Merge branch 'V2' into mainToV2Clone

# Description of Changes

- Standardized all locale-sensitive operations to use `Locale.ROOT`:
- Replaced `toLowerCase()/toUpperCase()` and `String.format(...)` with
`Locale.ROOT` variants across services, controllers, utils, and tests
(e.g., `InstallationPathConfig`, `ApplicationProperties`,
`ResourceMonitor`, `ChecksumUtils`, `PdfUtils`, `UploadLimitService`).
- Hardened comparisons and parsing:
- Normalized host/domain and file-extension checks with
`toLowerCase(Locale.ROOT)`; switched several `equals` calls to
constant-first style (e.g., content types, security domain checks).
- Logging & formatting improvements:
- Ensured percent/size values and hex formatting use root-locale
formatting to avoid locale-dependent output.
- Code quality & readability:
  - Converted multiple if/else ladders to modern `switch` expressions.
- Minor refactors (method references, early returns), removed redundant
returns, and clarified log messages.
- Minor fixes/behavioral nits:
- Normalized printer selection by lowercasing the searched name once;
made some equality checks null-safe/constant-first; added missing
`@Override` annotations where appropriate.

## Why

- Consistent use of `Locale.ROOT` avoids surprises in different
user/system locales (e.g., Turkish-I issues), makes string comparisons
deterministic, and keeps numeric/hex formatting stable across
environments.

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

---------

Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Co-authored-by: James Brunton <jbrunton96@gmail.com>

.dockerignore

@@ -1,75 +0,0 @@
-# Node modules and build artifacts
-node_modules
-frontend/node_modules
-frontend/dist
-frontend/build
-frontend/.vite
-frontend/.tauri
-frontend/src-tauri/target
-
-# Gradle build artifacts
-.gradle
-build
-bin
-target
-out
-
-# Git
-.git
-.gitignore
-
-# IDE
-.vscode
-.idea
-*.iml
-*.iws
-*.ipr
-
-# Logs
-*.log
-logs
-
-# Environment files
-.env
-.env.*
-!.env.example
-
-# OS files
-.DS_Store
-Thumbs.db
-
-# Java compiled files
-*.class
-*.jar
-*.war
-*.ear
-
-# Test reports
-test-results
-coverage
-
-# Docker
-docker-compose.override.yml
-.dockerignore
-
-# Temporary files
-tmp
-temp
-*.tmp
-*.swp
-*~
-
-# Runtime database and config files (locked by running app)
-app/core/configs/**
-stirling/**
-stirling-pdf-DB*.mv.db
-stirling-pdf-DB*.trace.db
-
-# Documentation
-*.md
-!README.md
-docs
-
-# CI/CD
-.github
-.gitlab-ci.yml

.github/config/.files.yaml

@@ -2,28 +2,26 @@ build: &build
   - build.gradle
   - app/(common|core|proprietary)/build.gradle
 
-openapi: &openapi
-  - *build
+app: &app
   - app/(common|core|proprietary)/src/main/java/**
 
-docker: &docker
-  - Dockerfile
-  - Dockerfile.fat
-  - Dockerfile.ultra-lite
-  - ".github/workflows/build.yml"
-  - scripts/init.sh
-  - scripts/init-without-ocr.sh
-  - exampleYmlFiles/**
+openapi: &openapi
+  - build.gradle
+  - app/(common|core|proprietary)/build.gradle
+  - app/(common|core|proprietary)/src/main/java/**
 
 project: &project
   - app/(common|core|proprietary)/src/(main|test)/java/**
-  - *build
-  - "app/(common|core|proprietary)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
+  - app/(common|core|proprietary)/build.gradle
+  - 'app/(common|core|proprietary)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*'
   - exampleYmlFiles/**
   - gradle/**
   - libs/**
-  - "testing/**/!(requirements*.txt|requirements*.in)*"
-  - *docker
+  - 'testing/**/!(requirements*.txt|requirements*.in)*'
+  - build.gradle
+  - Dockerfile
+  - Dockerfile.fat
+  - Dockerfile.ultra-lite
   - gradle.properties
   - gradlew
   - gradlew.bat
@@ -31,30 +29,9 @@ project: &project
   - settings.gradle
   - frontend/**
   - docker/**
-  - scripts/RestartHelper.java
 
 frontend: &frontend
   - frontend/**
   - .github/workflows/testdriver.yml
   - testing/**
   - docker/**
-  - scripts/translations/*.py
-  - scripts/build-tauri-jlink.bat
-  - scripts/build-tauri-jlink.sh
-  - scripts/convert_cff_to_ttf.py
-  - scripts/harvest_type3_fonts.py
-  - scripts/ignore_translation.toml
-  - scripts/index_type3_catalogue.py
-  - scripts/summarize_type3_signatures.py
-  - scripts/type3_to_cff.py
-  - scripts/update_type3_library.py
-
-licenses-frontend: &licenses-frontend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - "frontend/package.json"
-  - "frontend/package-lock.json"
-  - "frontend/scripts/generate-licenses.js"
-
-licenses-backend: &licenses-backend
-  - ".github/workflows/frontend-backend-licenses-update.yml"
-  - *build

.github/config/dependency-review-config.yml

@@ -1 +0,0 @@
-allow-ghsas: GHSA-wrw7-89jp-8q8g

.github/dependabot.yml

@@ -6,65 +6,18 @@
 version: 2
 updates:
   - package-ecosystem: "gradle" # See documentation for possible values
-    directories: 
-      - "/" # Location of package manifests
-      - "/app/common"
-      - "/app/core"
-      - "/app/proprietary"
+    directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10
     rebase-strategy: "auto"
 
   - package-ecosystem: "docker"
     directory: "/" # Location of Dockerfile
     schedule:
       interval: "weekly"
-    rebase-strategy: "auto"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directory: /devTools
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/backend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/embedded
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/frontend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directory: /frontend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: cargo
-    directory: /frontend/src-tauri
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: pip
-    directory: /testing/cucumber
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"

.github/labeler-config-srvaroa.yml

@@ -46,34 +46,26 @@ labels:
   - label: 'API'
     title: '.*openapi.*|.*swagger.*|.*api.*'
 
-  - label: 'v3'
-    base-branch: 'V3'
+  - label: 'v2'
+    base-branch: 'V2'
 
   - label: 'Translation'
     files:
-      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}.properties'
       - 'scripts/ignore_translation.toml'
-      - 'scripts/remove_translation_keys.sh'
-      - 'scripts/replace_translation_line.sh'
-      - 'scripts/translations/.*'
-      - '.github/scripts/check_language_toml.py'
-      - 'scripts/counter_translation_v3.py'
+      - 'app/core/src/main/resources/templates/fragments/languages.html'
+      - '.github/scripts/check_language_properties.py'
 
   - label: 'Front End'
     files:
+      - 'app/core/src/main/resources/templates/.*'
+      - 'app/proprietary/src/main/resources/templates/.*'
       - 'app/core/src/main/resources/static/.*'
       - 'app/proprietary/src/main/resources/static/.*'
       - 'app/core/src/main/java/stirling/software/SPDF/controller/web/.*'
       - 'app/core/src/main/java/stirling/software/SPDF/UI/.*'
       - 'app/proprietary/src/main/java/stirling/software/proprietary/security/controller/web/.*'
       - 'frontend/**'
-      - 'frontend/.*'
-      - 'frontend/**/.*'
-
-  - label: 'Tauri'
-    files:
-      - 'frontend/src-tauri/**'
-      - 'frontend/src-tauri/.*'
 
   - label: 'Java'
     files:

.github/labels.yml

@@ -84,9 +84,6 @@
 - name: "v2"
   color: "FFFF00"
   description: "Issues or pull requests related to the v2 branch"
-- name: "v3"
-  color: "FFA500"
-  description: "Issues or pull requests related to the v3 branch"
 - name: "wontfix"
   description: "This will not be worked on"
   color: "FFFFFF"
@@ -190,14 +187,3 @@
 - name: "break-change"
   color: "FF0000"
   description: "This PR introduces a breaking API change."
-- name: "Rust"
-  color: "DEA584"
-  description: "Pull requests that update Rust code"
-  from_name: "rust"
-- name: "Tauri"
-  color: "24C8FF"
-  description: "Pull requests that update Tauri code"
-  from_name: "tauri"
-- name: "license-review-required"
-  color: "EDEDED"
-  description: "This PR requires a license review"

.github/scripts/check_language_json.py

@@ -1,6 +1,6 @@
 """
 Author: Ludy87
-Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
+Description: This script processes JSON translation files for localization checks. It compares translation files in a branch with
 a reference file to ensure consistency. The script performs two main checks:
 1. Verifies that the number of translation keys in the translation files matches the reference file.
 2. Ensures that all keys in the translation files are present in the reference file and vice versa.
@@ -9,23 +9,23 @@ The script also provides functionality to update the translation files to match
 adjusting the format.
 
 Usage:
-    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+    python check_language_json.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_json.py --reference-file frontend/public/locales/en-GB/translation.json --branch "" --files frontend/public/locales/de-DE/translation.json frontend/public/locales/fr-FR/translation.json
 
+import copy
 import glob
 import os
 import argparse
 import re
-import tomllib  # Python 3.11+ (stdlib)
-import tomli_w  # For writing TOML files
+import json
 
 
 def find_duplicate_keys(file_path, keys=None, prefix=""):
     """
-    Identifies duplicate keys in a TOML file (including nested keys).
-    :param file_path: Path to the TOML file.
+    Identifies duplicate keys in a JSON file (including nested keys).
+    :param file_path: Path to the JSON file.
     :param keys: Dictionary to track keys (used for recursion).
     :param prefix: Prefix for nested keys.
     :return: List of tuples (key, first_occurrence_path, duplicate_path).
@@ -35,9 +35,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
 
     duplicates = []
 
-    # Load TOML file
-    with open(file_path, "rb") as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def process_dict(obj, current_prefix=""):
         for key, value in obj.items():
@@ -55,18 +54,18 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for TOML files (e.g., 500 KB)
+# Maximum size for JSON files (e.g., 500 KB)
 MAX_FILE_SIZE = 500 * 1024
 
 
-def parse_toml_file(file_path):
+def parse_json_file(file_path):
     """
-    Parses a TOML translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the TOML file.
+    Parses a JSON translation file and returns a flat dictionary of all keys.
+    :param file_path: Path to the JSON file.
     :return: Dictionary with flattened keys.
     """
-    with open(file_path, "rb") as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
         items = {}
@@ -100,37 +99,38 @@ def unflatten_dict(d, sep="."):
     return result
 
 
-def write_toml_file(file_path, updated_properties):
+def write_json_file(file_path, updated_properties):
     """
-    Writes updated properties back to the TOML file.
-    :param file_path: Path to the TOML file.
+    Writes updated properties back to the JSON file.
+    :param file_path: Path to the JSON file.
     :param updated_properties: Dictionary of updated properties to write.
     """
     nested_data = unflatten_dict(updated_properties)
 
-    with open(file_path, "wb") as file:
-        tomli_w.dump(nested_data, file)
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        json.dump(nested_data, file, ensure_ascii=False, indent=2)
+        file.write("\n")  # Add trailing newline
 
 
 def update_missing_keys(reference_file, file_list, branch=""):
     """
     Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference TOML file.
+    :param reference_file: Path to the reference JSON file.
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_properties = parse_toml_file(reference_file)
+    reference_properties = parse_json_file(reference_file)
 
     for file_path in file_list:
         basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
             basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".toml")
+            or not file_path.endswith(".json")
             or not os.path.dirname(file_path).endswith("locales")
         ):
             continue
 
-        current_properties = parse_toml_file(os.path.join(branch, file_path))
+        current_properties = parse_json_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -141,16 +141,16 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_toml_file(os.path.join(branch, file_path), updated_properties)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
     update_missing_keys(reference_file, file_list, branch)
 
 
-def read_toml_keys(file_path):
+def read_json_keys(file_path):
     if os.path.isfile(file_path) and os.path.exists(file_path):
-        return parse_toml_file(file_path)
+        return parse_json_file(file_path)
     return {}
 
 
@@ -160,7 +160,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_toml_keys(reference_file)
+    reference_keys = read_json_keys(reference_file)
     has_differences = False
 
     only_reference_file = True
@@ -191,18 +191,18 @@ def check_for_differences(reference_file, file_list, branch, actor):
         basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
         locale_dir = os.path.basename(os.path.dirname(file_normpath))
 
-        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
+        if (
+            basename_current_file == basename_reference_file
+            and locale_dir == "en-GB"
+        ):
             continue
 
-        if (
-            not file_normpath.endswith(".toml")
-            or basename_current_file != "translation.toml"
-        ):
+        if not file_normpath.endswith(".json") or basename_current_file != "translation.json":
             continue
 
         only_reference_file = False
         report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_toml_keys(os.path.join(branch, file_path))
+        current_keys = read_json_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -272,7 +272,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.json](https://github.com/Stirling-Tools/Stirling-PDF/blob/V2/frontend/public/locales/en-GB/translation.json)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -286,9 +286,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(
-        description="Find missing keys in TOML translation files"
-    )
+    parser = argparse.ArgumentParser(description="Find missing keys")
     parser.add_argument(
         "--actor",
         required=False,
@@ -339,9 +337,9 @@ if __name__ == "__main__":
                     "public",
                     "locales",
                     "*",
-                    "translation.toml",
+                    "translation.json",
                 )
             )
         update_missing_keys(args.reference_file, file_list)
     else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_properties.py

