(droppedWidget);
-
-            group.setChildren(List.of(kept, dropped));
-            acroForm.getFields().add(group);
-
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                return out.toByteArray();
-            }
-        }
-    }
-}
@@ -9,7 +9,6 @@ import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicInteger;

 import org.junit.jupiter.api.Test;
@@ -174,70 +173,6 @@ public class UnoServerPoolTest {
        assertEquals(port1, port2, "Should reuse the same endpoint after release");
    }

-    @Test
-    void testAcquireWithTimeoutFailsFast() throws InterruptedException {
-        List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> endpoints =
-                createEndpoints(1);
-        UnoServerPool pool = new UnoServerPool(endpoints);
-
-        UnoServerPool.UnoServerLease held = pool.acquireEndpoint();
-
-        long start = System.nanoTime();
-        assertThrows(
-                TimeoutException.class,
-                () -> pool.acquireEndpoint(100, TimeUnit.MILLISECONDS),
-                "Should time out when no endpoint available");
-        long elapsedMs = (System.nanoTime() - start) / 1_000_000;
-
-        assertTrue(
-                elapsedMs >= 100 && elapsedMs < 1000,
-                "Should fail-fast after roughly the timeout, got " + elapsedMs + "ms");
-
-        held.close();
-    }
-
-    @Test
-    void testAcquireWithTimeoutSucceedsWhenAvailable()
-            throws InterruptedException, TimeoutException {
-        List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> endpoints =
-                createEndpoints(1);
-        UnoServerPool pool = new UnoServerPool(endpoints);
-
-        try (UnoServerPool.UnoServerLease lease = pool.acquireEndpoint(1, TimeUnit.SECONDS)) {
-            assertNotNull(lease);
-            assertEquals(2003, lease.getEndpoint().getPort());
-        }
-    }
-
-    @Test
-    void testAcquireWithZeroTimeoutBlocksUnbounded() throws InterruptedException {
-        List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> endpoints =
-                createEndpoints(1);
-        UnoServerPool pool = new UnoServerPool(endpoints);
-        UnoServerPool.UnoServerLease held = pool.acquireEndpoint();
-
-        AtomicInteger acquired = new AtomicInteger(0);
-        Thread t =
-                Thread.ofVirtual()
-                        .start(
-                                () -> {
-                                    try {
-                                        UnoServerPool.UnoServerLease lease =
-                                                pool.acquireEndpoint(0, TimeUnit.MILLISECONDS);
-                                        acquired.incrementAndGet();
-                                        lease.close();
-                                    } catch (Exception e) {
-                                        fail("unexpected: " + e);
-                                    }
-                                });
-
-        Thread.sleep(150);
-        assertEquals(0, acquired.get(), "Should still be blocked");
-        held.close();
-        t.join(1000);
-        assertEquals(1, acquired.get(), "Should acquire after release");
-    }
-
    @Test
    void testHostLocationAndProtocol() throws InterruptedException {
        List<ApplicationProperties.ProcessExecutor.UnoServerEndpoint> endpoints = new ArrayList<>();
@@ -11,11 +11,11 @@ import stirling.software.common.model.api.security.RedactionArea;

 class StringToArrayListPropertyEditorTest {

-    private StringToArrayListPropertyEditor<RedactionArea> editor;
+    private StringToArrayListPropertyEditor editor;

    @BeforeEach
    void setUp() {
-        editor = new StringToArrayListPropertyEditor<>(RedactionArea.class);
+        editor = new StringToArrayListPropertyEditor();
    }

    @Test
@@ -39,14 +39,12 @@ spotless {
 }

 dependencies {
-    if (!gradle.ext.disableAdditional) {
+    if (System.getenv('DISABLE_ADDITIONAL_FEATURES') != 'true'
+        || (project.hasProperty('DISABLE_ADDITIONAL_FEATURES')
+        && System.getProperty('DISABLE_ADDITIONAL_FEATURES') != 'true')) {
        implementation project(':proprietary')
    }

-    if (gradle.ext.enableSaas) {
-        implementation project(':saas')
-    }
-
    implementation project(':common')
    implementation 'org.springframework.boot:spring-boot-starter-jetty'
    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
@@ -67,7 +65,7 @@ dependencies {
        exclude group: 'com.fasterxml.jackson.jaxrs'
        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
    }
-    implementation 'commons-io:commons-io:2.22.0'
+    implementation 'commons-io:commons-io:2.21.0'
    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
    implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
    implementation 'io.micrometer:micrometer-core'
@@ -89,6 +87,12 @@ dependencies {
    implementation 'com.sun.xml.bind:jaxb-core:4.0.7'
    implementation 'org.apache.poi:poi-ooxml:5.5.1'

+    // https://mvnrepository.com/artifact/technology.tabula/tabula
+    implementation ('technology.tabula:tabula:1.0.5')  {
+        exclude group: 'org.slf4j', module: 'slf4j-simple'
+        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
+        exclude group: 'com.google.code.gson', module: 'gson'
+    }
    // CVE-2022-25647: Explicit gson 2.13.2 to prevent unsafe deserialization (tabula would pull 2.8.7)
    implementation 'com.google.code.gson:gson:2.13.2'
    implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
@@ -162,8 +166,7 @@ bootJar {
    manifest {
        attributes(
            'Implementation-Title': 'Stirling-PDF',
-            'Implementation-Version': project.version,
-            'Enable-Native-Access': 'ALL-UNNAMED'
+            'Implementation-Version': project.version
        )
    }
 }
@@ -176,33 +179,8 @@ springBoot {
 // Frontend build tasks - only enabled with -PbuildWithFrontend=true
 def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
 def buildPrototypes = project.hasProperty('prototypesMode') && project.property('prototypesMode') == 'true'
-// Workspace root holds package.json and node_modules (shared across editor /
-// future portal). Editor-specific paths (src, public, dist, tauri) live one
-// level deeper under frontend/editor/.
-
-// Vite mode: -PprototypesMode > -PfrontendMode > enableSaas > disableAdditional > proprietary.
-def frontendModeOverride = project.findProperty('frontendMode')?.toString()?.toLowerCase()
-def frontendMode
-if (buildPrototypes) {
-    frontendMode = 'prototypes'
-} else if (frontendModeOverride) {
-    frontendMode = frontendModeOverride
-} else if (gradle.ext.enableSaas) {
-    frontendMode = 'saas'
-} else if (gradle.ext.disableAdditional) {
-    frontendMode = 'core'
-} else {
-    frontendMode = 'proprietary'
-}
-def frontendBuildTask = "frontend:build:${frontendMode}"
-
-// Workspace root holds package.json and node_modules (shared across editor /
-// future portal). Editor-specific paths (src, public, dist, tauri) live one
-// level deeper under frontend/editor/. When the portal lands as an embedded
-// app, add a sibling frontendPortalDir / frontendPortalDistDir alongside.
 def frontendDir = file('../../frontend')
-def frontendEditorDir = file('../../frontend/editor')
-def frontendEditorDistDir = file('../../frontend/editor/dist')
+def frontendDistDir = file('../../frontend/dist')
 def resourcesStaticDir = file('src/main/resources/static')
 def generatedFrontendPaths = [
    'assets',
@@ -267,13 +245,13 @@ tasks.register('npmBuild', Exec) {
    doNotTrackState("Frontend build depends on untracked npmInstall task")
    enabled = buildWithFrontend
    group = 'frontend'
-    description = 'Build editor frontend application'
+    description = 'Build frontend application'
    workingDir file('../..')
-    commandLine = ['task', frontendBuildTask]
-    inputs.dir(new File(frontendEditorDir, 'src'))
-    inputs.dir(new File(frontendEditorDir, 'public'))
+    commandLine = buildPrototypes ? ['task', 'frontend:build:prototypes'] : ['task', 'frontend:build']
+    inputs.dir(new File(frontendDir, 'src'))
+    inputs.dir(new File(frontendDir, 'public'))
    inputs.file(new File(frontendDir, 'package.json'))
-    outputs.dir(frontendEditorDistDir)
+    outputs.dir(frontendDistDir)