@@ -0,0 +1,403 @@
+"""
+Author: Ludy87
+Description: This script processes .properties files for localization checks. It compares translation files in a branch with
+a reference file to ensure consistency. The script performs two main checks:
+1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
+2. Ensures that all keys in the translation files are present in the reference file and vice versa.
+
+The script also provides functionality to update the translation files to match the reference file by adding missing keys and
+adjusting the format.
+
+Usage:
+    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+"""
+# Sample for Windows:
+# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
+
+import copy
+import glob
+import os
+import argparse
+import re
+
+
+def find_duplicate_keys(file_path):
+    """
+    Identifies duplicate keys in a .properties file.
+    :param file_path: Path to the .properties file.
+    :return: List of tuples (key, first_occurrence_line, duplicate_line).
+    """
+    keys = {}
+    duplicates = []
+
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Skip empty lines and comments
+            if not stripped_line or stripped_line.startswith("#"):
+                continue
+
+            # Split the line into key and value
+            if "=" in stripped_line:
+                key, _ = stripped_line.split("=", 1)
+                key = key.strip()
+
+                # Check if the key already exists
+                if key in keys:
+                    duplicates.append((key, keys[key], line_number))
+                else:
+                    keys[key] = line_number
+
+    return duplicates
+
+
+# Maximum size for properties files (e.g., 200 KB)
+MAX_FILE_SIZE = 200 * 1024
+
+
+def parse_properties_file(file_path):
+    """
+    Parses a .properties file and returns a structured list of its contents.
+    :param file_path: Path to the .properties file.
+    :return: List of dictionaries representing each line in the file.
+    """
+    properties_list = []
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Handle empty lines
+            if not stripped_line:
+                properties_list.append(
+                    {"line_number": line_number, "type": "empty", "content": ""}
+                )
+                continue
+
+            # Handle comments
+            if stripped_line.startswith("#"):
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "comment",
+                        "content": stripped_line,
+                    }
+                )
+                continue
+
+            # Handle key-value pairs
+            match = re.match(r"^([^=]+)=(.*)$", line)
+            if match:
+                key, value = match.groups()
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "entry",
+                        "key": key.strip(),
+                        "value": value.strip(),
+                    }
+                )
+
+    return properties_list
+
+
+def write_json_file(file_path, updated_properties):
+    """
+    Writes updated properties back to the file in their original format.
+    :param file_path: Path to the .properties file.
+    :param updated_properties: List of updated properties to write.
+    """
+    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
+
+    # Sort lines by their numbers and retain comments and empty lines
+    all_lines = sorted(set(updated_lines.keys()))
+
+    original_format = []
+    for line in all_lines:
+        if line in updated_lines:
+            entry = updated_lines[line]
+        else:
+            entry = None
+        ref_entry = updated_lines[line]
+        if ref_entry["type"] in ["comment", "empty"]:
+            original_format.append(ref_entry)
+        elif entry is None:
+            # Add missing entries from the reference file
+            original_format.append(ref_entry)
+        elif entry["type"] == "entry":
+            # Replace entries with those from the current JSON
+            original_format.append(entry)
+
+    # Write the updated content back to the file
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        for entry in original_format:
+            if entry["type"] == "comment":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "empty":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "entry":
+                file.write(f"{entry['key']}={entry['value']}\n")
+
+
+def update_missing_keys(reference_file, file_list, branch=""):
+    """
+    Updates missing keys in the translation files based on the reference file.
+    :param reference_file: Path to the reference .properties file.
+    :param file_list: List of translation files to update.
+    :param branch: Branch where the files are located.
+    """
+    reference_properties = parse_properties_file(reference_file)
+    for file_path in file_list:
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
+        if (
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+
+        current_properties = parse_properties_file(os.path.join(branch, file_path))
+        updated_properties = []
+        for ref_entry in reference_properties:
+            ref_entry_copy = copy.deepcopy(ref_entry)
+            for current_entry in current_properties:
+                if current_entry["type"] == "entry":
+                    if ref_entry_copy["type"] != "entry":
+                        continue
+                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
+                        ref_entry_copy["value"] = current_entry["value"]
+            updated_properties.append(ref_entry_copy)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
+
+
+def check_for_missing_keys(reference_file, file_list, branch):
+    update_missing_keys(reference_file, file_list, branch)
+
+
+def read_properties(file_path):
+    if os.path.isfile(file_path) and os.path.exists(file_path):
+        with open(file_path, "r", encoding="utf-8") as file:
+            return file.read().splitlines()
+    return [""]
+
+
+def check_for_differences(reference_file, file_list, branch, actor):
+    reference_branch = reference_file.split("/")[0]
+    basename_reference_file = os.path.basename(reference_file)
+
+    report = []
+    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
+    reference_lines = read_properties(reference_file)
+    has_differences = False
+
+    only_reference_file = True
+
+    file_arr = file_list
+
+    if len(file_list) == 1:
+        file_arr = file_list[0].split()
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "app", "core", "src", "main", "resources")
+    )
+
+    for file_path in file_arr:
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)
+        # Verify that file is within the expected directory
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")
+        # Verify file size before processing
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
+            )
+
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        if (
+            basename_current_file == basename_reference_file
+            or (
+                # only local windows command
+                not file_normpath.startswith(
+                    os.path.join(
+                        "", "app", "core", "src", "main", "resources", "messages_"
+                    )
+                )
+                and not file_normpath.startswith(
+                    os.path.join(
+                        os.getcwd(),
+                        "app",
+                        "core",
+                        "src",
+                        "main",
+                        "resources",
+                        "messages_",
+                    )
+                )
+            )
+            or not file_normpath.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+        only_reference_file = False
+        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
+        current_lines = read_properties(os.path.join(branch, file_path))
+        reference_line_count = len(reference_lines)
+        current_line_count = len(current_lines)
+
+        if reference_line_count != current_line_count:
+            report.append("")
+            report.append("1. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            has_differences = True
+            if reference_line_count > current_line_count:
+                report.append(
+                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
+                )
+            elif reference_line_count < current_line_count:
+                report.append(
+                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
+                )
+        else:
+            report.append("1. **Test Status:** ✅ **_Passed_**")
+
+        # Check for missing or extra keys
+        current_keys = []
+        reference_keys = []
+        for line in current_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                current_keys.append(key)
+        for line in reference_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                reference_keys.append(key)
+
+        current_keys_set = set(current_keys)
+        reference_keys_set = set(reference_keys)
+        missing_keys = current_keys_set.difference(reference_keys_set)
+        extra_keys = reference_keys_set.difference(current_keys_set)
+        missing_keys_list = list(missing_keys)
+        extra_keys_list = list(extra_keys)
+
+        if missing_keys_list or extra_keys_list:
+            has_differences = True
+            missing_keys_str = "`, `".join(missing_keys_list)
+            extra_keys_str = "`, `".join(extra_keys_list)
+            report.append("2. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            if missing_keys_list:
+                spaces_keys_list = []
+                for key in missing_keys_list:
+                    if " " in key:
+                        spaces_keys_list.append(key)
+                if spaces_keys_list:
+                    spaces_keys_str = "`, `".join(spaces_keys_list)
+                    report.append(
+                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
+                    )
+                report.append(
+                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
+                )
+            if extra_keys_list:
+                report.append(
+                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
+                )
+        else:
+            report.append("2. **Test Status:** ✅ **_Passed_**")
+
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
+            has_differences = True
+            output = "\n".join(
+                [
+                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
+                    for key, first, duplicate in find_duplicate_keys(
+                        os.path.join(branch, file_normpath)
+                    )
+                ]
+            )
+            report.append("3. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            report.append("    - duplicate entries were found:")
+            report.append(output)
+        else:
+            report.append("3. **Test Status:** ✅ **_Passed_**")
+
+        report.append("")
+        report.append("---")
+        report.append("")
+    if has_differences:
+        report.append("## ❌ Overall Check Status: **_Failed_**")
+        report.append("")
+        report.append(
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/resources/messages_en_GB.properties)"
+        )
+    else:
+        report.append("## ✅ Overall Check Status: **_Success_**")
+        report.append("")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )
+
+    if not only_reference_file:
+        print("\n".join(report))
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser.add_argument(
+        "--actor",
+        required=False,
+        help="Actor from PR.",
+    )
+    parser.add_argument(
+        "--reference-file",
+        required=True,
+        help="Path to the reference file.",
+    )
+    parser.add_argument(
+        "--branch",
+        type=str,
+        required=True,
+        help="Branch name.",
+    )
+    parser.add_argument(
+        "--check-file",
+        type=str,
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    parser.add_argument(
+        "--files",
+        nargs="+",
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    args = parser.parse_args()
+
+    # Sanitize --actor input to avoid injection attacks
+    if args.actor:
+        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
+
+    # Sanitize --branch input to avoid injection attacks
+    if args.branch:
+        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
+
+    file_list = args.files
+    if file_list is None:
+        if args.check_file:
+            file_list = [args.check_file]
+        else:
+            file_list = glob.glob(
+                os.path.join(
+                    os.getcwd(),
+                    "app",
+                    "core",
+                    "src",
+                    "main",
+                    "resources",
+                    "messages_*.properties",
+                )
+            )
+        update_missing_keys(args.reference_file, file_list)
+    else:
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/requirements_pre_commit.txt

@@ -4,9 +4,9 @@
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
 #
-cfgv==3.5.0 \
-    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
-    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+cfgv==3.4.0 \
+    --hash=sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9 \
+    --hash=sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560
     # via pre-commit
 distlib==0.4.0 \
     --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
@@ -28,9 +28,9 @@ platformdirs==4.5.0 \
     --hash=sha256:70ddccdd7c99fc5942e9fc25636a8b34d04c24b335100223152c2803e4063312 \
     --hash=sha256:e578a81bb873cbb89a41fcc904c7ef523cc18284b7e3b3ccf06aca1403b7ebd3
     # via virtualenv
-pre-commit==4.5.0 \
-    --hash=sha256:25e2ce09595174d9c97860a95609f9f852c0614ba602de3561e267547f2335e1 \
-    --hash=sha256:dc5a065e932b19fc1d4c653c6939068fe54325af8e741e74e88db4d28a4dd66b
+pre-commit==4.3.0 \
+    --hash=sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8 \
+    --hash=sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16
     # via -r .github/scripts/requirements_pre_commit.in
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \

.github/scripts/requirements_sync_readme.in

@@ -1,2 +1 @@
 tomlkit
-tomli-w

.github/scripts/requirements_sync_readme.txt

@@ -4,10 +4,6 @@
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
 #
-tomli-w==1.2.0 \
-    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
-    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
-    # via -r .github/scripts/requirements_sync_readme.in
 tomlkit==0.13.3 \
     --hash=sha256:430cf247ee57df2b94ee3fbe588e71d362a941ebb545dec29b53961d61add2a1 \
     --hash=sha256:c89c649d79ee40629a9fda55f8ace8c6a1b42deb912b2a8fd8d942ddadb606b0

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Resolve PR info
         id: resolve
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { owner, repo } = context.repo;
@@ -52,6 +52,7 @@ jobs:
             core.setOutput('repository', pr.head.repo.full_name);
             core.setOutput('ref', pr.head.ref);
             core.setOutput('is_fork', String(pr.head.repo.fork));
+            core.setOutput('base_ref', pr.base.ref);
             core.setOutput('author', pr.user.login);
             core.setOutput('state', pr.state);
 
@@ -64,6 +65,10 @@ jobs:
           IS_FORK: ${{ steps.resolve.outputs.is_fork }}
           # nur bei workflow_dispatch gesetzt:
           ALLOW_FORK_INPUT: ${{ inputs.allow_fork }}
+          # für Auto-PR-Logik:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_BASE: ${{ steps.resolve.outputs.base_ref }}
           PR_AUTHOR: ${{ steps.resolve.outputs.author }}
         run: |
           set -e
@@ -82,10 +87,16 @@ jobs:
               fi
             fi
           else
-            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96" "balazs-szucs")
+            auth_users=("Frooodle" "sf298" "Ludy87" "LaserKaspar" "sbplat" "reecebrowne" "DarioGii" "ConnorYoh" "EthanHealy01" "jbrunton96")
             is_auth=false; for u in "${auth_users[@]}"; do [ "$u" = "$PR_AUTHOR" ] && is_auth=true && break; done
-            if [ "$is_auth" = true ]; then
+            if [ "$PR_BASE" = "V2" ] && [ "$is_auth" = true ]; then
               should=true
+            else
+              title_has_v2=false; echo "$PR_TITLE" | grep -qiE 'v2|version.?2|version.?two' && title_has_v2=true
+              branch_has_kw=false; echo "$PR_BRANCH" | grep -qiE 'v2|react' && branch_has_kw=true
+              if [ "$is_auth" = true ] && { [ "$title_has_v2" = true ] || [ "$branch_has_kw" = true ]; }; then
+                should=true
+              fi
             fi
           fi
 
@@ -128,13 +139,13 @@ jobs:
 
       - name: Add deployment started comment
         id: deployment-started
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
-
+            
             // Delete previous V2 deployment comments to avoid clutter
             const { data: comments } = await github.rest.issues.listComments({
               owner,
@@ -157,13 +168,13 @@ jobs:
                 comment_id: comment.id
               });
             }
-
+            
             // Create new deployment started comment
             const { data: newComment } = await github.rest.issues.createComment({
               owner,
               repo,
               issue_number: prNumber,
-              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment for approved V2 contributors._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
+              body: `🚀 **Auto-deploying V2 version** for PR #${prNumber}...\n\n_This is an automated deployment triggered by V2/version2 keywords in the PR title or V2/React keywords in the branch name._\n\n⚠️ **Note:** If new commits are pushed during deployment, this build will be cancelled and replaced with the latest version.`
             });
             return newComment.id;
 
@@ -173,7 +184,7 @@ jobs:
           repository: ${{ needs.check-pr.outputs.pr_repository }}
           ref: ${{ needs.check-pr.outputs.pr_ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0 # Fetch full history for commit hash detection
+          fetch-depth: 0  # Fetch full history for commit hash detection
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
@@ -204,20 +215,20 @@ jobs:
           if [ -z "$BACKEND_HASH" ]; then
             BACKEND_HASH="no-backend-changes"
           fi
-
+          
           echo "Frontend hash: $FRONTEND_HASH"
           echo "Backend hash: $BACKEND_HASH"
-
+          
           echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
           echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-
+          
           # Short hashes for tags
           if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
             echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
           else
             echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
           fi
-
+          
           if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
             echo "backend_short=no-backend" >> $GITHUB_OUTPUT
           else
@@ -280,7 +291,7 @@ jobs:
           # Use same port strategy as regular PRs - just the PR number
           V2_PORT=${{ needs.check-pr.outputs.pr_number }}
           BACKEND_PORT=$((V2_PORT + 10000))  # Backend on higher port to avoid conflicts
-
+          
           # Create docker-compose for V2 with separate frontend and backend
           cat > docker-compose.yml << EOF
           version: '3.3'
@@ -295,10 +306,8 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
               environment:
-                DISABLE_ADDITIONAL_FEATURES: "false"
-                SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
                 SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"
@@ -352,14 +361,14 @@ jobs:
 
       - name: Post V2 deployment URL to PR
         if: success()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
             const v2Port = ${{ steps.deploy.outputs.v2_port }};
-
+            
             // Delete the "deploying..." comment since we're posting the final result
             const deploymentStartedId = ${{ steps.deployment-started.outputs.result }};
             if (deploymentStartedId) {
@@ -374,7 +383,7 @@ jobs:
                 console.log(`Could not delete deployment started comment: ${error.message}`);
               }
             }
-
+            
             const deploymentUrl = `http://${{ secrets.VPS_HOST }}:${v2Port}`;
             const httpsUrl = `https://${v2Port}.ssl.stirlingpdf.cloud`;
 
@@ -383,7 +392,7 @@ jobs:
                               `🔗 **Direct Test URL (non-SSL)** [${deploymentUrl}](${deploymentUrl})\n\n` +
                               `🔐 **Secure HTTPS URL**: [${httpsUrl}](${httpsUrl})\n\n` +
                               `_This deployment will be automatically cleaned up when the PR is closed._\n\n` +
-                              `🔄 **Auto-deployed** for approved V2 contributors.`;
+                              `🔄 **Auto-deployed** because PR title or branch name contains V2/version2/React keywords.`;
 
             await github.rest.issues.createComment({
               owner,
@@ -419,25 +428,25 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Clean up V2 deployment comments
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ github.event.pull_request.number }};
-
+            
             // Find and delete V2 deployment comments
             const { data: comments } = await github.rest.issues.listComments({
               owner,
               repo,
               issue_number: prNumber
             });
-
+            
             const v2Comments = comments.filter(c =>
               c.body?.includes("## 🚀 V2 Auto-Deployment Complete!") &&
               c.user?.type === "Bot"
             );
-
+            
             for (const comment of v2Comments) {
               await github.rest.issues.deleteComment({
                 owner,
@@ -489,4 +498,4 @@ jobs:
         if: always()
         run: |
           rm -f ../private.key
-        continue-on-error: true
+        continue-on-error: true

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -14,7 +14,6 @@ jobs:
     permissions:
       issues: write
     if: |
-      vars.CI_PROFILE != 'lite' &&
       github.event.issue.pull_request &&
       (
         contains(github.event.comment.body, 'prdeploy') ||
@@ -35,18 +34,20 @@ jobs:
       )
     outputs:
       pr_number: ${{ steps.get-pr.outputs.pr_number }}
+      pr_repository: ${{ steps.get-pr-info.outputs.repository }}
+      pr_ref: ${{ steps.get-pr-info.outputs.ref }}
       comment_id: ${{ github.event.comment.id }}
       disable_security: ${{ steps.check-security-flag.outputs.disable_security }}
       enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }}
       enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -59,13 +60,36 @@ jobs:
 
       - name: Get PR data
         id: get-pr
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const prNumber = context.payload.issue.number;
             console.log(`PR Number: ${prNumber}`);
             core.setOutput('pr_number', prNumber);
 
+      - name: Get PR repository and ref
+        id: get-pr-info
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.issue.number;
+
+            const { data: pr } = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: prNumber,
+            });
+
+            // For forks, use the full repository name, for internal PRs use the current repo
+            const repository = pr.head.repo.fork ? pr.head.repo.full_name : `${owner}/${repo}`;
+
+            console.log(`PR Repository: ${repository}`);
+            console.log(`PR Branch: ${pr.head.ref}`);
+
+            core.setOutput('repository', repository);
+            core.setOutput('ref', pr.head.ref);
+
       - name: Check for security/login flag
         id: check-security-flag
         env:
@@ -100,7 +124,7 @@ jobs:
 
       - name: Add 'in_progress' reaction to comment
         id: add-eyes-reaction
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -129,12 +153,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -146,13 +170,14 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
+          repository: ${{ needs.check-comment.outputs.pr_repository }}
+          ref: ${{ needs.check-comment.outputs.pr_ref }}
           token: ${{ steps.setup-bot.outputs.token }}
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: "17"
           distribution: "temurin"
@@ -172,7 +197,7 @@ jobs:
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
@@ -181,7 +206,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha
@@ -272,7 +297,7 @@ jobs:
 
       - name: Add success reaction to comment
         if: success()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -307,7 +332,7 @@ jobs:
 
       - name: Add failure reaction to comment
         if: failure()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -327,7 +352,7 @@ jobs:
 
       - name: Post deployment URL to PR
         if: success()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -357,149 +382,3 @@ jobs:
           rm -f ../private.key docker-compose.yml
           echo "Cleanup complete."
         continue-on-error: true
-
-  handle-label-commands:
-    if: ${{ github.event.issue.pull_request != null }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Apply label commands
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-
-            const { comment, issue } = context.payload;
-            const commentBody = comment?.body ?? '';
-            if (!commentBody.includes('::label::')) {
-              core.info('No label commands detected in comment.');
-              return;
-            }
-
-            const configPath = path.join(process.env.GITHUB_WORKSPACE, '.github', 'config', 'repo_devs.json');
-            const repoDevsConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-            const label_changer = (repoDevsConfig.label_changer || []).map((login) => login.toLowerCase());
-
-            const commenter = (comment?.user?.login || '').toLowerCase();
-            if (!label_changer.includes(commenter)) {
-              core.info(`User ${commenter} is not authorized to manage labels.`);
-              return;
-            }
-
-            const labelsConfigPath = path.join(process.env.GITHUB_WORKSPACE, '.github', 'labels.yml');
-            const labelsFile = fs.readFileSync(labelsConfigPath, 'utf8');
-
-            const labelNameMap = new Map();
-            for (const match of labelsFile.matchAll(/-\s+name:\s*(?:"([^"]+)"|'([^']+)'|([^\n]+))/g)) {
-              const labelName = (match[1] ?? match[2] ?? match[3] ?? '').trim();
-
-              if (!labelName) {
-                continue;
-              }
-              const normalized = labelName.toLowerCase();
-              if (!labelNameMap.has(normalized)) {
-                labelNameMap.set(normalized, labelName);
-              }
-            }
-
-            if (!labelNameMap.size) {
-              core.warning('No labels could be read from .github/labels.yml; aborting label commands.');
-              return;
-            }
-
-            let allowedLabelNames = new Set(labelNameMap.values());
-
-            const labelsToAdd = new Set();
-            const labelsToRemove = new Set();
-            const commandRegex = /^(\w+)::(label)::"([^"]+)"/gim;
-            let match;
-            while ((match = commandRegex.exec(commentBody)) !== null) {
-              core.info(`Found label command: ${match[0]} (action: ${match[1]}, label: ${match[2]}, labelName: ${match[3]})`);
-              const action = match[1].toLowerCase();
-              const labelName = match[3].trim();
-
-              if (!labelName) {
-                continue;
-              }
-
-              const normalized = labelName.toLowerCase();
-              const resolvedLabelName = labelNameMap.get(normalized);
-              if (action === 'add') {
-                if (!resolvedLabelName) {
-                  core.warning(`Label "${labelName}" is not defined in .github/labels.yml and cannot be added.`);
-                  continue;
-                }
-                if (!allowedLabelNames.has(resolvedLabelName)) {
-                  core.warning(`Label "${resolvedLabelName}" is not allowed for add commands and will be skipped.`);
-                  continue;
-                }
-                labelsToAdd.add(resolvedLabelName);
-              } else if (action === 'rm') {
-                const labelToRemove = resolvedLabelName ?? labelName;
-                if (!resolvedLabelName) {
-                  core.warning(`Label "${labelName}" is not defined in .github/labels.yml; attempting to remove as provided.`);
-                }
-                labelsToRemove.add(labelToRemove);
-              }
-            }
-
-            const addLabels = Array.from(labelsToAdd);
-            const removeLabels = Array.from(labelsToRemove);
-
-            if (!addLabels.length && !removeLabels.length) {
-              core.info('No valid label commands found after parsing.');
-              return;
-            }
-
-            const issueParams = {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issue.number,
-            };
-
-            if (addLabels.length) {
-              core.info(`Adding labels: ${addLabels.join(', ')}`);
-              await github.rest.issues.addLabels({
-                ...issueParams,
-                labels: addLabels,
-              });
-            }
-
-            for (const labelName of removeLabels) {
-              core.info(`Removing label: ${labelName}`);
-              try {
-                await github.rest.issues.removeLabel({
-                  ...issueParams,
-                  name: labelName,
-                });
-              } catch (error) {
-                if (error.status === 404) {
-                  core.warning(`Label "${labelName}" was not present on the pull request.`);
-                } else {
-                  throw error;
-                }
-              }
-            }
-
-            await github.rest.issues.deleteComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: comment.id,
-            });
-            core.info('Processed label commands and deleted the comment.');

.github/workflows/PR-Demo-cleanup.yml

@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout PR
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup GitHub App Bot
         if: github.actor != 'dependabot[bot]'
@@ -39,7 +39,7 @@ jobs:
 
       - name: Remove 'pr-deployed' label if present
         id: remove-label-comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -96,6 +96,7 @@ jobs:
             const hasDeploymentComment = deploymentComments.length > 0;
             core.setOutput('present', (hasLabel || hasDeploymentComment) ? 'true' : 'false');
 
+
       - name: Set up SSH
         if: steps.remove-label-comment.outputs.present == 'true'
         run: |

.github/workflows/ai_pr_title_review.yml

@@ -5,7 +5,7 @@ on:
     types: [opened, edited]
     branches: [main]
 
-permissions: # required for secure-repo hardening
+permissions:  # required for secure-repo hardening
   contents: read
 
 jobs:
@@ -19,11 +19,11 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
@@ -87,7 +87,7 @@ jobs:
       - name: AI PR Title Analysis
         if: steps.actor.outputs.is_repo_dev == 'true'
         id: ai-title-analysis
-        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
+        uses: actions/ai-inference@b81b2afb8390ee6839b494a404766bef6493c7d9 # v1.2.8
         with:
           model: openai/gpt-4o
           system-prompt-file: ".github/config/system-prompt.txt"
@@ -158,7 +158,7 @@ jobs:
 
       - name: Post comment on PR if needed
         if: steps.actor.outputs.is_repo_dev == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         continue-on-error: true
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}

.github/workflows/auto-labelerV2.yml

@@ -2,9 +2,6 @@ name: "Auto Pull Request Labeler V2"
 on:
   pull_request_target:
     types: [opened, synchronize]
-    branches:
-      - main
-      - V3
 
 permissions:
   contents: read
@@ -16,11 +13,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup GitHub App Bot
         id: setup-bot

.github/workflows/build.yml

@@ -2,7 +2,7 @@ name: Build and Test Workflow
 
 on:
   pull_request:
-    branches: ["main"]
+    branches: ["main", "V2", "V2-gha"]
   workflow_dispatch:
 
 # cancel in-progress jobs if a new job is triggered
@@ -27,19 +27,14 @@ jobs:
     timeout-minutes: 3
     outputs:
       build: ${{ steps.changes.outputs.build }}
+      app: ${{ steps.changes.outputs.app }}
       project: ${{ steps.changes.outputs.project }}
       openapi: ${{ steps.changes.outputs.openapi }}
-      frontend: ${{ steps.changes.outputs.frontend }}
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@v4.3.0
 
       - name: Check for file changes
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@v3.0.2
         id: changes
         with:
           filters: .github/config/.files.yaml
@@ -56,23 +51,25 @@ jobs:
         spring-security: [true, false]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@v4.3.0
 
       - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@v4.7.1
         with:
           java-version: ${{ matrix.jdk-version }}
           distribution: "temurin"
-
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4.4.2
+        with:
+          gradle-version: 8.14
       - name: Build with Gradle and spring security ${{ matrix.spring-security }}
         run: ./gradlew clean build -PnoSpotless
         env:
           DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
-
       - name: Check Test Reports Exist
         if: always()
         run: |
@@ -90,10 +87,9 @@ jobs:
               exit 1
             fi
           done
-
       - name: Upload Test Reports
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
           path: |
@@ -110,51 +106,47 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@v4.3.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4.7.1
         with:
-          java-version: "21"
+          java-version: "17"
           distribution: "temurin"
-
+      - uses: gradle/actions/setup-gradle@v4.4.2
       - name: Generate OpenAPI documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
         env:
           DISABLE_ADDITIONAL_FEATURES: true
-
+      
       - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: openapi-docs
           path: ./SwaggerDoc.json
 
   frontend-validation:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: files-changed
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@v2.12.2
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@v4.2.2
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@v4.1.0
         with:
-          node-version: "22"
-          cache: "npm"
+          node-version: '20'
+          cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
       - name: Install frontend dependencies
         run: cd frontend && npm ci
-      - name: Type-check frontend
-        run: cd frontend && npm run prebuild && npm run typecheck:all
       - name: Lint frontend
         run: cd frontend && npm run lint
       - name: Build frontend
@@ -162,7 +154,7 @@ jobs:
       - name: Run frontend tests
         run: cd frontend && npm run test -- --run
       - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: frontend-build
           path: frontend/dist/
@@ -174,25 +166,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
-
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/checkout@v4.3.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4.7.1
         with:
-          java-version: "21"
+          java-version: "17"
           distribution: "temurin"
-
       - name: check the licenses for compatibility
         run: ./gradlew clean checkLicense
-
       - name: FAILED - check the licenses for compatibility
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: dependencies-without-allowed-license.json
           path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -219,17 +207,17 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up Java 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "21"
+          java-version: "17"
           distribution: "temurin"
 
       - name: Set up Docker Buildx
@@ -237,14 +225,14 @@ jobs:
 
       - name: Install Docker Compose
         run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.37.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
           sudo chmod +x /usr/local/bin/docker-compose
 
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
-          cache: "pip" # caching pip dependencies
+          cache: 'pip' # caching pip dependencies
           cache-dependency-path: ./testing/cucumber/requirements.txt
 
       - name: Pip requirements
@@ -265,35 +253,27 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
+        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "21"
+          java-version: "17"
           distribution: "temurin"
 
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        with:
+          gradle-version: 8.14
+
       - name: Build application
         run: ./gradlew clean build
         env:
@@ -312,7 +292,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./${{ matrix.docker-rev }}
+          file: ./docker/backend/${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -324,7 +304,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
+          name: reports-docker-${{ matrix.docker-rev }}
           path: |
             build/reports/tests/
             build/test-results/

.github/workflows/check_properties.yml

@@ -1,14 +1,19 @@
-name: Check TOML Translation Files on PR
-
-# This workflow validates TOML translation files
+name: Check Properties Files on PR
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
-      - "frontend/public/locales/*/translation.toml"
+      - "app/core/src/main/resources/messages_*.properties"
 
 # cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
   cancel-in-progress: true
@@ -25,12 +30,12 @@ jobs:
       pull-requests: write # Allow writing to pull requests
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout main branch first
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -41,7 +46,7 @@ jobs:
 
       - name: Get PR data
         id: get-pr-data
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -68,24 +73,24 @@ jobs:
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
-          # Check if PR number exists
-          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-            echo "Error: PR number is empty"
-            exit 1
-          fi
-          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
-          # Check if any files were found
-          if [ ! -s changed_files.txt ]; then
-            echo "No TOML translation files changed in this PR"
-            echo "Workflow will exit early as no relevant files to check"
-            exit 0
-          fi
-          echo "Found $(wc -l < changed_files.txt) matching TOML files"
+                   # Check if PR number exists
+            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+              echo "Error: PR number is empty"
+              exit 1
+            fi
+            # Get changed files and filter for properties files, handle case where no matches are found
+            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
+            # Check if any files were found
+            if [ ! -s changed_files.txt ]; then
+              echo "No properties files changed in this PR"
+              echo "Workflow will exit early as no relevant files to check"
+              exit 0
+            fi
+            echo "Found $(wc -l < changed_files.txt) matching properties files"
 
-      - name: Determine reference file
+      - name: Determine reference file test
         id: determine-file
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -120,11 +125,11 @@ jobs:
               pull_number: prNumber,
             });
 
-            // Filter for relevant TOML files based on the PR changes
+            // Filter for relevant files based on the PR changes
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^app\/core\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -164,16 +169,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
+            if (changedFiles.includes("app/core/src/main/resources/messages_en_GB.properties")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-GB.toml";
+              referenceFilePath = "pr-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -181,11 +186,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-GB.toml";
+              referenceFilePath = "main-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -193,19 +198,11 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
-      - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
-
       - name: Run Python script to check files
         id: run-check
         run: |
-          echo "Running Python script to check TOML files..."
-          python .github/scripts/check_language_toml.py \
+          echo "Running Python script to check files..."
+          python .github/scripts/check_language_properties.py \
             --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
@@ -216,7 +213,7 @@ jobs:
         id: capture-output
         run: |
           if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Capturing output..."
+            echo "Test, capturing output..."
             SCRIPT_OUTPUT=$(cat result.txt)
             echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
             echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
@@ -230,14 +227,14 @@ jobs:
               echo "FAIL_JOB=false" >> $GITHUB_ENV
             fi
           else
-            echo "No output found."
+            echo "No update found."
             echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
             echo "FAIL_JOB=false" >> $GITHUB_ENV
           fi
 
       - name: Post comment on PR
         if: env.SCRIPT_OUTPUT != ''
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -252,7 +249,7 @@ jobs:
               issue_number: issueNumber
             });
 
-            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
+            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
 
             // Only update or create comments by the action user
             const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
@@ -263,7 +260,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 comment_id: comment.id,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Updated existing comment.");
             } else if (!comment) {
@@ -272,7 +269,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 issue_number: issueNumber,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Created new comment.");
             } else {
@@ -290,6 +287,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
+          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/codeql.yml-disabled

@@ -0,0 +1,79 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+#disable for now
+#on:
+#  push:
+#    branches: ["main"]
+#  pull_request:
+    # The branches below must be a subset of the branches above
+#    branches: ["main"]
+#  schedule:
+#    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -17,13 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: "Checkout Repository"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
-        with:
-          config-file: "./.github/config/dependency-review-config.yml"
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

.github/workflows/deploy-on-v2-commit.yml

@@ -23,10 +23,10 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@v3
 
       - name: Get commit hashes for frontend and backend
         id: commit-hashes
@@ -36,26 +36,26 @@ jobs:
           if [ -z "$FRONTEND_HASH" ]; then
             FRONTEND_HASH="no-frontend-changes"
           fi
-
+          
           # Get last commit that touched backend code, docker/backend, or docker/compose
           BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
           if [ -z "$BACKEND_HASH" ]; then
             BACKEND_HASH="no-backend-changes"
           fi
-
+          
           echo "Frontend hash: $FRONTEND_HASH"
           echo "Backend hash: $BACKEND_HASH"
-
+          
           echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
           echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-
+          
           # Short hashes for tags
           if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
             echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
           else
             echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
           fi
-
+          
           if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
             echo "backend_short=no-backend" >> $GITHUB_OUTPUT
           else
@@ -84,15 +84,16 @@ jobs:
             echo "Backend image needs to be built"
           fi
 