    // Show live output
    standardOutput = System.out
@@ -284,17 +262,16 @@ tasks.register('npmBuild', Exec) {
    environment 'VITE_API_BASE_URL', '/'

    doFirst {
-        println "Building editor frontend application for production (mode=${frontendMode}, VITE_API_BASE_URL=/)"
+        println "Building frontend application for production (VITE_API_BASE_URL=/)"
    }
 }

 tasks.register('copyFrontendAssets', Copy) {
    enabled = buildWithFrontend
    group = 'frontend'
-    description = 'Copy editor frontend build to static resources'
+    description = 'Copy frontend build to static resources'
    dependsOn npmBuild
-    dependsOn cleanFrontendAssets
-    from(frontendEditorDistDir) {
+    from(frontendDistDir) {
        // Exclude files that conflict with backend static resources
        exclude 'robots.txt'  // Backend already has this
        exclude 'favicon.ico' // Backend already has this
@@ -302,7 +279,7 @@ tasks.register('copyFrontendAssets', Copy) {
    into resourcesStaticDir
    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
    doFirst {
-        println "Copying frontend build from ${frontendEditorDistDir} to ${resourcesStaticDir}..."
+        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
        println "Backend static resources will be preserved"
    }
    doLast {
@@ -334,7 +311,7 @@ tasks.named('copyFrontendAssets').configure {
 }

 if (buildWithFrontend) {
-    println "Editor frontend build enabled - JAR will include React frontend (mode=${frontendMode})"
+    println "Frontend build enabled - JAR will include React frontend"
    processResources.dependsOn copyFrontendAssets
 } else {
    println "Frontend build disabled - JAR will be backend-only with API landing page"
@@ -343,9 +320,4 @@ if (buildWithFrontend) {
 }

 bootJar.dependsOn ':common:jar'
-if (!gradle.ext.disableAdditional) {
-    bootJar.dependsOn ':proprietary:jar'
-}
-if (gradle.ext.enableSaas) {
-    bootJar.dependsOn ':saas:jar'
-}
+bootJar.dependsOn ':proprietary:jar'
@@ -35,8 +35,7 @@ import stirling.software.common.model.ApplicationProperties;
        scanBasePackages = {
            "stirling.software.SPDF",
            "stirling.software.common",
-            "stirling.software.proprietary",
-            "stirling.software.saas"
+            "stirling.software.proprietary"
        })
 public class SPDFApplication {

@@ -206,22 +205,15 @@ public class SPDFApplication {
            }
        }

-        // 2. Detect classpath shape and pick the matching profile chain.
-        boolean hasSaas = isClassPresent("stirling.software.saas.security.SupabaseSecurityConfig");
-        boolean hasSecurity =
-                isClassPresent(
-                        "stirling.software.proprietary.security.configuration.SecurityConfiguration");
-
-        if (hasSaas) {
-            log.info("SaaS features in jar");
-            return new String[] {"security", "saas"};
-        }
-        if (hasSecurity) {
+        // 2. Detect if SecurityConfiguration is present on classpath
+        if (isClassPresent(
+                "stirling.software.proprietary.security.configuration.SecurityConfiguration")) {
            log.info("Additional features in jar");
            return new String[] {"security"};
+        } else {
+            log.info("Without additional features in jar");
+            return new String[] {"default"};
        }
-        log.info("Without additional features in jar");
-        return new String[] {"default"};
    }

    private static boolean isClassPresent(String className) {
@@ -23,7 +23,6 @@ import lombok.RequiredArgsConstructor;
 import stirling.software.SPDF.config.swagger.JsonDataResponse;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.AnalysisApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.CustomPDFDocumentFactory;

@@ -33,10 +32,7 @@ public class AnalysisController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;

-    @AutoJobPostMapping(
-            value = "/page-count",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/page-count", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get PDF page count",
@@ -47,10 +43,7 @@ public class AnalysisController {
        }
    }

-    @AutoJobPostMapping(
-            value = "/basic-info",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/basic-info", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get basic PDF information",
@@ -67,8 +60,7 @@ public class AnalysisController {

    @AutoJobPostMapping(
            value = "/document-properties",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get PDF document properties",
@@ -98,10 +90,7 @@ public class AnalysisController {
        }
    }

-    @AutoJobPostMapping(
-            value = "/page-dimensions",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/page-dimensions", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get page dimensions for all pages",
@@ -121,10 +110,7 @@ public class AnalysisController {
        }
    }

-    @AutoJobPostMapping(
-            value = "/form-fields",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/form-fields", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get form field information",
@@ -148,10 +134,7 @@ public class AnalysisController {
        }
    }

-    @AutoJobPostMapping(
-            value = "/annotation-info",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/annotation-info", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get annotation information",
@@ -176,10 +159,7 @@ public class AnalysisController {
        }
    }

-    @AutoJobPostMapping(
-            value = "/font-info",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/font-info", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get font information",
@@ -205,10 +185,7 @@ public class AnalysisController {
        }
    }

-    @AutoJobPostMapping(
-            value = "/security-info",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/security-info", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @JsonDataResponse
    @Operation(
            summary = "Get security information",
@@ -28,7 +28,6 @@ import lombok.RequiredArgsConstructor;

 import stirling.software.SPDF.model.api.general.BookletImpositionRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.TempFileManager;
@@ -45,8 +44,7 @@ public class BookletImpositionController {

    @AutoJobPostMapping(
            value = "/booklet-imposition",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.MEDIUM_WEIGHT)
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Create a booklet with proper page imposition",
            description =
@@ -26,7 +26,6 @@ import stirling.software.SPDF.config.EndpointConfiguration;
 import stirling.software.SPDF.model.api.general.CropPdfForm;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
@@ -127,10 +126,7 @@ public class CropController {
        return endpointConfiguration.isGroupEnabled("Ghostscript");
    }

-    @AutoJobPostMapping(
-            value = "/crop",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+    @AutoJobPostMapping(value = "/crop", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Crops a PDF document",
            description =
@@ -25,7 +25,6 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.SPDF.model.api.EditTableOfContentsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.TempFileManager;
@@ -45,8 +44,7 @@ public class EditTableOfContentsController {

    @AutoJobPostMapping(
            value = "/extract-bookmarks",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Extract PDF Bookmarks",
            description = "Extracts bookmarks/table of contents from a PDF document as JSON.")
@@ -149,8 +147,7 @@ public class EditTableOfContentsController {