+
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push frontend image
         if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/frontend/Dockerfile
@@ -102,10 +103,10 @@ jobs:
             ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64
-
+      
       - name: Build and push backend image
         if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/backend/Dockerfile
@@ -116,16 +117,18 @@ jobs:
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64
 
+
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
           echo "${{ secrets.VPS_SSH_KEY }}" > ../private.key
           chmod 600 ../private.key
 
+
       - name: Deploy to VPS on port 3000
         run: |
           export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
-
+      
           cat > $UNIQUE_NAME << EOF
           version: '3.3'
           services:
@@ -151,7 +154,7 @@ jobs:
                 SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
                 baseUrl: "https://demo.stirlingpdf.cloud"
               restart: on-failure:5
-
+      
             frontend:
               container_name: stirling-v2-frontend
               image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
@@ -163,10 +166,10 @@ jobs:
                 - backend
               restart: on-failure:5
           EOF
-
+      
           # Copy to remote with unique name
           scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }}:/tmp/$UNIQUE_NAME
-
+      
           # SSH and rename/move atomically to avoid interference
           ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << ENDSSH
             mkdir -p /stirling/V2/{data,config,logs}
@@ -183,3 +186,4 @@ jobs:
         if: always()
         run: |
           rm -f ../private.key
+

.github/workflows/frontend-backend-licenses-update.yml

@@ -1,510 +0,0 @@
-name: License Report Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  files-changed:
-    name: detect what files changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    outputs:
-      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
-      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
-        id: changes
-        with:
-          filters: .github/config/.files.yaml
-
-  generate-frontend-license-report:
-    if: needs.files-changed.outputs.licenses-frontend == 'true'
-    name: Generate Frontend License Report
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Checkout PR head (default)
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Checkout BASE branch (safe script)
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Install frontend dependencies
-        working-directory: frontend
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        run: npm ci --ignore-scripts --audit=false --fund=false
-
-      - name: Generate frontend license report (internal PR)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        working-directory: frontend
-        env:
-          PR_IS_FORK: "false"
-        run: npm run generate-licenses
-
-      - name: Generate frontend license report (fork PRs, pinned)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          NPM_CONFIG_IGNORE_SCRIPTS: "true"
-        working-directory: frontend
-        run: |
-          mkdir -p src/assets
-          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
-
-      - name: Postprocess with project script (BASE version)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        env:
-          PR_IS_FORK: "true"
-        run: |
-          node base/frontend/scripts/generate-licenses.js \
-            --input frontend/src/assets/3rdPartyLicenses.json
-
-      - name: Copy postprocessed artifacts back (fork PRs)
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
-        run: |
-          mkdir -p frontend/src/assets
-          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
-          fi
-          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
-            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
-          fi
-
-      - name: Check for license warnings
-        run: |
-          if [ -f "frontend/src/assets/license-warnings.json" ]; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-
-      # PR Event: Check licenses and comment on PR
-      - name: Delete previous license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            // Get all comments on the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            // Filter for license check comments
-            const licenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Frontend License Check Passed') ||
-              comment.body.includes('## ❌ Frontend License Check Failed')
-            );
-
-            // Delete old license check comments
-            for (const comment of licenseComments) {
-              console.log(`Deleting old license check comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Summarize results (fork PRs)
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) || github.actor == 'dependabot[bot]'
-        run: |
-          {
-            echo "## Frontend License Check"
-            echo ""
-            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
-              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/src/assets/license-warnings.json" ]; then
-                echo ""
-                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
-              fi
-            else
-              echo "✅ **Passed** – no license warnings detected."
-            fi
-            echo ""
-            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Comment on PR - License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-
-            let commentBody;
-
-            if (hasWarnings) {
-              // Read warnings file to get specific issues
-              const fs = require('fs');
-              let warningDetails = '';
-              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
-                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
-              } catch (e) {
-                warningDetails = 'Unable to read warning details';
-              }
-
-              commentBody = `## ❌ Frontend License Check Failed
-
-              The frontend license check has detected compatibility warnings that require review:
-
-              ${warningDetails}
-
-              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Frontend License Check Passed
-
-              All frontend licenses have been validated and no compatibility warnings were detected.
-
-              The frontend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ License warnings detected. Failing the workflow."
-          exit 1
-
-      # Push Event: Commit license files and create PR
-      - name: Commit changes (Push only)
-        if: github.event_name == 'push'
-        run: |
-          git add frontend/src/assets/3rdPartyLicenses.json
-          # Note: Do NOT commit license-warnings.json - it's only for PR review
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (Push only)
-        if: github.event_name == 'push'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the frontend license report based on changes to package.json dependencies."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          The following licenses may require review for corporate compatibility:
-
-          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
-
-          Please review these licenses to ensure they are acceptable for your use case."
-          fi
-
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (Push only)
-        id: cpr
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Frontend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-frontend-3rd-party-licenses
-          base: main
-          title: "Update Frontend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,frontend
-          draft: false
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (Push only)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-  generate-backend-license-report:
-    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: files-changed
-    name: Generate Backend License Report
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      repository-projects: write # Required for enabling automerge
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup GitHub App Bot
-        if: (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)) && github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Check licenses and generate report
-        id: license-check
-        run: |
-          ./gradlew clean checkLicense generateLicenseReport || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
-        env:
-          DISABLE_ADDITIONAL_FEATURES: false
-          STIRLING_PDF_DESKTOP_UI: true
-
-      - name: Check for license compatibility issues
-        run: |
-          if [ -f build/reports/dependency-license/dependencies-without-allowed-license.json ] && \
-             jq '.dependenciesWithoutAllowedLicenses | length > 0' build/reports/dependency-license/dependencies-without-allowed-license.json | grep -q true; then
-            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
-          else
-            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
-          fi
-        if: always()
-
-      - name: Upload artifact on license issues
-        if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: backend-dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-
-      - name: Move license file
-        if: env.LICENSE_CHECK_FAILED != 'true' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          mkdir -p app/core/src/main/resources/static
-          cp build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
-
-      - name: Delete previous backend license check comments
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.issue.number;
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner,
-              repo,
-              issue_number: prNumber,
-              per_page: 100
-            });
-
-            const backendLicenseComments = comments.filter(comment => 
-              comment.body.includes('## ✅ Backend License Check Passed') ||
-              comment.body.includes('## ❌ Backend License Check Failed')
-            );
-
-            for (const comment of backendLicenseComments) {
-              console.log(`Deleting old backend license comment: ${comment.id}`);
-              await github.rest.issues.deleteComment({
-                owner,
-                repo,
-                comment_id: comment.id
-              });
-            }
-
-      - name: Comment on PR - Backend License Check Results
-        if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
-            const fs = require('fs');
-            let warningDetails = '';
-
-            if (hasWarnings) {
-              try {
-                const warningsFile = 'build/reports/dependency-license/dependencies-without-allowed-license.json';
-                if (fs.existsSync(warningsFile)) {
-                  const data = JSON.parse(fs.readFileSync(warningsFile, 'utf8'));
-                  if (data.length > 0) {
-                    warningDetails = data.map(dep => `- **${dep.moduleName}@${dep.moduleVersion}** – ${dep.moduleLicenses.map(l => l.licenseName).join(', ')}`).join('\n');
-                  }
-                }
-              } catch (e) {
-                warningDetails = 'Unable to parse warning details.';
-              }
-            }
-
-            let commentBody;
-            if (hasWarnings) {
-              commentBody = `## ❌ Backend License Check Failed
-
-              The backend license check has detected dependencies with incompatible or unallowed licenses:
-
-              ${warningDetails || 'See uploaded artifact for details.'}
-
-              **Action Required:** Please review these licenses and resolve before merging.
-
-              _This check will fail the PR until license issues are resolved._`;
-            } else {
-              commentBody = `## ✅ Backend License Check Passed
-
-              All backend dependencies have valid and allowed licenses.
-
-              The backend license report has been updated successfully.`;
-            }
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: commentBody
-            });
-
-      - name: Fail workflow if license warnings exist (PR only)
-        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: |
-          echo "❌ Backend license warnings detected. Failing the workflow."
-          exit 1
-
-      - name: Commit changes (push only)
-        if: github.event_name == 'push' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: |
-          git config user.name "${{ steps.setup-bot.outputs.committer }}"
-          git config user.email "${{ steps.setup-bot.outputs.committer-email || 'bot@github.com' }}"
-          git add app/core/src/main/resources/static/3rdPartyLicenses.json
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Prepare PR body (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        run: |
-          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
-
-          This PR updates the backend license report based on dependency changes."
-
-          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
-            PR_BODY="$PR_BODY
-
-          ## ⚠️ License Compatibility Warnings
-
-          Incompatible licenses detected – manual review required before merge."
-          fi
-          echo "PR_BODY<<EOF" >> $GITHUB_ENV
-          echo "$PR_BODY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-
-      - name: Create Pull Request (push only)
-        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        id: cpr
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: "Update Backend 3rd Party Licenses"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: update-backend-3rd-party-licenses
-          base: main
-          title: "Update Backend 3rd Party Licenses"
-          body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,backend
-          delete-branch: true
-          sign-commits: true
-
-      - name: Enable Pull Request Automerge (push only, no warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
-        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
-
-      - name: Add review required label (push only, with warnings)
-        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
-        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
-        env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/frontend-licenses-update.yml

@@ -0,0 +1,282 @@
+name: Frontend License Report Workflow
+
+on:
+  push:
+    branches:
+      - V2
+    paths:
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/scripts/generate-licenses.js"
+  pull_request:
+    branches:
+      - V2
+    paths:
+      - ".github/workflows/frontend-licenses-update.yml"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/scripts/generate-licenses.js"
+
+permissions:
+  contents: read
+
+jobs:
+  generate-frontend-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout PR head (default)
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Checkout BASE branch (safe script)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: base
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        run: npm ci --ignore-scripts --audit=false --fund=false
+
+      - name: Generate frontend license report (internal PR)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        working-directory: frontend
+        env:
+          PR_IS_FORK: "false"
+        run: npm run generate-licenses
+
+      - name: Generate frontend license report (fork PRs, pinned)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        working-directory: frontend
+        run: |
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
+
+      - name: Postprocess with project script (BASE version)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        env:
+          PR_IS_FORK: "true"
+        run: |
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json
+
+      - name: Copy postprocessed artifacts back (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
+          fi
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
+          fi
+
+      - name: Check for license warnings
+        run: |
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
+            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
+          else
+            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
+          fi
+
+      # PR Event: Check licenses and comment on PR
+      - name: Delete previous license check comments
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            
+            // Get all comments on the PR
+            const { data: comments } = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber,
+              per_page: 100
+            });
+            
+            // Filter for license check comments
+            const licenseComments = comments.filter(comment => 
+              comment.body.includes('## ✅ Frontend License Check Passed') ||
+              comment.body.includes('## ❌ Frontend License Check Failed')
+            );
+            
+            // Delete old license check comments
+            for (const comment of licenseComments) {
+              console.log(`Deleting old license check comment: ${comment.id}`);
+              await github.rest.issues.deleteComment({
+                owner,
+                repo,
+                comment_id: comment.id
+              });
+            }
+
+      - name: Summarize results (fork PRs)
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
+        run: |
+          {
+            echo "## Frontend License Check"
+            echo ""
+            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
+              echo "❌ **Failed** – incompatible or unknown licenses found."
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
+                echo ""
+                echo "### Warnings"
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
+              fi
+            else
+              echo "✅ **Passed** – no license warnings detected."
+            fi
+            echo ""
+            echo "_Note: This is a fork PR. PR comments are disabled; use this summary._"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Comment on PR - License Check Results
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.issue.number;
+            const hasWarnings = process.env.LICENSE_WARNINGS_EXIST === 'true';
+            
+            let commentBody;
+            
+            if (hasWarnings) {
+              // Read warnings file to get specific issues
+              const fs = require('fs');
+              let warningDetails = '';
+              try {
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
+                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
+              } catch (e) {
+                warningDetails = 'Unable to read warning details';
+              }
+              
+              commentBody = `## ❌ Frontend License Check Failed
+              
+              The frontend license check has detected compatibility warnings that require review:
+
+              ${warningDetails}
+
+              **Action Required:** Please review these licenses to ensure they are acceptable for your use case before merging.
+
+              _This check will fail the PR until license issues are resolved._`;
+            } else {
+              commentBody = `## ✅ Frontend License Check Passed
+              
+              All frontend licenses have been validated and no compatibility warnings were detected.
+
+              The frontend license report has been updated successfully.`;
+            }
+            
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
+
+      - name: Fail workflow if license warnings exist (PR only)
+        if: github.event_name == 'pull_request' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: |
+          echo "❌ License warnings detected. Failing the workflow."
+          exit 1
+
+      # Push Event: Commit license files and create PR
+      - name: Commit changes (Push only)
+        if: github.event_name == 'push'
+        run: |
+          git add frontend/src/assets/3rdPartyLicenses.json
+          # Note: Do NOT commit license-warnings.json - it's only for PR review
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Prepare PR body (Push only)
+        if: github.event_name == 'push'
+        run: |
+          PR_BODY="Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+
+          This PR updates the frontend license report based on changes to package.json dependencies."
+          
+          if [ "${{ env.LICENSE_WARNINGS_EXIST }}" = "true" ]; then
+            PR_BODY="$PR_BODY
+
+          ## ⚠️ License Compatibility Warnings
+
+          The following licenses may require review for corporate compatibility:
+
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')
+
+          Please review these licenses to ensure they are acceptable for your use case."
+          fi
+          
+          echo "PR_BODY<<EOF" >> $GITHUB_ENV
+          echo "$PR_BODY" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+
+      - name: Create Pull Request (Push only)
+        id: cpr
+        if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update Frontend 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-frontend-3rd-party-licenses
+          base: V2
+          title: "Update Frontend 3rd Party Licenses"
+          body: ${{ env.PR_BODY }}
+          labels: Licenses,github-actions,frontend
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'false'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+
+      - name: Add review required label (Push only)
+        if: github.event_name == 'push' && steps.cpr.outputs.pull-request-operation == 'created' && env.LICENSE_WARNINGS_EXIST == 'true'
+        run: gh pr edit "${{ steps.cpr.outputs.pull-request-number }}" --add-label "license-review-required"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/licenses-update.yml

@@ -0,0 +1,102 @@
+name: License Report Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  generate-license-report:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write # Required for enabling automerge
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Check out code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+
+      - name: Check licenses for compatibility
+        run: ./gradlew clean checkLicense
+
+      - name: Upload artifact on failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
+
+      - name: Move and rename license file
+        run: |
+          mv build/reports/dependency-license/index.json app/core/src/main/resources/static/3rdPartyLicenses.json
+
+      - name: Commit changes
+        run: |
+          git add app/core/src/main/resources/static/3rdPartyLicenses.json
+          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        id: cpr
+        if: env.CHANGES_DETECTED == 'true'
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Update 3rd Party Licenses"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: update-3rd-party-licenses
+          title: "Update 3rd Party Licenses"
+          body: |
+            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot]
+          labels: Licenses,github-actions
+          draft: false
+          delete-branch: true
+          sign-commits: true
+
+      - name: Enable Pull Request Automerge
+        if: steps.cpr.outputs.pull-request-operation == 'created'
+        run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}

.github/workflows/manage-label.yml

@@ -15,12 +15,12 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Check out the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Run Labeler
         uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0

.github/workflows/multiOSReleases.yml

@@ -1,4 +1,4 @@
-name: Multi-OS Tauri Releases
+name: Test Installers Build
 
 on:
   workflow_dispatch:
@@ -6,23 +6,7 @@ on:
       test_mode:
         description: "Run in test mode (skip release step)"
         required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2-master]
+        default: "false"
   release:
     types: [created]
 
@@ -30,547 +14,305 @@ permissions:
   contents: read
 
 jobs:
-  determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
+  read_versions:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
+      versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
+          distribution: 'temurin'
+          java-version: '21'
 
+      # ✅ Get version from Gradle
       - name: Get version number
         id: versionNumber
         run: |
-          echo "Running gradlew printVersion..."
-          ./gradlew printVersion --quiet
           VERSION=$(./gradlew printVersion --quiet | tail -1)
-          echo "Extracted version: $VERSION"
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      # ✅ Get Mac-specific version from Gradle
+      - name: Get version number mac
+        id: versionNumberMac
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          VERSION_MAC=$(./gradlew printMacVersion --quiet | tail -1)
+          echo "versionNumberMac=$VERSION_MAC" >> $GITHUB_OUTPUT
 
-  build-jars:
-    needs: determine-matrix
+  build-portable:
+    needs: read_versions
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        variant:
-          - name: "default"
-            disable_security: true
-            build_frontend: true
-            file_suffix: ""
-          - name: "with-login"
-            disable_security: false
-            build_frontend: true
+        disable_security: [true, false]
+        include:
+          - disable_security: false
             file_suffix: "-with-login"
-          - name: "server-only"
-            disable_security: true
-            build_frontend: false
-            file_suffix: "-server"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: "21"
           distribution: "temurin"
 
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           gradle-version: 8.14
 
-      - name: Setup Node.js
-        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Build JAR
-        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
         env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Rename JAR
+      - name: Rename binaries
         run: |
-          echo "Version from determine-matrix: ${{ needs.determine-matrix.outputs.version }}"
-          echo "Looking for: app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar"
-          ls -la app/core/build/libs/
-          mkdir -p ./jar-dist
-          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
+          mkdir ./binaries
+          mv ./build/launch4j/Stirling-PDF.exe ./binaries/win-Stirling-PDF-portable-Server${{ matrix.file_suffix }}.exe
+          mv ./app/core/build/libs/stirling-pdf-${{ needs.read_versions.outputs.version }}.jar ./binaries/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: jar${{ matrix.variant.file_suffix }}
-          path: ./jar-dist/*.jar
           retention-days: 1
+          if-no-files-found: error
+          name: stirling${{ matrix.file_suffix }}-binaries
+          path: |
+            ./binaries/*
 
-  build:
-    needs: determine-matrix
+  sign_verify-portable:
+    needs: [build-portable, read_versions]
+    runs-on: ubuntu-latest
     strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "with-login-"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          node-version: 22
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+          name: stirling-${{ matrix.file_suffix }}binaries
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+          retention-days: 1
+          if-no-files-found: error
+          name: stirling-${{ matrix.file_suffix }}signed
+          path: |
+            ./*
+            !cosign.*
+
+  build-installers:
+    needs: read_versions
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: "21"
           distribution: "temurin"
 
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        with:
+          gradle-version: 8.14
+
+      # Install Windows dependencies
+      - name: Install WiX Toolset
+        if: matrix.os == 'windows-latest'
         run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+          curl -L -o wix.exe https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314.exe
+          .\wix.exe /install /quiet
 
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+      # Build installer
+      - name: Build Installer
+        run: ./gradlew build jpackage -x test --info
         env:
           DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: true
+          BROWSER_OPEN: true
 
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
+      - name: Set up JDK (x86_64)
+        if: matrix.os == 'macos-latest'
         run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
+          curl -L -o jdk.tar.gz https://cdn.azul.com/zulu/bin/zulu17.56.15-ca-jdk17.0.14-macosx_x64.tar.gz
+          mkdir -p zulu17
+          tar -xzf jdk.tar.gz -C zulu17 --strip-components=1
+          echo "JAVA_HOME=$PWD/zulu17" >> $GITHUB_ENV
+          echo "$PWD/zulu17/bin" >> $GITHUB_PATH
 
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
+      -   name: Verify JDK architecture
+          if: matrix.os == 'macos-latest'
+          run: file $JAVA_HOME/bin/java
 
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+      -   name: Build project and run jpackage (x86_64)
+          if: matrix.os == 'macos-latest'
+          run: arch -x86_64 ./gradlew jpackageMacX64
 
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on release or V2-master
-          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
+      # Rename and collect artifacts based on OS
+      - name: Prepare artifacts
+        id: prepare
         shell: bash
         run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
+          ls -lah ./build/jpackage/
+          mkdir ./binaries
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.version }}.exe" "./binaries/Stirling-PDF-win-installer.exe"
+          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-installer.dmg"
+            mv "./build/jpackage/x86_64/Stirling PDF (x86_64)-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-x86_64-installer.dmg"
           else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            mv "./build/jpackage/stirling-pdf_${{ needs.read_versions.outputs.version }}-1_amd64.deb" "./binaries/Stirling-PDF-linux-installer.deb"
           fi
 
+      - name: Display structure of downloaded files
+        run: ls -R ./binaries
+
       - name: Upload build artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
           retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}binaries
+          path: |
+            ./binaries/*
+
+  sign_verify:
+    needs: [read_versions, build-installers]
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: ${{ matrix.platform }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        if: matrix.os == 'windows-latest'
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+
+      - name: Generate key pair
+        if: matrix.os == 'windows-latest'
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        if: matrix.os == 'windows-latest'
+        run: |
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./Stirling-PDF-win-installer.exe.intoto.jsonl \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}signed
+          path: |
+            ./Stirling-PDF-${{ matrix.platform }}installer.*
+            ./Stirling-PDF-${{ matrix.platform }}x86_64-installer.*
+            !cosign.*
 
   create-release:
-    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-    needs: [determine-matrix, build, build-jars]
+    if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_mode != 'true'
+    needs: [read_versions, sign_verify, sign_verify-portable]
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - name: Download all Tauri artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          pattern: Stirling-PDF-*
-          path: ./artifacts/tauri
-
-      - name: Download JAR artifact (default)
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          name: jar
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (with login)
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          name: jar-with-login
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (server only)
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-        with:
-          name: jar-server
-          path: ./artifacts/jars
-
+      - name: Download signed artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Upload binaries to Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        run: ls -R
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.read_versions.outputs.version }}
           generate_release_notes: true
           files: |
-            ./artifacts/**/*.jar
-            ./artifacts/**/*.msi
-            ./artifacts/**/*.dmg
-            ./artifacts/**/*.deb
-            ./artifacts/**/*.AppImage
-          draft: false
-          prerelease: false
+            ./*signed/*

.github/workflows/pre_commit.yml

@@ -12,21 +12,17 @@ permissions:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
-    env:
-      # Prevents sdist builds → no tar extraction
-      PIP_ONLY_BINARY: ":all:"
-      PIP_DISABLE_PIP_VERSION_CHECK: "1"
     permissions:
       contents: write
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
 
@@ -38,23 +34,23 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
-          cache: "pip" # caching pip dependencies
+          cache: 'pip' # caching pip dependencies
           cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt
 
       - name: Run Pre-Commit Hooks
         run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt
+          pip install --require-hashes -r ./.github/scripts/requirements_pre_commit.txt
 
       - run: pre-commit run --all-files -c .pre-commit-config.yaml
         continue-on-error: true
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 21
+          java-version: 17
           distribution: "temurin"
 
       - name: Build with Gradle
@@ -67,7 +63,7 @@ jobs:
 
       - name: Create Pull Request
         if: env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           token: ${{ steps.setup-bot.outputs.token }}
           commit-message: ":file_folder: pre-commit"

.github/workflows/push-docker-v2.yml

@@ -1,245 +0,0 @@
-name: Push Docker Image - V2 Branch
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - V2-master
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-
-      - name: Get version number
-        id: versionNumber
-        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for latest (V2-master branch - production)
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Generate tags for latest (V1_V2_merge branch - test)
-        id: meta-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign regular images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --yes \
-              --key env://COSIGN_PRIVATE_KEY \
-              "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for latest-fat (V2-master branch - production)
-        id: meta-fat
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Generate tags for latest-fat (V1_V2_merge branch - test)
-        id: meta-fat-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Build and push Unified Dockerfile (fat variant)
-        id: build-push-fat
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.fat
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign fat images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite (V2-master branch - production)
-        id: meta-lite
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Generate tags for ultra-lite (V1_V2_merge branch - test)
-        id: meta-lite-test
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        if: github.ref == 'refs/heads/V1_V2_merge'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done

.github/workflows/push-docker.yml

@@ -24,26 +24,25 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       packages: write
       id-token: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "21"
+          java-version: "17"
           distribution: "temurin"
 
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           gradle-version: 8.14
 
@@ -55,7 +54,7 @@ jobs:
 
       - name: Install cosign
         if: github.ref == 'refs/heads/master'
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
         with:
           cosign-release: "v2.4.1"
 
@@ -68,20 +67,20 @@ jobs:
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Convert repository owner to lowercase
         id: repoowner
@@ -89,7 +88,7 @@ jobs:
 
       - name: Generate tags
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
         if: github.ref != 'refs/heads/main'
         with:
           images: |
@@ -108,7 +107,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -135,7 +134,7 @@ jobs:
 
       - name: Generate tags ultra-lite
         id: meta2
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
         if: github.ref != 'refs/heads/main'
         with:
           images: |
@@ -153,7 +152,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
+          file: ./Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -166,7 +165,7 @@ jobs:
 
       - name: Generate tags fat
         id: meta3
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -184,7 +183,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/releaseArtifacts.yml

@@ -0,0 +1,180 @@
+name: Release Artifacts
+
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
+    outputs:
+      version: ${{ steps.versionNumber.outputs.versionNumber }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        with:
+          gradle-version: 8.14
+
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Get version number
+        id: versionNumber
+        run: |
+          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
+          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Rename binaries
+        run: |
+          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+      - name: Debug build artifacts
+        run: |
+          echo "Current Directory: $(pwd)"
+          ls -R ./build/libs
+          ls -R ./build/launch4j
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: binaries${{ matrix.file_suffix }}
+          path: |
+            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
+
+  sign_verify:
+    needs: build
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: binaries${{ matrix.file_suffix }}
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+
+      - name: Generate key pair
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        run: |
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
+
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: signed${{ matrix.file_suffix }}
+          path: |
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+
+  release:
+    needs: [build, sign_verify]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Download signed artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: signed${{ matrix.file_suffix }}
+
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        with:
+          tag_name: v${{ needs.build.outputs.version }}
+          generate_release_notes: true
+          files: |
+            ./libs/Stirling-PDF*
+            ./launch4j/Stirling-PDF-Server*

.github/workflows/scorecards.yml

@@ -17,7 +17,6 @@ permissions: read-all
 
 jobs:
   analysis:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
@@ -35,17 +34,17 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -67,7 +66,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -75,6 +74,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v3.29.5
+        uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/sonarqube.yml

@@ -0,0 +1,75 @@
+name: Run Sonarqube
+
+on:
+  push:
+    branches:
+      - master
+  pull_request_target:
+    branches:
+      - main
+  workflow_dispatch:
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: read
+  actions: read
+
+jobs:
+  sonarqube:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+
+      - name: Build and analyze with Gradle
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          DISABLE_ADDITIONAL_FEATURES: false
+          STIRLING_PDF_DESKTOP_UI: true
+        run: |
+          ./gradlew clean build sonar \
+            -Dsonar.projectKey=Stirling-Tools_Stirling-PDF \
+            -Dsonar.organization=stirling-tools \
+            -Dsonar.host.url=https://sonarcloud.io \
+            -Dsonar.login=${SONAR_TOKEN} \
+            -Dsonar.log.level=DEBUG \
+            --info
+
+      - name: Upload Problems Report on Failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: gradle-problems-report
+          path: build/reports/problems/problems-report.html
+          retention-days: 7
+
+      - name: Upload Sonar Logs on Failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: sonar-logs
+          path: |
+            .scannerwork/report-task.txt
+            build/sonar/
+          retention-days: 7

.github/workflows/stale.yml

@@ -10,19 +10,18 @@ permissions:
 
 jobs:
   stale:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -23,23 +23,22 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK 17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "21"
+          java-version: "17"
           distribution: "temurin"
 
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs

.github/workflows/sync_files.yml

@@ -0,0 +1,116 @@
+name: Sync Files
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+      - "README.md"
+      - "app/core/src/main/resources/messages_*.properties"
+      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
+      - "scripts/ignore_translation.toml"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-files:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+
+      - name: Sync translation property files
+        run: |
+          python .github/scripts/check_language_properties.py --reference-file "app/core/src/main/resources/messages_en_GB.properties" --branch main
+
+      - name: Commit translation files
+        run: |
+          git add app/core/src/main/resources/messages_*.properties
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+
+      - name: Install dependencies
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+
+      - name: Sync README.md
+        run: |
+          python scripts/counter_translation.py
+
+      - name: Run git add
+        run: |
+          git add README.md scripts/ignore_translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
+
+      - name: Create Pull Request
+        if: always()
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: Update files
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: sync_readme
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          body: |
+            ### Description of Changes
+
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+
+            #### **1. Synchronization of Translation Files**
+            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
+            - Ensured consistency and synchronization across all supported language files.
+            - Highlighted any missing or incomplete translations.
+
+            #### **2. Update README.md**
+            - Generated the translation progress table in `README.md`.
+            - Added a summary of the current translation status for all supported languages.
+            - Included up-to-date statistics on translation coverage.
+
+            #### **Why these changes are necessary**
+            - Keeps translation files aligned with the latest reference updates.
+            - Ensures the documentation reflects the current translation progress.
+
+            ---
+
+            Auto-generated by [create-pull-request][1].
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
+          add-paths: |
+            README.md
+            app/core/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,14 +1,15 @@
-name: Sync Files (TOML)
+name: Sync Files V2
 
 on:
   workflow_dispatch:
   push:
     branches:
-      - main
+      - V2
+      - syncLangTest
     paths:
       - "build.gradle"
       - "README.md"
-      - "frontend/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.json"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
       - "scripts/ignore_translation.toml"
 
@@ -32,11 +33,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Setup GitHub App Bot
         id: setup-bot
@@ -46,26 +47,26 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
-      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Sync translation TOML files
+      - name: Sync translation JSON files
         run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
+          python .github/scripts/check_language_json.py --reference-file "frontend/public/locales/en-GB/translation.json" --branch V2
 
       - name: Commit translation files
         run: |
-          git add frontend/public/locales/*/translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
+          git add frontend/public/locales/*/translation.json
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+
+      - name: Install dependencies
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Sync README.md
         run: |
-          python scripts/counter_translation_v3.py
+          python scripts/counter_translation_v2.py
 
       - name: Run git add
         run: |
@@ -74,29 +75,28 @@ jobs:
 
       - name: Create Pull Request
         if: always()
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           token: ${{ steps.setup-bot.outputs.token }}
           commit-message: Update files
           committer: ${{ steps.setup-bot.outputs.committer }}
           author: ${{ steps.setup-bot.outputs.committer }}
           signoff: true
-          branch: sync_readme_v3
-          base: main
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          branch: sync_readme_v2
+          base: V2
+          title: ":globe_with_meridians: [V2] Sync Translations + Update README Progress Table"
           body: |
             ### Description of Changes
 
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation for the **V2 branch**. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.json`) to reflect changes in the reference file `en-GB/translation.json`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
-            - **Format**: TOML
 
             #### **2. Update README.md**
-            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
+            - Generated the translation progress table in `README.md`.
             - Added a summary of the current translation status for all supported languages.
             - Included up-to-date statistics on translation coverage.
 