    @AutoJobPostMapping(
            value = "/edit-table-of-contents",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.SMALL_WEIGHT)
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Edit Table of Contents",
            description = "Add or edit bookmarks/table of contents in a PDF document.")
@@ -1,333 +0,0 @@
-package stirling.software.SPDF.controller.api;
-
-import java.io.OutputStream;
-import java.nio.file.Files;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-import org.springframework.core.io.Resource;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.WebDataBinder;
-import org.springframework.web.bind.annotation.InitBinder;
-import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.multipart.MultipartFile;
-
-import io.github.pixee.security.Filenames;
-import io.swagger.v3.oas.annotations.Operation;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.config.swagger.StandardPdfResponse;
-import stirling.software.SPDF.model.api.general.EditTextRequest;
-import stirling.software.SPDF.model.json.PdfJsonDocument;
-import stirling.software.SPDF.model.json.PdfJsonPage;
-import stirling.software.SPDF.model.json.PdfJsonTextElement;
-import stirling.software.SPDF.service.PdfJsonConversionService;
-import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.model.api.general.EditTextOperation;
-import stirling.software.common.util.ExceptionUtils;
-import stirling.software.common.util.GeneralUtils;
-import stirling.software.common.util.TempFile;
-import stirling.software.common.util.TempFileManager;
-import stirling.software.common.util.WebResponseUtils;
-import stirling.software.common.util.propertyeditor.StringToArrayListPropertyEditor;
-
-/**
- * Find/replace text editing for PDFs. Round-trips through {@link PdfJsonConversionService}: the
- * input PDF is parsed into the editable JSON model, find/replace operations are applied to the
- * {@code text} field of each text element, and the mutated model is rebuilt into a PDF.
- *
- * <p>Matching joins all text elements on a page into a single string before searching, so find
- * strings can span multiple visual runs (titles split per word, kerning-broken phrases, etc.).
- *
- * <p>For cross-element matches the entire replacement is written into the first matched element,
- * any intermediate elements are emptied, and the suffix of the last matched element is preserved.
- * This anchors the new text at the leftmost match position and lets the font lay it out as one run,
- * which is more visually reliable than redistributing words to the original per-element X positions
- * (those positions are calibrated to the original word widths and rarely match the replacement
- * widths). Centered or tracked layouts will become left-aligned at the original first-word position
- * when their text is replaced - the trade-off is accepted in favour of avoiding glyph overlaps and
- * gaps from variable-width word distribution.
- */
-@Slf4j
-@GeneralApi
-@RequiredArgsConstructor
-public class EditTextController {
-
-    private static final Pattern FILE_EXTENSION_PATTERN = Pattern.compile("[.][^.]+$");
-
-    private final PdfJsonConversionService pdfJsonConversionService;
-    private final TempFileManager tempFileManager;
-
-    @InitBinder
-    public void initBinder(WebDataBinder binder) {
-        binder.registerCustomEditor(
-                List.class,
-                "edits",
-                new StringToArrayListPropertyEditor<>(EditTextOperation.class));
-    }
-
-    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/edit-text")
-    @StandardPdfResponse
-    @Operation(
-            summary = "Edit text in a PDF via find and replace",
-            description =
-                    "Applies an ordered list of find/replace operations to the text in a PDF and"
-                            + " returns the edited PDF. Useful for find-and-replace, bulk renames"
-                            + " (e.g. updating a company name throughout a document), and copy"
-                            + " editing where the AI agent has identified specific replacements."
-                            + " Matching is performed against the joined text of each page, so"
-                            + " find strings can span multiple visual runs (titles split per word,"
-                            + " kerning-broken phrases). Cross-element matches are written as a"
-                            + " single replacement run anchored at the leftmost matched position;"
-                            + " centered or tracked text may shift left when its content changes."
-                            + " Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<Resource> editText(@ModelAttribute EditTextRequest request)
-            throws Exception {
-        MultipartFile inputFile = request.getFileInput();
-        if (inputFile == null) {
-            throw ExceptionUtils.createFileNullOrEmptyException();
-        }
-        List<EditTextOperation> edits = request.getEdits();
-        if (edits == null || edits.isEmpty()) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.editText.no.edits",
-                    "No find/replace operations provided for text editing");
-        }
-        for (EditTextOperation edit : edits) {
-            if (edit == null || edit.getFind() == null || edit.getFind().isEmpty()) {
-                throw ExceptionUtils.createIllegalArgumentException(
-                        "error.editText.empty.find", "Each edit must have a non-empty find string");
-            }
-        }
-
-        boolean wholeWordSearch = Boolean.TRUE.equals(request.getWholeWordSearch());
-        List<CompiledEdit> compiledEdits = compileEdits(edits, wholeWordSearch);
-
-        PdfJsonDocument document = pdfJsonConversionService.convertPdfToJsonDocument(inputFile);
-        Set<Integer> pageFilter = resolvePageFilter(request, document);
-        int modifiedSpans = applyEdits(document, compiledEdits, pageFilter);
-        log.info(
-                "edit-text: modified {} text span(s) using {} edit(s) on {} page(s)",
-                modifiedSpans,
-                compiledEdits.size(),
-                pageFilter == null
-                        ? document.getPages() == null ? 0 : document.getPages().size()
-                        : pageFilter.size());
-
-        String docName = buildOutputFilename(inputFile);
-        TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
-        try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
-            pdfJsonConversionService.convertJsonToPdf(document, os);
-        } catch (Exception e) {
-            tempOut.close();
-            throw e;
-        }
-        return WebResponseUtils.pdfFileToWebResponse(tempOut, docName);
-    }
-
-    private List<CompiledEdit> compileEdits(
-            List<EditTextOperation> edits, boolean wholeWordSearch) {
-        return edits.stream().map(edit -> compileEdit(edit, wholeWordSearch)).toList();
-    }
-
-    private CompiledEdit compileEdit(EditTextOperation edit, boolean wholeWordSearch) {
-        // Always treat the user-supplied find string as a literal: Pattern.quote escapes any
-        // regex metacharacters, so the constructed pattern can only ever do a literal match
-        // (optionally bounded by our own word-boundary anchors). This rules out catastrophic
-        // backtracking from a malicious find string.
-        String findRaw = edit.getFind();
-        String replacement = Objects.toString(edit.getReplace(), "");
-        String regex = Pattern.quote(findRaw);
-        if (wholeWordSearch) {
-            // Use lookarounds rather than \b so the bound works even when the find string starts
-            // or ends with a non-word character (e.g. "-foo" or "$id"). \b only fires at a
-            // word/non-word transition, which would never trigger for a find that starts with a
-            // non-word char and was preceded by another non-word char in the source text.
-            regex = "(?<!\\w)(?:" + regex + ")(?!\\w)";
-        }
-        Pattern pattern = Pattern.compile(regex);
-        String safeReplacement = Matcher.quoteReplacement(replacement);
-        return new CompiledEdit(pattern, safeReplacement);
-    }
-
-    private Set<Integer> resolvePageFilter(EditTextRequest request, PdfJsonDocument document) {
-        String pageNumbers = request.getPageNumbers();
-        int totalPages = document.getPages() == null ? 0 : document.getPages().size();
-        if (totalPages == 0) {
-            return Collections.emptySet();
-        }
-        if (pageNumbers == null || pageNumbers.isBlank() || "all".equalsIgnoreCase(pageNumbers)) {
-            return null;
-        }
-        List<Integer> pages = GeneralUtils.parsePageList(pageNumbers, totalPages, true);
-        return new HashSet<>(pages);
-    }
-
-    private int applyEdits(
-            PdfJsonDocument document, List<CompiledEdit> edits, Set<Integer> pageFilter) {
-        List<PdfJsonPage> pages = document.getPages();
-        if (pages == null) {
-            return 0;
-        }
-        int modifiedSpans = 0;
-        // The page filter is built from parsePageList against pages.size(), so it returns 1-based
-        // positional page numbers. Match against the same positional numbering here rather than
-        // the per-page pageNumber field, which can become non-sequential after split/merge round
-        // trips and would misalign the filter.
-        for (int i = 0; i < pages.size(); i++) {
-            int positionalPageNumber = i + 1;
-            if (pageFilter != null && !pageFilter.contains(positionalPageNumber)) {
-                continue;
-            }
-            modifiedSpans += applyEditsToPage(pages.get(i), edits);
-        }
-        return modifiedSpans;
-    }
-
-    private int applyEditsToPage(PdfJsonPage page, List<CompiledEdit> edits) {
-        List<PdfJsonTextElement> elements = page.getTextElements();
-        if (elements == null || elements.isEmpty()) {
-            return 0;
-        }
-        Set<Integer> modifiedIndices = new HashSet<>();
-        for (CompiledEdit edit : edits) {
-            applyEditToPage(elements, edit, modifiedIndices);
-        }
-        for (Integer index : modifiedIndices) {
-            // Char codes were captured for the original glyph sequence; clear them so the rebuild
-            // re-encodes from the new text via the font.
-            elements.get(index).setCharCodes(null);
-        }
-        return modifiedIndices.size();
-    }
-
-    /**
-     * Apply a single edit across the page by matching against the concatenation of all element
-     * texts, then writing the replacement back into the originating element(s).
-     */
-    private void applyEditToPage(
-            List<PdfJsonTextElement> elements, CompiledEdit edit, Set<Integer> modifiedIndices) {
-        StringBuilder joined = new StringBuilder();
-        int[] starts = new int[elements.size()];
-        int[] ends = new int[elements.size()];
-        for (int i = 0; i < elements.size(); i++) {
-            starts[i] = joined.length();
-            String text = elements.get(i).getText();
-            if (text != null) {
-                joined.append(text);
-            }
-            ends[i] = joined.length();
-        }
-
-        Matcher matcher = edit.pattern().matcher(joined);
-        List<MatchSpan> spans = new ArrayList<>();
-        StringBuffer interpolation = new StringBuffer();
-        int previousAppendPosition = 0;
-        while (matcher.find()) {
-            if (matcher.start() == matcher.end()) {
-                // Skip zero-length matches (e.g. /a*/ on empty input) — they cannot be applied.
-                continue;
-            }
-            int sizeBefore = interpolation.length();
-            matcher.appendReplacement(interpolation, edit.replacement());
-            int prefixLength = matcher.start() - previousAppendPosition;
-            String actualReplacement =
-                    interpolation.substring(sizeBefore + prefixLength, interpolation.length());
-            spans.add(new MatchSpan(matcher.start(), matcher.end(), actualReplacement));
-            previousAppendPosition = matcher.end();
-        }
-
-        // Apply right-to-left so earlier match positions stay valid as we mutate elements.
-        for (int i = spans.size() - 1; i >= 0; i--) {
-            MatchSpan span = spans.get(i);
-            int firstElement = findElementForCharIndex(starts, ends, span.start());
-            int lastElement = findElementForCharIndex(starts, ends, span.end() - 1);
-            if (firstElement < 0 || lastElement < 0) {
-                continue;
-            }
-            applyMatchToElements(
-                    elements, starts, span, firstElement, lastElement, modifiedIndices);
-        }
-    }
-
-    /**
-     * Find the element whose text covers the character at {@code charIndex} in the joined string.
-     * Returns -1 if no element covers that index (which should not happen for valid match spans).
-     */
-    private static int findElementForCharIndex(int[] starts, int[] ends, int charIndex) {
-        for (int i = 0; i < starts.length; i++) {
-            if (starts[i] <= charIndex && charIndex < ends[i]) {
-                return i;
-            }
-        }
-        return -1;
-    }
-
-    private static void applyMatchToElements(
-            List<PdfJsonTextElement> elements,
-            int[] starts,
-            MatchSpan span,
-            int firstElement,
-            int lastElement,
-            Set<Integer> modifiedIndices) {
-        if (firstElement == lastElement) {
-            PdfJsonTextElement element = elements.get(firstElement);
-            String text = nullToEmpty(element.getText());
-            int matchStartInElement = span.start() - starts[firstElement];
-            int matchEndInElement = span.end() - starts[firstElement];
-            element.setText(
-                    text.substring(0, matchStartInElement)
-                            + span.replacement()
-                            + text.substring(matchEndInElement));
-            modifiedIndices.add(firstElement);
-            return;
-        }
-
-        // Cross-element match: write the whole replacement into the first matched element, empty
-        // any intermediate elements, and keep only the suffix of the last matched element. The
-        // JSON->PDF rebuild concatenates per-token text, so the font lays out the replacement as
-        // one continuous run anchored at the first element's X position.
-        String firstText = nullToEmpty(elements.get(firstElement).getText());
-        int firstSplit = span.start() - starts[firstElement];
-        elements.get(firstElement).setText(firstText.substring(0, firstSplit) + span.replacement());
-        modifiedIndices.add(firstElement);
-
-        for (int mid = firstElement + 1; mid < lastElement; mid++) {
-            elements.get(mid).setText("");
-            modifiedIndices.add(mid);
-        }
-
-        String lastText = nullToEmpty(elements.get(lastElement).getText());
-        int lastSplit = span.end() - starts[lastElement];
-        elements.get(lastElement).setText(lastText.substring(lastSplit));
-        modifiedIndices.add(lastElement);
-    }
-
-    private static String nullToEmpty(String value) {
-        return value != null ? value : "";
-    }
-
-    private String buildOutputFilename(MultipartFile inputFile) {
-        String originalName = inputFile.getOriginalFilename();
-        String baseName =
-                (originalName != null && !originalName.isBlank())
-                        ? FILE_EXTENSION_PATTERN
-                                .matcher(Filenames.toSimpleFileName(originalName))
-                                .replaceFirst("")
-                        : "document";
-        return baseName + "_edited.pdf";
-    }
-
-    private record CompiledEdit(Pattern pattern, String replacement) {}
-
-    private record MatchSpan(int start, int end, String replacement) {}
-}
@@ -3,14 +3,13 @@ package stirling.software.SPDF.controller.api;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
 import java.util.List;
 import java.util.regex.Pattern;