@@ -115,5 +115,4 @@ jobs:
           sign-commits: true
           add-paths: |
             README.md
-            frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            frontend/public/locales/*/translation.json

.github/workflows/tauri-build.yml

@@ -1,646 +0,0 @@
-name: Build Tauri Applications
-
-on:
-  workflow_dispatch:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  pull_request:
-    branches: [main, V2-tauri-windows]
-    paths:
-      - "frontend/src-tauri/**"
-      - "frontend/src/desktop/**"
-      - "frontend/tsconfig.desktop.json"
-      - ".github/workflows/tauri-build.yml"
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
-    steps:
-      - name: Determine build matrix
-        id: set-matrix
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For PR/push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
-
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          # STIRLING_PDF_DESKTOP_UI=false ./gradlew clean bootJar --no-daemon
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink (always rebuild)
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Check DMG creation dependencies (macOS only)
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
-          echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
-          echo "create-dmg availability: $(which create-dmg || echo 'NOT FOUND')"
-          echo "Available disk space: $(df -h /tmp | tail -1)"
-          echo "macOS version: $(sw_vers -productVersion)"
-          echo "Available tools:"
-          ls -la /usr/bin/hd* || echo "No hd* tools found"
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # List available certificates and check if they have certificates attached
-          Write-Host "Checking for available certificates..."
-          $certList = & smctl keypair ls 2>&1
-          Write-Host "Keypair list output:"
-          Write-Host $certList
-          Write-Host ""
-
-          # Parse the output to check certificate status
-          $lines = $certList -split "`n"
-          $foundKeypair = $false
-          $hasCertificate = $false
-
-          foreach ($line in $lines) {
-            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
-              $foundKeypair = $true
-              Write-Host "[SUCCESS] Found keypair in list"
-
-              # Check if this line has certificate info (not just empty spaces after alias)
-              $parts = $line -split "\s+"
-              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
-                $hasCertificate = $true
-                Write-Host "[SUCCESS] Certificate is associated with keypair"
-              }
-            }
-          }
-
-          if (-not $foundKeypair) {
-            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
-            Write-Host "Available keypairs are listed above"
-            Write-Host ""
-            Write-Host "Please verify:"
-            Write-Host "  1. Keypair alias is correct in GitHub secret"
-            Write-Host "  2. API key has access to this keypair"
-            exit 1
-          }
-
-          if (-not $hasCertificate) {
-            Write-Host "[ERROR] No certificate associated with keypair"
-            Write-Host "This usually means:"
-            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
-            Write-Host "  2. Certificate is pending approval"
-            Write-Host "  3. Certificate needs to be attached to the keypair"
-            Write-Host ""
-            Write-Host "Try running in DigiCert ONE portal:"
-            Write-Host "  smctl keypair sync"
-            exit 1
-          }
-
-          Write-Host "[SUCCESS] Certificate check passed"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              Write-Host ""
-              Write-Host "Possible issues:"
-              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
-              Write-Host "  2. Incorrect keypair alias"
-              Write-Host "  3. API key lacks signing permissions"
-              Write-Host ""
-              Write-Host "Please verify in DigiCert ONE portal:"
-              Write-Host "  - Certificate status is 'Issued' (not Pending)"
-              Write-Host "  - Keypair status is 'Online'"
-              Write-Host "  - 'Can sign' is set to 'Yes'"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Verify notarization (macOS only)
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "🔍 Verifying notarization status..."
-          cd ./frontend/src-tauri/target
-          DMG_FILE=$(find . -name "*.dmg" | head -1)
-          if [ -n "$DMG_FILE" ]; then
-            echo "Found DMG: $DMG_FILE"
-            echo "Checking notarization ticket..."
-            spctl -a -vvv -t install "$DMG_FILE" || echo "⚠️ Notarization check failed or not yet complete"
-            stapler validate "$DMG_FILE" || echo "⚠️ No notarization ticket attached"
-          else
-            echo "⚠️ No DMG file found to verify"
-          fi
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
-
-      - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
-        shell: pwsh
-        run: |
-          Write-Host "Verifying Windows code signatures..."
-
-          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
-          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"
-
-          $allSigned = $true
-          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
-          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
-
-          # Check EXE signature
-          if (Test-Path $exePath) {
-            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
-            Write-Host "EXE Signature Status: $($exeSig.Status)"
-            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
-            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
-
-            if ($exeSig.Status -ne "Valid") {
-              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
-              if ($usingKeyLocker -or $usingPfx) {
-                Write-Host "[ERROR] Certificate was provided but signing failed"
-                $allSigned = $false
-              } else {
-                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
-              }
-            } else {
-              Write-Host "[SUCCESS] EXE is properly signed"
-            }
-          }
-
-          # Check MSI signature
-          if (Test-Path $msiPath) {
-            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
-            Write-Host "MSI Signature Status: $($msiSig.Status)"
-            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
-            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
-
-            if ($msiSig.Status -ne "Valid") {
-              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
-              if ($usingKeyLocker -or $usingPfx) {
-                Write-Host "[ERROR] Certificate was provided but signing failed"
-                $allSigned = $false
-              } else {
-                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
-              }
-            } else {
-              Write-Host "[SUCCESS] MSI is properly signed"
-            }
-          }
-
-          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
-            Write-Host "[ERROR] Code signing verification failed"
-            exit 1
-          } else {
-            Write-Host "[SUCCESS] Code signature verification completed"
-          }
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
-          retention-days: 7
-
-      - name: Verify build artifacts
-        shell: bash
-        run: |
-          cd ./frontend/src-tauri/target
-
-          # Check for expected artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            echo "Checking for Windows artifacts..."
-            find . -name "*.exe" -o -name "*.msi" | head -5
-            if [ $(find . -name "*.exe" | wc -l) -eq 0 ]; then
-              echo "❌ No Windows executable found"
-              exit 1
-            fi
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            echo "Checking for macOS artifacts..."
-            find . -name "*.dmg" -o -name "*.app" | head -5
-            if [ $(find . -name "*.dmg" -o -name "*.app" | wc -l) -eq 0 ]; then
-              echo "❌ No macOS artifacts found"
-              exit 1
-            fi
-          else
-            echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.AppImage" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
-              echo "❌ No Linux artifacts found"
-              exit 1
-            fi
-          fi
-
-          echo "✅ Build artifacts found for ${{ matrix.name }}"
-
-      - name: Test artifact sizes
-        shell: bash
-        run: |
-          cd ./frontend/src-tauri/target
-          echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
-            if [ -f "$file" ]; then
-              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
-              echo "$file: $size bytes"
-              # Check if file is suspiciously small (less than 1MB)
-              if [ "$size" != "unknown" ] && [ "$size" -lt 1048576 ]; then
-                echo "⚠️  Warning: $file is smaller than 1MB"
-              fi
-            fi
-          done
-
-  report:
-    needs: build
-    runs-on: ubuntu-latest
-    if: always()
-    steps:
-      - name: Report build results
-        run: |
-          if [ "${{ needs.build.result }}" = "success" ]; then
-            echo "✅ All Tauri builds completed successfully!"
-            echo "Artifacts are ready for distribution."
-          elif [ "${{ needs.build.result }}" = "skipped" ]; then
-            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
-          else
-            echo "❌ Some Tauri builds failed."
-            echo "Please check the logs and fix any issues."
-            exit 1
-          fi

.github/workflows/testdriver.yml

@@ -21,25 +21,24 @@ permissions:
 
 jobs:
   deploy:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Set up JDK
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: "21"
-          distribution: "temurin"
+          java-version: '17'
+          distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           gradle-version: 8.14
 
@@ -58,7 +57,7 @@ jobs:
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
@@ -67,7 +66,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
@@ -117,47 +116,28 @@ jobs:
             docker-compose up -d
           EOF
 
-  files-changed:
-    if: always()
-    name: detect what files changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    outputs:
-      frontend: ${{ steps.changes.outputs.frontend }}
-    steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
-        id: changes
-        with:
-          filters: ".github/config/.files.yaml"
-
   test:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [deploy, files-changed]
+    needs: deploy
     runs-on: ubuntu-latest
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Node
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+          cache: 'npm'
 
       - name: Run TestDriver.ai
         uses: testdriverai/action@f0d0f45fdd684db628baa843fe9313f3ca3a8aa8 #1.1.3
         with:
           key: ${{secrets.TESTDRIVER_API_KEY}}
           prerun: |
-            cd frontend
             npm install
             npm run build
             npm install dashcam-chrome --save
@@ -176,7 +156,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
@@ -187,7 +167,6 @@ jobs:
           sudo chmod 600 ../private.key
 
       - name: Cleanup deployment
-        if: always()
         run: |
           ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.VPS_USERNAME }}@${{ secrets.VPS_HOST }} << EOF
             cd /stirling/test-${{ github.sha }}
@@ -195,4 +174,3 @@ jobs:
             cd /stirling
             rm -rf test-${{ github.sha }}
           EOF
-        continue-on-error: true # Ensure cleanup runs even if previous steps fail

.gitignore

@@ -17,8 +17,8 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/
-!pipeline/.gitkeep
+pipeline/watchedFolders/
+pipeline/finishedFolders/
 customFiles/
 configs/
 watchedFolders/
@@ -31,25 +31,8 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json
 
-# Frontend build artifacts copied to backend static resources
-# These are generated by npm build and should not be committed
-app/core/src/main/resources/static/assets/
-app/core/src/main/resources/static/index.html
-app/core/src/main/resources/static/locales/
-app/core/src/main/resources/static/Login/
-app/core/src/main/resources/static/classic-logo/
-app/core/src/main/resources/static/modern-logo/
-app/core/src/main/resources/static/og_images/
-app/core/src/main/resources/static/samples/
-app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/robots.txt
-app/core/src/main/resources/static/pdfium/
-app/core/src/main/resources/static/vendor/
-# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
-
 # Gradle
 .gradle
-.gradle-home
 .lock
 
 # External tool builders
@@ -230,17 +213,3 @@ node_modules/
 test_batch.json
 *.backup.*.json
 frontend/public/locales/*/translation.backup*.json
-
-# Development/build artifacts
-.gradle-cache/
-scripts/pdf-collection/
-**/tmp/
-*.backup
-
-# Type3 development data
-docs/type3/signatures/
-
-
-# Type3 sample PDFs (development only)
-**/type3/samples/
-

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.8
+    rev: v0.14.2
     hooks:
       - id: ruff
         args:
@@ -22,7 +22,7 @@ repos:
         files: \.(html|css|js|py|md)$
         exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: v8.28.0
     hooks:
       - id: gitleaks
   - repo: https://github.com/pre-commit/pre-commit-hooks

ADDING_TOOLS.md

@@ -202,10 +202,10 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-GB/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.json`
 
 **Required Translation Keys**:
-```toml
+```json
 {
   "home": {
     "[toolName]": {
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-GB/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.json`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

DeveloperGuide.md

@@ -32,12 +32,6 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Docker for containerization
 - Gradle for build management
 
-**Desktop Application (Tauri):**
-- Tauri for cross-platform desktop app packaging
-- Rust backend for system integration
-- PDF file association support
-- Self-contained JRE bundling with JLink
-
 **Legacy (reference only during development):**
 - Thymeleaf templates (being completely replaced in 2.0)
 
@@ -50,8 +44,6 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Java JDK 17 or later (JDK 21 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
-- Rust and Cargo (required for Tauri desktop app development)
-- Tauri CLI (install with `cargo install tauri-cli`)
 
 ### Setup Steps
 
@@ -103,10 +95,6 @@ Stirling 2.0 uses client-side file storage:
 ### Legacy Code Reference
 The existing Thymeleaf templates remain in the codebase during development as reference material but will be completely removed for the 2.0 release.
 
-### Tauri Desktop App Development
-Stirling-PDF can be packaged as a cross-platform desktop application using Tauri with PDF file association support and bundled JRE.
-See [the frontend README](frontend/README.md#tauri) for build instructions.
-
 ## 5. Project Structure
 
 ```bash
@@ -121,12 +109,6 @@ Stirling-PDF/
 │   │   ├── services/      # API and utility services
 │   │   ├── types/         # TypeScript type definitions
 │   │   └── utils/         # Utility functions
-│   ├── src-tauri/         # Tauri desktop app configuration
-│   │   ├── src/           # Rust backend code
-│   │   ├── libs/          # JAR files (generated by build scripts)
-│   │   ├── runtime/       # Bundled JRE (generated by build scripts)
-│   │   ├── Cargo.toml     # Rust dependencies
-│   │   └── tauri.conf.json # Tauri configuration
 │   ├── public/
 │   │   └── locales/       # Internationalization files (JSON)
 │   ├── package.json       # Frontend dependencies
@@ -410,23 +392,23 @@ For Stirling 2.0, new features are built as React components instead of Thymelea
    // frontend/src/tools/NewTool.tsx
    import { useState } from 'react';
    import { Button, FileInput, Container } from '@mantine/core';
-
+   
    interface NewToolProps {
      params: Record<string, any>;
      updateParams: (updates: Record<string, any>) => void;
    }
-
+   
    export default function NewTool({ params, updateParams }: NewToolProps) {
      const [files, setFiles] = useState<File[]>([]);
-
+     
      const handleProcess = async () => {
        // Process files using API or client-side logic
      };
-
+     
      return (
        <Container>
-         <FileInput
-           multiple
+         <FileInput 
+           multiple 
            accept="application/pdf"
            onChange={setFiles}
          />

LICENSE

@@ -6,10 +6,6 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "frontend/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
-* All content that resides under the "frontend/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

README.md

@@ -1,69 +1,191 @@
-<p align="center">
-  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
-</p>
+<p align="center"><img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80"></p>
+<h1 align="center">Stirling-PDF</h1>
 
-<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
+[![Docker Pulls](https://img.shields.io/docker/pulls/frooodle/s-pdf)](https://hub.docker.com/r/frooodle/s-pdf)
+[![Discord](https://img.shields.io/discord/1068636748814483718?label=Discord)](https://discord.gg/HYmhKj45pU)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge)](https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF)
+[![GitHub Repo stars](https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social)](https://github.com/Stirling-Tools/stirling-pdf)
 
-Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
+<a href="https://www.producthunt.com/posts/stirling-pdf?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-stirling&#0045;pdf" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=641239&theme=light" alt="Stirling&#0032;PDF - Open&#0032;source&#0032;locally&#0032;hosted&#0032;web&#0032;PDF&#0032;editor | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/apps/new?repo=https://github.com/Stirling-Tools/Stirling-PDF/tree/digitalOcean&refcode=c3210994b1af)
 
-<p align="center">
-  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
-    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
-  </a>
-  <a href="https://discord.gg/HYmhKj45pU">
-    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
-  </a>
-  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
-    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
-  </a>
-  <a href="https://github.com/Stirling-Tools/stirling-pdf">
-    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
-  </a>
-</p>
+[Stirling-PDF](https://www.stirlingpdf.com) is a robust, locally hosted web-based PDF manipulation tool using Docker. It enables you to carry out various operations on PDF files, including splitting, merging, converting, reorganizing, adding images, rotating, compressing, and more. This locally hosted web application has evolved to encompass a comprehensive set of features, addressing all your PDF requirements.
 
-![Stirling PDF - Dashboard](images/home-light.png)
+All files and PDFs exist either exclusively on the client side, reside in server memory only during task execution, or temporarily reside in a file solely for the execution of the task. Any file downloaded by the user will have been deleted from the server by that point.
 
-## Key Capabilities
+Homepage: [https://stirlingpdf.com](https://stirlingpdf.com)
 
-- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
-- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
-- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
-- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
-- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
-- **Global UI** - Interface available in 40+ languages.
+All documentation available at [https://docs.stirlingpdf.com/](https://docs.stirlingpdf.com/)
 
-For a full feature list, see the docs: **https://docs.stirlingpdf.com**
+![stirling-home](images/stirling-home.jpg)
 
-## Quick Start
+## Features
 
-```bash
-docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
-```
+- Parallel file processing and downloads
+- Dark mode support
+- Custom download options
+- Custom 'Pipelines' to run multiple features in an automated queue
+- API for integration with external scripts
+- Optional Login and Authentication support (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/System%20and%20Security) for documentation)
+- Enterprise features like SSO (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/Single%20Sign-On%20Configuration) for documentation)
+- Database Backup and Import (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/DATABASE) for documentation)
 
-Then open: http://localhost:8080
+### 50+ PDF Operations
 
-For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
+#### Organise
+- **Merge**: Combine multiple PDFs into one
+- **Split**: Divide PDFs into multiple files
+- **Extract page(s)**: Extract specific pages from PDF
+- **Remove**: Delete pages from PDF
+- **Crop PDF**: Adjust PDF page boundaries
+- **Rotate**: Rotate pages in 90-degree increments
+- **Adjust page size/scale**: Resize page contents
+- **Multi-Page Layout**: Add multiple pages to PDF
+- **PDF to Single Large Page**: Convert to single continuous page
+- **Organize**: Rearrange PDF pages
 
-## Resources
+#### Convert to PDF
+- **Image to PDF**: Convert images to PDF format
+- **Convert file to PDF**: Convert various common file types to PDF
+- **HTML to PDF**: Transform HTML documents to PDF
+- **Markdown to PDF**: Convert Markdown files to PDF
+- **CBZ to PDF**: Convert comic book archives
+- **CBR to PDF**: Convert comic book rar archives
+- **Email to PDF**: Convert email files to PDF
+- **Vector Image to PDF**: Convert vector images (PS, EPS, EPSF) to PDF format
 
-- [**Documentation**](https://docs.stirlingpdf.com)
-- [**Homepage**](https://stirling.com)
-- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
-- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
+#### Convert from PDF
+- **PDF to Word**: Convert to document (docx, doc, odt) format
+- **PDF to Image**: Extract PDF pages as images
+- **PDF to RTF (Text)**: Convert to Rich Text Format
+- **PDF to Presentation**: Convert to presentation (pptx, ppt, odp) format
+- **PDF to CSV**: Extract tables to CSV
+- **PDF to XML**: Convert to XML format
+- **PDF to HTML**: Transform to HTML
+- **PDF to PDF/A**: Convert to archival (PDF/A-1b, PDF/A-2b) format
+- **PDF to Markdown**: Convert PDF to Markdown
+- **PDF to CBZ**: Convert to comic book archive
+- **PDF to CBR**: Convert to comic book rar archive
+- **PDF to Vector Image**: Convert PDF to vector image (EPS, PS, PCL, XPS) format
 
-## Support
+#### Sign & Security
+- **Sign**: Add digital signatures
+- **Remove Password**: Remove PDF security
+- **Add Watermark**: Apply watermarks
+- **Sign with Certificate**: Certificate-based signing
+- **Add Stamp to PDF**: Apply digital stamps
+- **Auto Redact**: Automatically redact content
+- **Change Permissions**: Modify access permissions
+- **Add Password**: Apply PDF encryption
+- **Manual Redaction**: Manual content redaction
+- **Remove Certificate Sign**: Remove digital signatures
+- **Sanitize**: Clean PDF of potential security issues
+- **Validate PDF Signature**: Verify digital signatures
 
-- **Community** [Discord](https://discord.gg/HYmhKj45pU)
-- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+#### View & Edit
+- **OCR / Cleanup scans**: Optical Character Recognition
+- **Add Image**: Insert images into PDF
+- **Extract Images**: Extract embedded images
+- **Change Metadata**: Edit PDF metadata
+- **Get ALL Info on PDF**: Comprehensive PDF analysis
+- **Advanced Colour options**: Colour manipulation (various options for colour inversion, CMYK conversion)
+- **Compare**: Compare PDF documents
+- **Add Page Numbers**: Insert page numbering
+- **Flatten**: Flatten PDF layers, and interactive elements
+- **Remove Annotations**: Delete comments and markups
+- **Remove Blank pages**: Delete empty pages
+- **Remove Image**: Delete embedded images
+- **View/Edit PDF**: Interactive PDF editing
+- **Unlock PDF Forms**: Enable form editing
+- **Add Attachments**: Attach files to PDF
 
-## Contributing
+#### Advanced
+- **Compress**: Reduce file size
+- **Pipeline**: Automated workflow processing (OCR images pipeline, prepare PDFs for emailing pipeline)
+- **Adjust Colours/Contrast**: Colour and contrast adjustment
+- **Auto Rename PDF File**: Automatic file renaming
+- **Auto Split Pages**: Automatic page splitting
+- **Detect/Split Scanned photos**: Photo detection and splitting
+- **Overlay PDFs**: Layer PDFs over each other
+- **Repair**: Fix corrupted PDFs
+- **Show JavaScript**: Display embedded JavaScript
+- **Auto Split by Size/Count**: Split by file size or page count
+- **Split PDF by Chapters**: Chapter-based splitting
+- **Split PDF by Sections**: Section-based splitting
+- **Scanner Effect**: Apply scanner-like effects
+- **Edit Table of Contents**: Modify PDF bookmarks and TOC
 
-We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+# 📖 Get Started
 
-For development setup, see the [Developer Guide](DeveloperGuide.md).
+Visit our comprehensive documentation at [docs.stirlingpdf.com](https://docs.stirlingpdf.com) for:
 
-For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
+- Installation guides for all platforms
+- Configuration options
+- Feature documentation
+- API reference
+- Security setup
+- Enterprise features
 
-## License
 
-Stirling PDF is open-core. See [LICENSE](LICENSE) for details.
+## Supported Languages
+
+Stirling-PDF currently supports 40 languages!
+
+| Language                                     | Progress                               |
+|----------------------------------------------|----------------------------------------|
+| Arabic (العربية) (ar_AR)                     | ![58%](https://geps.dev/progress/58)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![59%](https://geps.dev/progress/59)   |
+| Basque (Euskara) (eu_ES)                     | ![35%](https://geps.dev/progress/35)   |
+| Bulgarian (Български) (bg_BG)                | ![64%](https://geps.dev/progress/64)   |
+| Catalan (Català) (ca_CA)                     | ![64%](https://geps.dev/progress/64)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![93%](https://geps.dev/progress/93)   |
+| Czech (Česky) (cs_CZ)                        | ![66%](https://geps.dev/progress/66)   |
+| Danish (Dansk) (da_DK)                       | ![58%](https://geps.dev/progress/58)   |
+| Dutch (Nederlands) (nl_NL)                   | ![57%](https://geps.dev/progress/57)   |
+| English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
+| English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
+| French (Français) (fr_FR)                    | ![96%](https://geps.dev/progress/96)   |
+| German (Deutsch) (de_DE)                     | ![97%](https://geps.dev/progress/97)   |
+| Greek (Ελληνικά) (el_GR)                     | ![64%](https://geps.dev/progress/64)   |
+| Hindi (हिंदी) (hi_IN)                        | ![63%](https://geps.dev/progress/63)   |
+| Hungarian (Magyar) (hu_HU)                   | ![97%](https://geps.dev/progress/97)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![59%](https://geps.dev/progress/59)   |
+| Irish (Gaeilge) (ga_IE)                      | ![64%](https://geps.dev/progress/64)   |
+| Italian (Italiano) (it_IT)                   | ![95%](https://geps.dev/progress/95)   |
+| Japanese (日本語) (ja_JP)                       | ![92%](https://geps.dev/progress/92)   |
+| Korean (한국어) (ko_KR)                         | ![64%](https://geps.dev/progress/64)   |
+| Norwegian (Norsk) (no_NB)                    | ![62%](https://geps.dev/progress/62)   |
+| Persian (فارسی) (fa_IR)                      | ![61%](https://geps.dev/progress/61)   |
+| Polish (Polski) (pl_PL)                      | ![68%](https://geps.dev/progress/68)   |
+| Portuguese (Português) (pt_PT)               | ![65%](https://geps.dev/progress/65)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![72%](https://geps.dev/progress/72)   |
+| Romanian (Română) (ro_RO)                    | ![54%](https://geps.dev/progress/54)   |
+| Russian (Русский) (ru_RU)                    | ![91%](https://geps.dev/progress/91)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![94%](https://geps.dev/progress/94)   |
+| Simplified Chinese (简体中文) (zh_CN)            | ![88%](https://geps.dev/progress/88)   |
+| Slovakian (Slovensky) (sk_SK)                | ![49%](https://geps.dev/progress/49)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![67%](https://geps.dev/progress/67)   |
+| Spanish (Español) (es_ES)                    | ![93%](https://geps.dev/progress/93)   |
+| Swedish (Svenska) (sv_SE)                    | ![62%](https://geps.dev/progress/62)   |
+| Thai (ไทย) (th_TH)                           | ![56%](https://geps.dev/progress/56)   |
+| Tibetan (བོད་ཡིག་) (bo_CN)                   | ![61%](https://geps.dev/progress/61)   |
+| Traditional Chinese (繁體中文) (zh_TW)           | ![97%](https://geps.dev/progress/97)   |
+| Turkish (Türkçe) (tr_TR)                     | ![94%](https://geps.dev/progress/94)   |
+| Ukrainian (Українська) (uk_UA)               | ![67%](https://geps.dev/progress/67)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![54%](https://geps.dev/progress/54)   |
+| Malayalam (മലയാളം) (ml_IN)                   | ![69%](https://geps.dev/progress/69)   |
+
+## Stirling PDF Enterprise
+
+Stirling PDF offers an Enterprise edition of its software. This is the same great software but with added features, support and comforts.
+Check out our [Enterprise docs](https://docs.stirlingpdf.com/Pro)
+
+
+## 🤝 Looking to contribute?
+
+Join our community:
+- [Contribution Guidelines](CONTRIBUTING.md)
+- [Translation Guide (How to add custom languages)](devGuide/HowToAddNewLanguage.md)
+- [Developer Guide](devGuide/DeveloperGuide.md)
+- [Issue Tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+- [Discord Community](https://discord.gg/HYmhKj45pU)

WINDOWS_SIGNING.md

@@ -1,258 +0,0 @@
-# Windows Code Signing Setup Guide
-
-This guide explains how to set up Windows code signing for Stirling-PDF desktop application builds.
-
-## Overview
-
-Windows code signing is essential for:
-- Preventing Windows SmartScreen warnings
-- Building trust with users
-- Enabling Microsoft Store distribution
-- Professional application distribution
-
-## Certificate Types
-
-### OV Certificate (Organization Validated)
-- More affordable option
-- Requires business verification
-- May trigger SmartScreen warnings initially until reputation builds
-- Suitable for most independent software vendors
-
-### EV Certificate (Extended Validation)
-- Premium option with immediate SmartScreen reputation
-- Requires hardware security module (HSM) or cloud-based signing
-- Higher cost but provides immediate trust
-- Required since June 2023 for new certificates
-
-## Obtaining a Certificate
-
-### Certificate Authorities
-Popular certificate authorities for Windows code signing:
-- DigiCert
-- Sectigo (formerly Comodo)
-- GlobalSign
-- SSL.com
-
-### Certificate Format
-You'll receive a certificate in one of these formats:
-- `.pfx` or `.p12` (preferred - contains both certificate and private key)
-- `.cer` + private key (needs conversion to .pfx)
-
-### Converting to PFX (if needed)
-If you have separate certificate and private key files:
-
-```bash
-openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cer
-```
-
-## Setting Up GitHub Secrets
-
-### Required Secrets
-
-Navigate to your GitHub repository → Settings → Secrets and variables → Actions
-
-Add the following secrets:
-
-#### 1. `WINDOWS_CERTIFICATE`
-- **Description**: Base64-encoded .pfx certificate file
-- **How to create**:
-
-**On macOS/Linux:**
-```bash
-base64 -i certificate.pfx | pbcopy  # Copies to clipboard
-```
-
-**On Windows (PowerShell):**
-```powershell
-[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
-```
-
-Paste the entire base64 string into the GitHub secret.
-
-#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
-- **Description**: Password for the .pfx certificate
-- **Value**: The password you set when creating/exporting the .pfx file
-
-### Optional Secrets for Tauri Updater
-
-If you're using Tauri's built-in updater feature:
-
-#### `TAURI_SIGNING_PRIVATE_KEY`
-- Generated using Tauri CLI: `npm run tauri signer generate`
-- Used for update package verification
-
-#### `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`
-- Password for the Tauri signing key
-
-## Configuration Files
-
-### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)
-
-The Windows signing configuration is already set up:
-
-```json
-"windows": {
-  "certificateThumbprint": null,
-  "digestAlgorithm": "sha256",
-  "timestampUrl": "http://timestamp.digicert.com"
-}
-```
-
-**Configuration Options:**
-- `certificateThumbprint`: Automatically extracted from imported certificate (leave as `null`)
-- `digestAlgorithm`: Hashing algorithm - `sha256` is recommended
-- `timestampUrl`: Timestamp server to prove signing time (survives certificate expiration)
-
-**Alternative Timestamp Servers:**
-- DigiCert: `http://timestamp.digicert.com`
-- Sectigo: `http://timestamp.sectigo.com`
-- GlobalSign: `http://timestamp.globalsign.com`
-
-### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
-
-The workflow includes three Windows signing steps:
-
-1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
-2. **Build Tauri App**: Builds and signs the application using the imported certificate
-3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
-
-## Testing the Setup
-
-### 1. Local Testing (Windows Only)
-
-Before pushing to GitHub, test locally:
-
-```powershell
-# Set environment variables
-$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
-$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
-
-# Build the application
-cd frontend
-npm run tauri build
-
-# Verify the signature
-Get-AuthenticodeSignature "./src-tauri/target/release/bundle/msi/Stirling-PDF_*.msi"
-```
-
-### 2. GitHub Actions Testing
-
-1. Push your changes to a branch
-2. Manually trigger the workflow:
-   - Go to Actions → Build Tauri Applications
-   - Click "Run workflow"
-   - Select "windows" platform
-3. Check the build logs for:
-   - ✅ Certificate import success
-   - ✅ Build completion
-   - ✅ Signature verification
-
-### 3. Verifying Signed Binaries
-
-After downloading the built artifacts:
-
-**Windows (PowerShell):**
-```powershell
-Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.exe"
-Get-AuthenticodeSignature "Stirling-PDF-windows-x86_64.msi"
-```
-
-Look for:
-- Status: `Valid`
-- Signer: Your organization name
-- Timestamp: Recent date/time
-
-**Windows (GUI):**
-1. Right-click the .exe or .msi file
-2. Select "Properties"
-3. Go to "Digital Signatures" tab
-4. Verify signature details
-
-## Troubleshooting
-
-### "HashMismatch" Status
-- Certificate doesn't match the binary
-- Possible file corruption during download
-- Re-download and verify
-
-### "NotSigned" Status
-- Certificate wasn't imported correctly
-- Check GitHub secrets are set correctly
-- Verify base64 encoding is complete (no truncation)
-
-### "UnknownError" Status
-- Timestamp server unreachable
-- Try alternative timestamp URL in tauri.conf.json
-- Check network connectivity in GitHub Actions
-
-### SmartScreen Still Shows Warnings
-- Normal for OV certificates initially
-- Reputation builds over time with user downloads
-- Consider EV certificate for immediate reputation
-
-### Certificate Not Found During Build
-- Verify `WINDOWS_CERTIFICATE` secret is set
-- Check base64 encoding is correct (no extra whitespace)
-- Ensure password is correct
-
-## Security Best Practices
-
-1. **Never commit certificates to version control**
-   - Keep .pfx files secure and backed up
-   - Use GitHub secrets for CI/CD
-
-2. **Rotate certificates before expiration**
-   - Set calendar reminders
-   - Update GitHub secrets with new certificate
-
-3. **Use strong passwords**
-   - Certificate password should be complex
-   - Store securely (password manager)
-
-4. **Monitor certificate usage**
-   - Review GitHub Actions logs
-   - Set up notifications for failed builds
-
-5. **Limit access to secrets**
-   - Only repository admins should access secrets
-   - Audit secret access regularly
-
-## Certificate Lifecycle
-
-### Before Expiration
-1. Obtain new certificate from CA (typically annual renewal)
-2. Convert to .pfx format if needed
-3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
-4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
-5. Test build to verify new certificate works