+import org.apache.pdfbox.multipdf.PDFMergerUtility;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
 import org.apache.pdfbox.pdmodel.PDDocumentInformation;
@@ -40,7 +39,6 @@ import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.general.MergePdfsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
@@ -48,11 +46,6 @@ import stirling.software.common.util.PdfErrorUtils;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
-import stirling.software.jpdfium.PdfDocument;
-import stirling.software.jpdfium.PdfMerge;
-import stirling.software.jpdfium.doc.Bookmark;
-import stirling.software.jpdfium.doc.PdfBookmarkEditor;
-import stirling.software.jpdfium.doc.PdfBookmarkEditor.BookmarkTree;

@GeneralApi
@Slf4j
@@ -63,6 +56,7 @@ public class MergeController {
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

+    // Merges a list of PDDocument objects into a single PDDocument
    public PDDocument mergeDocuments(List<PDDocument> documents) throws IOException {
        PDDocument mergedDoc = pdfDocumentFactory.createNewDocument();
        boolean success = false;
@@ -81,8 +75,11 @@ public class MergeController {
        }
    }

+    // Re-order files to match the explicit order provided by the front-end.
+    // fileOrder is newline-delimited original filenames in the desired order.
    private static MultipartFile[] reorderFilesByProvidedOrder(
            MultipartFile[] files, String fileOrder) {
+        // Split by various line endings and trim each entry
        String[] desired =
                stirling.software.common.util.RegexPatternUtils.getInstance()
                        .getNewlineSplitPattern()
@@ -109,6 +106,7 @@ public class MergeController {
        return ordered.toArray(new MultipartFile[0]);
    }

+    // Returns a comparator for sorting MultipartFile arrays based on the given sort type
    private Comparator<MultipartFile> getSortComparator(String sortType) {
        return switch (sortType) {
            case "byFileName" ->
@@ -156,16 +154,18 @@ public class MergeController {
                            return 0;
                        }
                    };
-            case "orderProvided" -> (file1, file2) -> 0;
-            default -> (file1, file2) -> 0;
+            case "orderProvided" -> (file1, file2) -> 0; // Default is the order provided
+            default -> (file1, file2) -> 0; // Default is the order provided
        };
    }

+    // Parse client file IDs from JSON string
    private String[] parseClientFileIds(String clientFileIds) {
        if (clientFileIds == null || clientFileIds.trim().isEmpty()) {
            return new String[0];
        }
        try {
+            // Simple JSON array parsing - remove brackets and split by comma
            String trimmed = clientFileIds.trim();
            if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
                String inside = trimmed.substring(1, trimmed.length() - 1).trim();
@@ -185,29 +185,39 @@ public class MergeController {
        return new String[0];
    }

+    // Adds a table of contents to the merged document using filenames as chapter titles
    private void addTableOfContents(PDDocument mergedDocument, MultipartFile[] files) {
+        // Create the document outline
        PDDocumentOutline outline = new PDDocumentOutline();
        mergedDocument.getDocumentCatalog().setDocumentOutline(outline);

-        int pageIndex = 0;
+        int pageIndex = 0; // Current page index in the merged document
+
+        // Iterate through the original files
        for (MultipartFile file : files) {
+            // Get the filename without extension to use as bookmark title
            String filename = file.getOriginalFilename();
            String title = GeneralUtils.removeExtension(filename);

+            // Create an outline item for this file
            PDOutlineItem item = new PDOutlineItem();
            item.setTitle(title);

+            // Set the destination to the first page of this file in the merged document
            if (pageIndex < mergedDocument.getNumberOfPages()) {
                PDPage page = mergedDocument.getPage(pageIndex);
                item.setDestination(page);
            }
+
+            // Add the item to the outline
            outline.addLast(item);

+            // Increment page index for the next file
            try (PDDocument doc = pdfDocumentFactory.load(file)) {
                pageIndex += doc.getNumberOfPages();
            } catch (IOException e) {
                ExceptionUtils.logException("document loading for TOC generation", e);
-                pageIndex++;
+                pageIndex++; // Increment by at least one if we can't determine page count
            }
        }
    }
@@ -225,6 +235,7 @@ public class MergeController {
                    }
                }

+                // Fallback to XMP metadata if Info dates are missing
                PDMetadata metadata = doc.getDocumentCatalog().getMetadata();
                if (metadata != null) {
                    try (InputStream is = metadata.createInputStream()) {
@@ -260,10 +271,7 @@ public class MergeController {
        return -1;
    }

-    @AutoJobPostMapping(
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            value = "/merge-pdfs",
-            resourceWeight = ResourceWeight.MEDIUM_WEIGHT)
+    @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/merge-pdfs")
    @StandardPdfResponse
    @Operation(
            summary = "Merge multiple PDF files into one",
@@ -275,7 +283,7 @@ public class MergeController {
            @ModelAttribute MergePdfsRequest request,
            @RequestParam(value = "fileOrder", required = false) String fileOrder)
            throws IOException {
-        List<File> filesToDelete = new ArrayList<>();
+        List<File> filesToDelete = new ArrayList<>(); // List of temporary files to delete
        TempFile outputTempFile = null;

        boolean removeCertSign = Boolean.TRUE.equals(request.getRemoveCertSign());
@@ -286,35 +294,48 @@ public class MergeController {
            files = new MultipartFile[0];
        }

+        // If front-end provided explicit visible order, honor it and override backend sorting
        if (fileOrder != null && !fileOrder.isBlank()) {
            log.info("Reordering files based on fileOrder parameter");
            files = reorderFilesByProvidedOrder(files, fileOrder);
        } else {
            log.info("Sorting files based on sortType: {}", request.getSortType());
-            Arrays.sort(files, getSortComparator(request.getSortType()));
+            Arrays.sort(
+                    files,
+                    getSortComparator(
+                            request.getSortType())); // Sort files based on requested sort type
        }

        try (TempFile mt = new TempFile(tempFileManager, ".pdf")) {

-            List<Path> inputPaths = new ArrayList<>(files.length);
+            PDFMergerUtility mergerUtility = new PDFMergerUtility();
+            long totalSize = 0;
            List<Integer> invalidIndexes = new ArrayList<>();
            for (int index = 0; index < files.length; index++) {
                MultipartFile multipartFile = files[index];
-                File tempFile = tempFileManager.convertMultipartFileToFile(multipartFile);
-                filesToDelete.add(tempFile);
-                inputPaths.add(tempFile.toPath());
+                totalSize += multipartFile.getSize();
+                File tempFile =
+                        tempFileManager.convertMultipartFileToFile(
+                                multipartFile); // Convert MultipartFile to File
+                filesToDelete.add(tempFile); // Add temp file to the list for later deletion

-                try (PdfDocument ignored = PdfDocument.open(tempFile.toPath())) {
-                } catch (Exception e) {
+                // Pre-validate each PDF so we can report which one(s) are broken
+                // Use the original MultipartFile to avoid deleting the tempFile during validation
+                try (PDDocument ignored = pdfDocumentFactory.load(multipartFile)) {
+                    // OK
+                } catch (IOException e) {
                    ExceptionUtils.logException("PDF pre-validate", e);
                    invalidIndexes.add(index);
                }
+                mergerUtility.addSource(tempFile); // Add source file to the merger utility
            }

-            int[] pageCounts;
+            mergerUtility.setDestinationFileName(mt.getFile().getAbsolutePath());
+
            try {
-                pageCounts =
-                        mergeWithJpdfium(inputPaths, files, generateToc, mt.getFile().toPath());
+                mergerUtility.mergeDocuments(
+                        pdfDocumentFactory.getStreamCacheFunction(
+                                totalSize)); // Merge the documents
            } catch (IOException e) {
                ExceptionUtils.logException("PDF merge", e);
                if (PdfErrorUtils.isCorruptedPdfError(e)) {
@@ -323,26 +344,10 @@ public class MergeController {
                throw e;
            }

-            boolean sigFlattenNeeded = false;
-            if (removeCertSign) {
-                try (PdfDocument check = PdfDocument.open(mt.getFile().toPath())) {
-                    sigFlattenNeeded = !check.signatures().isEmpty();
-                } catch (Exception e) {
-                    log.debug(
-                            "JPDFium signature pre-check failed; falling back to PDFBox flatten:"
-                                    + " {}",
-                            e.getMessage());
-                    sigFlattenNeeded = true;
-                }
-                if (!sigFlattenNeeded) {
-                    log.info(
-                            "removeCertSign requested but merged document has no signature"
-                                    + " fields; skipping PDFBox flatten pass");
-                }
-            }
-
-            if (sigFlattenNeeded) {
-                try (PDDocument mergedDocument = pdfDocumentFactory.load(mt.getFile())) {
+            // Load the merged PDF document and operate on it inside try-with-resources
+            try (PDDocument mergedDocument = pdfDocumentFactory.load(mt.getFile())) {
+                // Remove signatures if removeCertSign is true
+                if (removeCertSign) {
                    PDDocumentCatalog catalog = mergedDocument.getDocumentCatalog();
                    PDAcroForm acroForm = catalog.getAcroForm();
                    if (acroForm != null) {
@@ -350,26 +355,24 @@ public class MergeController {
                                acroForm.getFields().stream()
                                        .filter(PDSignatureField.class::isInstance)
                                        .toList();
+
                        if (!fieldsToRemove.isEmpty()) {
-                            acroForm.flatten(fieldsToRemove, false);
+                            acroForm.flatten(
+                                    fieldsToRemove,
+                                    false); // Flatten the fields, effectively removing them
                        }
                    }
-                    outputTempFile = new TempFile(tempFileManager, ".pdf");
-                    try {
-                        mergedDocument.save(outputTempFile.getFile());
-                    } catch (Exception e) {
-                        outputTempFile.close();
-                        outputTempFile = null;
-                        throw e;
-                    }
                }
-            } else {
+
+                // Add table of contents if generateToc is true
+                if (generateToc && files.length > 0) {
+                    addTableOfContents(mergedDocument, files);
+                }
+
+                // Save the modified document to a temporary file
                outputTempFile = new TempFile(tempFileManager, ".pdf");
                try {
-                    Files.copy(
-                            mt.getFile().toPath(),
-                            outputTempFile.getFile().toPath(),
-                            java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                    mergedDocument.save(outputTempFile.getFile());
                } catch (Exception e) {
                    outputTempFile.close();
                    outputTempFile = null;
@@ -388,7 +391,7 @@ public class MergeController {
            throw ex;
        } finally {
            for (File file : filesToDelete) {
-                tempFileManager.deleteTempFile(file);
+                tempFileManager.deleteTempFile(file); // Delete temporary files
            }
        }

@@ -398,113 +401,4 @@ public class MergeController {

        return WebResponseUtils.pdfFileToWebResponse(outputTempFile, mergedFileName);
    }
-
-    private int[] mergeWithJpdfium(
-            List<Path> inputPaths, MultipartFile[] files, boolean generateToc, Path outputPath)
-            throws IOException {
-        if (inputPaths.isEmpty()) {
-            try (PdfDocument empty = PdfDocument.open(new byte[0])) {
-                empty.save(outputPath);
-            } catch (Exception ignored) {
-                Files.write(outputPath, new byte[0]);
-            }
-            return new int[0];
-        }
-
-        List<PdfDocument> docs = new ArrayList<>(inputPaths.size());
-        int[] pageCounts = new int[inputPaths.size()];
-        int[] pageOffsets = new int[inputPaths.size()];
-        List<List<Bookmark>> sourceBookmarks = new ArrayList<>(inputPaths.size());
-        int runningOffset = 0;
-        try {
-            for (int i = 0; i < inputPaths.size(); i++) {
-                Path p = inputPaths.get(i);
-                PdfDocument doc = PdfDocument.open(p);
-                docs.add(doc);
-                pageCounts[i] = doc.pageCount();
-                pageOffsets[i] = runningOffset;
-                sourceBookmarks.add(doc.bookmarks());
-                runningOffset += pageCounts[i];
-            }
-
-            BookmarkTree combinedTree =
-                    buildCombinedBookmarkTree(files, pageOffsets, sourceBookmarks, generateToc);
-
-            try (PdfDocument merged = PdfMerge.merge(docs)) {
-                if (combinedTree.entries().isEmpty()) {
-                    merged.save(outputPath);
-                } else {
-                    PdfBookmarkEditor.setBookmarks(merged, combinedTree, outputPath);
-                }
-            }
-        } catch (RuntimeException e) {
-            throw new IOException("JPDFium merge failed", e);
-        } finally {
-            for (PdfDocument doc : docs) {
-                try {
-                    doc.close();
-                } catch (Exception ignored) {
-                }
-            }
-        }
-        return pageCounts;
-    }
-
-    private BookmarkTree buildCombinedBookmarkTree(
-            MultipartFile[] files,
-            int[] pageOffsets,
-            List<List<Bookmark>> sourceBookmarks,
-            boolean generateToc) {
-        BookmarkTree.Builder builder = BookmarkTree.builder();
-
-        if (generateToc) {
-            for (int i = 0; i < files.length; i++) {
-                String filename = files[i].getOriginalFilename();
-                String title = GeneralUtils.removeExtension(filename);
-                if (title == null || title.isBlank()) {
-                    title = "Document " + (i + 1);
-                }
-                builder.add(title, pageOffsets[i]);
-            }
-        }
-
-        for (int i = 0; i < sourceBookmarks.size(); i++) {
-            int offset = pageOffsets[i];
-            for (Bookmark bm : sourceBookmarks.get(i)) {
-                addBookmarkFlat(builder, bm, offset);
-            }
-        }
-
-        return builder.build();
-    }
-
-    private void addBookmarkFlat(BookmarkTree.Builder builder, Bookmark root, int offset) {
-        final int maxNodes = 100_000;
-        java.util.Deque<Bookmark> stack = new java.util.ArrayDeque<>();
-        java.util.Set<Bookmark> visited =
-                java.util.Collections.newSetFromMap(new java.util.IdentityHashMap<>());
-        stack.push(root);
-        int processed = 0;
-        while (!stack.isEmpty() && processed < maxNodes) {
-            Bookmark bm = stack.pop();
-            if (!visited.add(bm)) {
-                continue;
-            }
-            processed++;
-            if (bm.isInternal() && bm.title() != null) {
-                builder.add(bm.title(), offset + bm.pageIndex());
-            }
-            if (bm.hasChildren()) {
-                List<Bookmark> children = bm.children();
-                for (int i = children.size() - 1; i >= 0; i--) {
-                    stack.push(children.get(i));
-                }
-            }
-        }
-        if (processed >= maxNodes) {
-            log.warn(
-                    "Source bookmark traversal hit {}-node cap; remaining bookmarks dropped",
-                    maxNodes);
-        }
-    }
 }
@@ -24,7 +24,6 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.SPDF.model.api.general.MergeMultiplePagesRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralFormCopyUtils;
@@ -42,8 +41,7 @@ public class MultiPageLayoutController {

    @AutoJobPostMapping(
            value = "/multi-page-layout",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.MEDIUM_WEIGHT)
+            consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
            summary = "Merge multiple pages of a PDF document into a single page",
            description =
@@ -25,7 +25,6 @@ import stirling.software.SPDF.config.swagger.StandardPdfResponse;
 import stirling.software.SPDF.model.api.general.OverlayPdfsRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
@@ -40,10 +39,7 @@ public class PdfOverlayController {
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

-    @AutoJobPostMapping(
-            value = "/overlay-pdfs",
-            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
-            resourceWeight = ResourceWeight.MEDIUM_WEIGHT)
+    @AutoJobPostMapping(value = "/overlay-pdfs", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @StandardPdfResponse
    @Operation(
            summary = "Overlay PDF files in various modes",
@@ -28,7 +28,6 @@ import stirling.software.SPDF.config.swagger.MultiFileResponse;
 import stirling.software.SPDF.model.api.general.PosterPdfRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
-import stirling.software.common.enumeration.ResourceWeight;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
@@ -44,10 +43,7 @@ public class PosterPdfController {
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final TempFileManager tempFileManager;

-    @AutoJobPostMapping(
-            value = "/split-for-poster-print",
-            consumes = "multipart/form-data",
-            resourceWeight = ResourceWeight.MEDIUM_WEIGHT)
+    @AutoJobPostMapping(value = "/split-for-poster-print", consumes = "multipart/form-data")
    @MultiFileResponse
    @Operation(
            summary = "Split large PDF pages into smaller printable chunks",
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
EthanHealy01	e2e37695cd	fix: use ?? instead of \|\| so empty thumbnail string skips generation	2026-05-05 17:50:09 +01:00
EthanHealy01	fa3e9f5db6	fix: remove unreachable size check inside image branch of generateThumbnailForFile	2026-05-05 17:49:18 +01:00
EthanHealy01	2c7efe1e83	refactor: consolidate thumbnail rendering onto UIRedesignStaging base Apply useFileThumbnail + DocumentThumbnail to FileEditorThumbnail, rebased onto UIRedesignStaging. Also carry forward the FileEditorFileName truncation fix from main (#6310).	2026-05-05 17:31:04 +01:00
EthanHealy01	18fd86f5bf	These adress the change requests along with some other issues I found with our UI	2026-05-05 17:25:31 +01:00
EthanHealy01	93ab2b4805	merge main	2026-05-05 11:54:46 +01:00
EthanHealy01	54805896d6	Merge remote-tracking branch 'origin/main' into UIRedesignStaging	2026-05-01 18:54:21 +01:00
EthanHealy01	0a73467ce5	Revert "fix: viewer stays on signed file instead of jumping to file A after tool run" This reverts commit `df056a8f2d`.	2026-05-01 14:35:11 +01:00
EthanHealy01	df056a8f2d	fix: viewer stays on signed file instead of jumping to file A after tool run Remove the useEffect that cleared activeFileId when its file left the workbench. That effect raced with tool operations: CONSUME_FILES atomically removes the input and adds the output in one dispatch, but the clearing effect fired between the dispatch and the tool's setActiveFileId(newId) call, clobbering the correct new ID with null. activeFileIndex already falls back to 0 for stale/null IDs, so the clearing effect was not needed for correctness.	2026-05-01 14:32:48 +01:00
EthanHealy01	34d9baa1be	fix: move close icon from hamburger to search icon when search is active	2026-05-01 14:23:15 +01:00
EthanHealy01andGitHub	d86259c596	Merge branch 'main' into UIRedesignStaging	2026-05-01 14:13:58 +01:00
EthanHealy01	178c3c3331	prettier	2026-05-01 14:04:33 +01:00
EthanHealy01	39e0fb630c	fix: stay on multi-tool after first file upload getStartupNavigationAction was unconditionally redirecting to viewer/ fileEditor on 0→N file transitions, overriding the multi-tool workbench. Exempt multiTool the same way pdfTextEditor already is.	2026-05-01 12:17:14 +01:00
EthanHealy01andGitHub	ed7a9d1a01	Merge branch 'main' into UIRedesignStaging	2026-05-01 12:10:38 +01:00
EthanHealy01	be69d071bc	test(e2e): fix Firefox toggle click in settings spec Click the visible label wrapper instead of force-clicking the hidden checkbox input, which Firefox does not register as a state change.	2026-05-01 12:07:55 +01:00
EthanHealy01	a8671ec1f7	test(e2e): fix all stubbed Playwright test failures Updated stubbed specs to match the redesigned UI: fixed locators for WorkbenchBar buttons, FileSidebar search, navigation, settings dialog, language selector, and in-document PDF search. All 130 stubbed tests now pass (7 intentional skips for build-conditional features).	2026-05-01 10:55:19 +01:00
EthanHealy01	9cb40ad6ff	Add missing workbenchBar.multiTool translation key	2026-04-30 21:31:07 +01:00
EthanHealy01	67fc78b6df	Fix lint, formatting, and TOML parse errors post-merge - Remove unused meta variable and getFileTypeMeta import from NonPdfViewer - Fix TOML: move compare.edited.selectBaseFirst and compare.swap.label from dotted-key form in [compare] to their proper subsections - Run Prettier on 7 files flagged by format check	2026-04-30 21:29:11 +01:00
EthanHealy01	b5b4bbc46b	Merge branch 'main' into UIRedesignStaging Resolved conflict in en-GB/translation.toml: - Accept main's reorganised/alphabetised structure - Restore UIRedesign wording (checked/add vs selected/select terminology) - Add sections new to UIRedesign: fileSelectorPicker, fileSidebar, workbenchBar - Add missing keys: rightRail.closeAll/share, tool.filesLoading/filesLoadingProgress, settings.general theme/language keys, fileEditor.pageCount, encryptedPdfUnlock viewer keys	2026-04-30 21:24:27 +01:00
EthanHealy01	849899f58c	Merge remote-tracking branch 'origin/UIRedesignStaging' into UIRedesignStaging	2026-04-30 21:17:08 +01:00
EthanHealy01	a42fdfad00	UI redesign: multi-tool mode, workbench bar animation, PDFium rendering fixes - Add multi-tool mode support across FileSidebar, FilesModalContext, PageEditorContext, WorkbenchBar, and ToolWorkflowContext — adding files stays in pageEditor view and auto-selects files; left panel hides/shows on workbench switch - Animate WorkbenchBar in/out via CSS grid-template-rows trick when files are added/removed; suppress initial transition with rAF flag - Fix PDFium pixel format (RGBA not BGRA) and rotation logic (effective dims already post-rotation; counter-rotate when applyRotation=false) - Fix PageEditor flash of "No PDF files loaded" by checking file context directly - Redesign AddFileCard: solid border, rounded corners, shadow hover, focus-visible ring - Show AddFileCard in FileEditor empty state instead of text stack - Add date grouping helpers (today/yesterday/thisWeek/thisMonth/older) to FileSidebar - Redesign FilePdfIcon: solid filled with folded corner, red colour - Simplify NonPdfBanner: remove file-type badge, keep only convert-to-PDF button - Fix thumbnail precedence in useToolOperation (prefer metadata.thumbnailUrl) - Fix fileActions stub dispatch to trigger selector re-render after ADD_FILES - Switch Annotate to useAllFiles and Automate/AutomationRun to useViewScopedFiles	2026-04-30 21:16:58 +01:00
EthanHealy01andGitHub	770577edb6	Merge branch 'main' into UIRedesignStaging	2026-04-24 11:00:53 +01:00
EthanHealy01	eaed8feb42	aikido change requests	2026-04-23 18:59:36 +01:00
EthanHealy01andGitHub	a0f294e68e	Merge branch 'main' into UIRedesignStaging	2026-04-23 14:36:38 +01:00
EthanHealy01andGitHub	3b24b3479a	Merge branch 'main' into UIRedesignStaging	2026-04-23 13:05:14 +01:00
EthanHealy01	fd1cf4468e	prettier	2026-04-21 22:38:27 +01:00
EthanHealy01	04c5fbc590	change stuff for playwright test and remove test for drag and drop compare upload which no longer exists	2026-04-21 21:26:19 +01:00
EthanHealy01andGitHub	d2f28e07ea	Merge branch 'main' into UIRedesignStaging	2026-04-21 18:50:19 +01:00
EthanHealy01	2843418fb7	frontend validatoin	2026-04-21 18:47:23 +01:00
EthanHealy01	53377da75d	test	2026-04-21 18:09:22 +01:00
EthanHealy01	93b1669f63	Merge branch 'main' of https://github.com/Stirling-Tools/Stirling-PDF into UIRedesignStaging	2026-04-21 16:35:51 +01:00
EthanHealy01andGitHub	7dc164453b	UIUX/UI redesign (#6107 ) # PR: feature/UIRedesign → UIRedesignStaging ## Overview Major layout restructure: the old right-rail icon column and top file-tab strip are replaced by a new horizontal `WorkbenchBar` and a new persistent `FileSidebar` on the left. Alongside those headline changes, a range of bugs are fixed around viewer state, file management, and thumbnail caching. --- ## Changes ### 1. Page layout restructured Before: `QuickAccessBar` above content, `ToolPanel` on the left, `RightRail` vertical icon column on the right. After: `FileSidebar` on the left, `WorkbenchBar` across the top, `ToolPanel` on the right. The right rail is gone. --- ### 2. `FileSidebar` — new persistent left sidebar Why: The only way to see saved files was opening the file manager modal. The sidebar gives quick access to everything in IndexedDB without a modal. Before: No persistent sidebar. Files managed exclusively via the modal. After: - Collapsible strip on the left (collapses to a narrow icon strip, expands to a file list). - Shows all saved files, sorted by last modified. Files not yet persisted to IndexedDB also appear. - Click a file to toggle it on/off the workbench. If the file is open in the viewer with unsaved changes, the save prompt fires first. - Search bar filters by filename. - Add files from computer or Google Drive directly from the sidebar. - Thumbnail appears on hover, loaded lazily and cached for future visits. - The currently-viewed file is pinned at the top of the list with a green highlight. - List updates automatically when files are added or deleted anywhere in the app. --- ### 3. `WorkbenchBar` replaces `TopControls` + `RightRail` Why: `TopControls` only showed when files existed and only displayed file tabs. The right rail was a separate vertical column. Neither gave a coherent home for view switching, tool actions, and file operations. Before: File tabs in a strip at the top; download/close/view buttons in a separate vertical column on the right. After: - Always visible bar across the top. - Left: Viewer / Active Files view switcher (hidden when no files are open). - Centre: Tool-specific action buttons (the same buttons that previously lived in the right rail), plus zoom controls when in viewer mode. - Right: Print (viewer only), Close (closes the current file in viewer mode, closes all files in file editor mode), Download, Save As. - Adapts to narrow widths by wrapping into two rows. --- ### 4. Viewer — active file never loses track after tool operations Why: After running a tool on a file, the viewer would sometimes jump to showing a different file. Before: The "active file index" and "active file ID" were tracked as two separate pieces of state that could desync when files were reordered after a tool ran. After: The index is always derived from the ID, so they can never disagree. The viewer stays on the correct file after any operation. ### 5. Auto-navigate after file upload Before: After uploading files via the modal, the user was left on whatever view was active — no automatic navigation. After: Single file uploaded → navigates to viewer. Multiple files uploaded → navigates to Active Files. --- ### 6. Run button shows loading progress while files are still loading Why: Opening a tool immediately after uploading many files could silently skip files that hadn't finished loading yet. Before: Run button was enabled immediately; files still being loaded from storage were silently skipped. After: While files are loading, the run button is replaced with a disabled progress indicator. For multiple pending files it shows "2 / 5 files loading…". Once all files are ready, the button becomes active. --- ### 7. Bulk delete in file manager Why: Deleting many files at once was slow and caused visible flicker as each file was removed one by one. Before: Each selected file went through the full single-delete flow sequentially. After: Local files are deleted in a single batch operation — one UI update, one IndexedDB transaction. Server-connected files still go through the sequential flow since each may need a confirmation prompt. --- ### 8. Deselecting a dirty file in the modal no longer removes it from the workbench Before: Deselecting a file in the file manager and clicking "Open" would remove it from the workbench even if it had unsaved changes. After: Files with unsaved changes are skipped when removing deselected files. --- ### 9. File manager — "Close all files" button Before: With nothing selected in the file manager, the "Open File" button was disabled. After: When nothing is selected but files are open, the button changes to "Close all files" and becomes enabled. --- ### 10. File picker — search and hover thumbnails Before: No way to filter the file list in the picker dropdown. No visual preview. After: Search input filters files by name. Hovering a row shows a thumbnail preview. --- ### 11. Pan and ruler modes are now mutually exclusive Before: Enabling the pan tool while the ruler was active left the ruler in a broken state, and vice versa. After: Activating either tool automatically deactivates the other. --- ### 12. Tool icons switched to outline style All tool icons in the picker are now the outline variant instead of the filled/solid variant, for a lighter, more consistent look. --- ### 13. Settings — language and theme options added to General settings Language and theme (light/dark) controls are now available in Settings → General. --- ## Test Script --- ### Sidebar and file management 1. Sidebar toggle: Confirm the left sidebar strip is visible on load. Click expand — confirm the file list appears. Click collapse — confirm it shrinks back to the strip. 2. Upload and see files: Upload 3 PDFs. Confirm all three appear in the sidebar list without needing to open any modal. 3. Sidebar search: Type part of a filename in the sidebar search box. Confirm the list filters. Clear it — confirm all files return. 4. Toggle files on workbench from sidebar: Click a file in the sidebar that isn't on the workbench — confirm it opens. Click it again — confirm it closes. 5. Save prompt via sidebar: Open a file in the viewer and make a change (e.g. annotate). Click that file in the sidebar to close it — confirm the unsaved-changes save prompt appears. 6. Thumbnail on hover: Hover a file row in the sidebar — confirm a thumbnail preview appears. 7. Currently viewed file pinned: With multiple files open, confirm the one you're viewing is highlighted at the top of the sidebar list. 8. Sidebar reflects deletions: Delete a file via the file manager modal. Confirm the sidebar updates automatically without a page reload. --- ### Workbench bar 9. No files state: With no files open, confirm the workbench bar is visible but no view tabs are shown. 10. View tabs appear: Upload a file — confirm "Viewer" and "Active Files" tabs appear. Switch between them. 11. Close button behaviour: In Active Files with multiple files, click Close — confirm all files close. Open a single file in viewer mode, click Close — confirm only that file closes. 12. Download: Open a file in the viewer, click Download — confirm the file saves. 13. Zoom controls in viewer: Confirm zoom in/out and a slider appear in the bar's centre when in viewer mode. Drag the slider — confirm the PDF zooms live. Switch to Active Files — confirm the controls disappear. --- ### Tool panel 14. Collapse/expand: Collapse the tool panel. Confirm a narrow strip remains (not blank space). Click the expand icon — panel opens. Collapse again, click the search icon — confirm the panel opens with the search field already focused. 15. Back button in tool: Open a tool (e.g. Compress). Confirm the search bar icon changes to a back arrow. Click it — confirm you return to the tool list. 16. Viewer tool mini bar: Open a PDF in the viewer. Confirm a mini toolbar appears at the top of the panel with viewer-specific buttons (annotate, redact, form fill, etc.). Switch to Active Files — confirm it disappears. --- ### Running tools with files loading 17. Loading indicator on run button: Upload 5+ PDFs and immediately open a tool (e.g. Compress or Merge). If files are still loading, confirm the run button shows a loading progress indicator and is disabled. Wait until loading finishes — confirm the button becomes active. --- ### Viewer correctness 18. Active file stays put after tool run: Open 3 PDFs. Navigate to file #2 in the viewer. Run a tool (e.g. rotate) on file #2. Confirm the viewer stays on file #2 after the operation completes. 19. Pan / ruler mutual exclusion: Open a PDF. Enable pan. Enable the ruler — confirm pan turns off. Re-enable pan — confirm the ruler turns off. --- ### File manager 20. Bulk delete: Open the file manager, select 3+ local files, click Delete Selected. Confirm all disappear in one go with no flicker, and the sidebar updates. 21. Dirty file not removed on deselect: Open a PDF, make a change. Open the file manager, deselect that file, click Open. Confirm the file is still on the workbench. 22. Close all from modal: Have files open. Open the file manager, deselect everything — confirm the button changes to "Close all files". Click it — confirm all files close. --- ### File picker (inside tools) 23. Search in picker: Open a tool with a file picker (e.g. Merge, Compare). Open the picker dropdown. Type a partial name — confirm the list filters. Hover a row — confirm a thumbnail appears. --- ### Other flows 24. Auto-navigate after upload: Upload a single PDF via the modal — confirm you land in the viewer. Upload multiple at once — confirm you land in Active Files. 25. Landscape PDF aspect ratio: Upload a landscape PDF. In Active Files view, confirm its thumbnail card is wider than tall. 26. Compare tool clear label: Open the Compare tool. Click to clear the selection. Confirm the confirm button reads "Clear Selected". 27. Settings — language and theme: Open Settings → General. Confirm Language and Theme controls exist. Toggle theme — confirm it switches. 28. Tool icons: Open the tool picker and confirm all tool icons use the outline/unfilled style. <img width="2056" height="1077" alt="Screenshot 2026-04-14 at 5 08 36 PM" src="https://github.com/user-attachments/assets/b68243cb-70f6-4aac-b4e8-76ca6c617be2" /> <img width="2056" height="1080" alt="Screenshot 2026-04-14 at 5 08 51 PM" src="https://github.com/user-attachments/assets/b3c1525b-6f30-4abc-b85a-ce2368e376c7" /> <img width="2056" height="1081" alt="Screenshot 2026-04-14 at 5 09 10 PM" src="https://github.com/user-attachments/assets/894bb5a4-dd4b-49ae-a7da-2ee343c6c656" /> <img width="2056" height="1080" alt="Screenshot 2026-04-14 at 5 09 31 PM" src="https://github.com/user-attachments/assets/9d4dd1e4-026d-4736-891d-0ae6647318d4" />	2026-04-21 15:48:02 +01:00
EthanHealy01andGitHub	be85773852	remove selected and de-selected logic and change the compare tool to accomadate (#6095 ) # Changes 1. Files are no longer selected/deselected, they're just on the workbench or not. 2. Compare tool logic was changed to accommodate the changes in file selection 3. Added a re-usable file selector component that allows you to select files from the workbench / saved files / upload files and used it in the compare tool. <img width="2056" height="1081" alt="Screenshot 2026-04-10 at 5 28 07 PM" src="https://github.com/user-attachments/assets/e04f1c0e-91fc-4564-a6f1-b9b992ca4f70" /> 3. Files on active files are cleaner looking, on hover shows buttons, tool runs, versions <img width="325" height="378" alt="Screenshot 2026-04-10 at 4 56 52 PM" src="https://github.com/user-attachments/assets/d29d88fe-2c72-4c5f-9650-1376085bcff6" /> <img width="286" height="363" alt="Screenshot 2026-04-10 at 4 57 05 PM" src="https://github.com/user-attachments/assets/387c1709-de22-4cc8-b658-9f4c9f192af1" /> # How to test ## Compare tool 1. Open the Compare tool with no files on the workbench 3. Click the Original PDF picker → confirm the popover opens with Saved Files and Workbench tabs 5. Switch to Saved Files, pick a file → confirm it appears as a card but does not appear in the workbench file list 6. Pick a second file for Edited PDF → confirm the Compare button becomes active 7. Hit Compare → confirm results appear in the workbench view 8. Hit Swap → confirm a re-run is triggered and results update correctly 9. Use the upload button → confirm a thumbnail appears on the card immediately 10. Clear selected → confirm both slots reset and the workbench view closes ## FileSelectorPicker 1. Open either slot picker and switch between Saved Files / Workbench tabs — confirm the active tab is remembered when you open the other slot's picker 3. Sort by A–Z then reopen — confirm sort preference persists 4. Upload a PDF via the Upload tab button — confirm thumbnail shows in the card, file appears in Saved Files on next open 5. With a file in the other slot, confirm it is hidden from both tab lists (excludeIds) ## File editor 1. Load 3+ files, run any tool (e.g. Compress) — confirm it runs on all files without needing to select any 2. Confirm Close All removes all files from the workbench	2026-04-14 17:03:59 +01:00