-
-### Expired Certificates
-- Signed binaries remain valid (timestamp proves signing time)
-- New builds will fail until certificate is renewed
-- Users can still install previously signed versions
-
-## Cost Considerations
-
-### Certificate Costs (Annual, as of 2024)
-- **OV Certificate**: $100-400/year
-- **EV Certificate**: $400-1000/year
-
-### Choosing the Right Certificate
-- **Open source / early stage**: Start with OV
-- **Commercial / enterprise**: Consider EV for better trust
-- **Microsoft Store**: EV certificate required
-
-## Additional Resources
-
-- [Tauri Windows Signing Documentation](https://v2.tauri.app/distribute/sign/windows/)
-- [Microsoft Code Signing Overview](https://docs.microsoft.com/windows/win32/seccrypto/cryptography-tools)
-- [DigiCert Code Signing Guide](https://www.digicert.com/signing/code-signing-certificates)
-- [Windows SmartScreen FAQ](https://support.microsoft.com/windows/smartscreen-faq)
-
-## Support
-
-If you encounter issues with Windows code signing:
-1. Check GitHub Actions logs for detailed error messages
-2. Verify all secrets are set correctly
-3. Test certificate locally first (Windows environment required)
-4. Open an issue in the repository with relevant logs (remove sensitive data)

app/allowed-licenses.json

@@ -96,22 +96,6 @@
       "moduleName": ".*",
       "moduleLicense": "MPL 2.0"
     },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "Mozilla Public License, Version 2.0"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "Mozilla Public License 2.0 (MPL-2.0)"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": 	"CDDL+GPL License"
-    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "BSD"
-    },
     {
       "moduleName": ".*",
       "moduleLicense": "UnboundID SCIM2 SDK Free Use License"

app/common/build.gradle

@@ -33,16 +33,14 @@ dependencies {
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
-    api 'org.apache.commons:commons-lang3:3.20.0'
+    api 'org.apache.commons:commons-lang3:3.19.0'
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
-    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
-    api "org.apache.pdfbox:preflight:$pdfboxVersion"
     api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:2.10'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.13"
     api 'jakarta.mail:jakarta.mail-api:2.1.5'
     runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
 }

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
-                Use these endpoints to understand what's inside a document without changing it.
+                Document analysis and information extraction services for content intelligence and insights.
 
-                Typical uses:
-                • Get page counts and dimensions for layout or print rules
-                • List fonts and annotations to spot compatibility issues
-                • Inspect form fields before deciding how to fill or modify them
-                • Pull metadata and security settings for audits or reports
+                This endpoint group provides analytical capabilities to understand document structure,
+                extract information, and generate insights from PDF content for automated processing.
+
+                Common use cases:
+                • Document inventory management and content audit for compliance verification
+                • Quality assurance workflows and business intelligence analytics
+                • Migration planning, accessibility evaluation, and document forensics
+
+                Business applications:
+                • Legal discovery, financial document review, and healthcare records analysis
+                • Academic research, government processing, and publishing optimization
+
+                Operational scenarios:
+                • Large-scale profiling, migration assessment, and performance optimization
+                • Automated quality control and content strategy development
+
+                Target users: Data analysts, QA teams, administrators, and business intelligence
+                professionals requiring detailed document insights.
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
-                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
+                Document format transformation services for cross-platform compatibility and workflow integration.
 
-                Typical uses:
-                • Turn PDFs into Word or text for editing
-                • Convert office files, images, HTML, or email (EML) into PDFs
-                • Create PDF/A for long-term archiving
-                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
+                This endpoint group enables transformation between various formats, supporting
+                diverse business workflows and system integrations for mixed document ecosystems.
+
+                Common use cases:
+                • Legacy system integration, document migration, and cross-platform sharing
+                • Archive standardization, publishing preparation, and content adaptation
+                • Accessibility compliance and mobile-friendly document preparation
+
+                Business applications:
+                • Enterprise content management, digital publishing, and educational platforms
+                • Legal document processing, healthcare interoperability, and government standardization
+
+                Integration scenarios:
+                • API-driven pipelines, automated workflow preparation, and batch conversions
+                • Real-time format adaptation for user requests
+
+                Target users: System integrators, content managers, digital archivists, and
+                organizations requiring flexible document format interoperability.
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
-                Use these endpoints as a "pre-check" step to decide what to do with a file next.
+                Document content filtering and search operations for information discovery and organization.
 
-                Typical uses:
-                • Reject files that are too big or too small
-                • Detect image-only PDFs that should go through OCR
-                • Ensure a document has enough pages before it enters a workflow
-                • Check orientation of pages before printing or merging
+                This endpoint group enables intelligent content discovery and organization within
+                document collections for content-based processing and information extraction.
+
+                Common use cases:
+                • Legal discovery, research organization, and compliance auditing
+                • Content moderation, academic research, and business intelligence
+                • Quality assurance and content validation workflows
+
+                Business applications:
+                • Contract analysis, financial review, and healthcare records organization
+                • Government processing, educational curation, and IP protection
+
+                Workflow scenarios:
+                • Large-scale processing, automated classification, and information extraction
+                • Document preparation for further processing or analysis
+
+                Target users: Legal professionals, researchers, compliance officers, and
+                organizations requiring intelligent document content discovery and organization.
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,13 +22,21 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
-                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
+                Core PDF processing operations for fundamental document manipulation workflows.
 
-                Typical uses:
-                • Split a large PDF into smaller files (by pages, chapters, or size)
-                • Merge several PDFs into one report or pack
-                • Rotate or reorder pages before sending or archiving
-                • Turn a multi-page document into one long scrolling page
+                This endpoint group provides essential PDF functionality that forms the foundation
+                of most document processing workflows across various industries.
+
+                Common use cases:
+                • Document preparation for archival systems and content organization
+                • File preparation for distribution, accessibility compliance, and batch processing
+                • Document consolidation for reporting and legal compliance workflows
+
+                Typical applications:
+                • Content management, publishing workflows, and educational content distribution
+                • Business process automation and archive management
+
+                Target users: Content managers, document processors, and organizations requiring
+                reliable foundational PDF manipulation capabilities.
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -1,37 +0,0 @@
-package stirling.software.common.annotations.api;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import io.swagger.v3.oas.annotations.tags.Tag;
-
-/**
- * Combined annotation for Invite management controllers.
- * Includes @RestController, @RequestMapping("/api/v1/invite"), and OpenAPI @Tag.
- */
-@Target(ElementType.TYPE)
-@Retention(RetentionPolicy.RUNTIME)
-@RestController
-@RequestMapping("/api/v1/invite")
-@Tag(
-        name = "Invite",
-        description =
-                """
-                Invite-link generation and acceptance endpoints for onboarding new users.
-
-                Provides the ability to issue invitation tokens, send optional email invites,
-                validate and accept invite links, and manage pending invitations for teams.
-
-                Typical use cases include:
-                • Admin workflows for issuing time-limited invitations to external users
-                • Self-service invite acceptance and team assignment
-                • License limit enforcement when provisioning new accounts
-
-                Target users: administrators and automation scripts orchestrating user onboarding.
-                """)
-public @interface InviteApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,15 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
-                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
+                Specialized utilities and supplementary tools for enhanced document processing workflows.
 
-                Typical uses:
-                • Repair a damaged PDF or remove blank pages
-                • Run OCR on scanned PDFs so they become searchable
-                • Compress large PDFs for email or web download
-                • Extract embedded images or scans
-                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
-                • Update PDF metadata (title, author, etc.)
+                This endpoint group provides utility operations that support core document processing
+                tasks and address specific workflow needs in real-world scenarios.
+
+                Common use cases:
+                • Document optimization for bandwidth-limited environments and storage cost management
+                • Document repair, content extraction, and validation for quality assurance
+                • Accessibility improvement and custom processing for specialized needs
+
+                Business applications:
+                • Web publishing optimization, email attachment management, and archive efficiency
+                • Mobile compatibility, print production, and legacy document recovery
+
+                Operational scenarios:
+                • Batch processing, quality control, and performance optimization
+                • Troubleshooting and recovery of problematic documents
+
+                Target users: System administrators, document specialists, and organizations requiring
+                specialized document processing and optimization tools.
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,12 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
-                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
+                Automated document processing workflows for complex multi-stage business operations.
 
-                Typical uses:
-                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
-                • Normalise documents before they enter an archive
-                • Wrap a complex document flow behind a single API call for your own apps
+                This endpoint group enables organizations to create sophisticated document processing
+                workflows that combine multiple operations into streamlined, repeatable processes.
+
+                Common use cases:
+                • Invoice processing, legal document review, and healthcare records standardization
+                • Government processing, educational content preparation, and publishing automation
+                • Contract lifecycle management and approval processes
+
+                Business applications:
+                • Automated compliance reporting, large-scale migration, and quality assurance
+                • Archive preparation, content delivery, and document approval workflows
+
+                Operational scenarios:
+                • Scheduled batch processing and event-driven document processing
+                • Multi-department coordination and business system integration
+
+                Target users: Business process managers, IT automation specialists, and organizations
+                requiring consistent, repeatable document processing workflows.
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
-                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
+                Document security and protection services for confidential and sensitive content.
 
-                Typical uses:
-                • Add or remove a password on a PDF
-                • Redact personal or confidential information (manually or automatically)
-                • Validate or remove digital signatures
-                • Sanitize a PDF to strip scripts and embedded content
+                This endpoint group provides essential security operations for organizations handling
+                sensitive documents and materials requiring controlled access.
+
+                Common use cases:
+                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
+                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
+                • Contract security for business transactions
+
+                Business applications:
+                • Document authentication, confidential sharing, and secure archiving
+                • Content watermarking, access control, and privacy protection through redaction
+
+                Industry scenarios:
+                • Legal discovery, medical records exchange, financial audit documentation
+                • Enterprise policy enforcement and data governance
+
+                Target users: Legal professionals, healthcare administrators, compliance officers,
+                government agencies, and enterprises handling sensitive content.
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java

@@ -37,7 +37,7 @@ public class AutoJobAspect {
 
     @Around("@annotation(autoJobPostMapping)")
     public Object wrapWithJobExecution(
-            ProceedingJoinPoint joinPoint, AutoJobPostMapping autoJobPostMapping) throws Exception {
+            ProceedingJoinPoint joinPoint, AutoJobPostMapping autoJobPostMapping) {
         // This aspect will run before any audit aspects due to @Order(0)
         // Extract parameters from the request and annotation
         boolean async = Boolean.parseBoolean(request.getParameter("async"));
@@ -81,12 +81,6 @@ public class AutoJobAspect {
                                     "AutoJobAspect caught exception during job execution: {}",
                                     ex.getMessage(),
                                     ex);
-                            // Rethrow RuntimeException as-is to preserve exception type
-                            if (ex instanceof RuntimeException) {
-                                throw (RuntimeException) ex;
-                            }
-                            // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                            // BaseAppException
                             throw new RuntimeException(ex);
                         }
                     },
@@ -115,8 +109,7 @@ public class AutoJobAspect {
             int maxRetries,
             boolean trackProgress,
             boolean queueable,
-            int resourceWeight)
-            throws Exception {
+            int resourceWeight) {
 
         // Keep jobId reference for progress tracking in TaskManager
         AtomicReference<String> jobIdRef = new AtomicReference<>();
@@ -214,12 +207,6 @@ public class AutoJobAspect {
 
                     // If we get here, all retries failed
                     if (lastException != null) {
-                        // Rethrow RuntimeException as-is to preserve exception type
-                        if (lastException instanceof RuntimeException) {
-                            throw (RuntimeException) lastException;
-                        }
-                        // Wrap checked exceptions - GlobalExceptionHandler will unwrap
-                        // BaseAppException
                         throw new RuntimeException(
                                 "Job failed after "
                                         + maxRetries

app/common/src/main/java/stirling/software/common/configuration/AppConfig.java

@@ -11,6 +11,7 @@ import java.util.function.Predicate;
 import java.util.stream.Stream;
 
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Lazy;
@@ -19,7 +20,9 @@ import org.springframework.context.annotation.Scope;
 import org.springframework.core.env.Environment;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
+import org.springframework.core.io.ResourceLoader;
 import org.springframework.util.ClassUtils;
+import org.thymeleaf.spring6.SpringTemplateEngine;
 
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
@@ -37,6 +40,10 @@ public class AppConfig {
 
     private final ApplicationProperties applicationProperties;
 
+    @Getter
+    @Value("${baseUrl:http://localhost}")
+    private String baseUrl;
+
     @Getter
     @Value("${server.servlet.context-path:/}")
     private String contextPath;
@@ -45,17 +52,6 @@ public class AppConfig {
     @Value("${server.port:8080}")
     private String serverPort;
 
-    /**
-     * Get the backend URL from system configuration. Falls back to http://localhost if not
-     * configured.
-     *
-     * @return The backend base URL for SAML/OAuth/API callbacks
-     */
-    public String getBackendUrl() {
-        String backendUrl = applicationProperties.getSystem().getBackendUrl();
-        return (backendUrl != null && !backendUrl.isBlank()) ? backendUrl : "http://localhost";
-    }
-
     @Value("${v2}")
     public boolean v2Enabled;
 
@@ -64,7 +60,6 @@ public class AppConfig {
         return v2Enabled;
     }
 
-    /* Commented out Thymeleaf template engine bean - to be removed when frontend migration is complete
     @Bean
     @ConditionalOnProperty(name = "system.customHTMLFiles", havingValue = "true")
     public SpringTemplateEngine templateEngine(ResourceLoader resourceLoader) {
@@ -72,16 +67,16 @@ public class AppConfig {
         templateEngine.addTemplateResolver(new FileFallbackTemplateResolver(resourceLoader));
         return templateEngine;
     }
-    */
 
     @Bean(name = "loginEnabled")
     public boolean loginEnabled() {
-        return applicationProperties.getSecurity().isEnableLogin();
+        return applicationProperties.getSecurity().getEnableLogin();
     }
 
     @Bean(name = "appName")
     public String appName() {
-        return "Stirling PDF";
+        String homeTitle = applicationProperties.getUi().getAppName();
+        return (homeTitle != null) ? homeTitle : "Stirling PDF";
     }
 
     @Bean(name = "appVersion")
@@ -99,7 +94,9 @@ public class AppConfig {
 
     @Bean(name = "homeText")
     public String homeText() {
-        return "null";
+        return (applicationProperties.getUi().getHomeDescription() != null)
+                ? applicationProperties.getUi().getHomeDescription()
+                : "null";
     }
 
     @Bean(name = "languages")
@@ -114,13 +111,18 @@ public class AppConfig {
 
     @Bean(name = "navBarText")
     public String navBarText() {
-        String navBar = applicationProperties.getUi().getAppNameNavbar();
-        return (navBar != null) ? navBar : "Stirling PDF";
+        String defaultNavBar =
+                applicationProperties.getUi().getAppNameNavbar() != null
+                        ? applicationProperties.getUi().getAppNameNavbar()
+                        : applicationProperties.getUi().getAppName();
+        return (defaultNavBar != null) ? defaultNavBar : "Stirling PDF";
     }
 
     @Bean(name = "enableAlphaFunctionality")
     public boolean enableAlphaFunctionality() {
-        return applicationProperties.getSystem().isEnableAlphaFunctionality();
+        return applicationProperties.getSystem().getEnableAlphaFunctionality() != null
+                ? applicationProperties.getSystem().getEnableAlphaFunctionality()
+                : false;
     }
 
     @Bean(name = "rateLimit")
@@ -257,6 +259,12 @@ public class AppConfig {
         return false;
     }
 
+    @Bean(name = "GoogleDriveEnabled")
+    @Profile("default")
+    public boolean googleDriveEnabled() {
+        return false;
+    }
+
     @Bean(name = "license")
     @Profile("default")
     public String licenseType() {

app/common/src/main/java/stirling/software/common/configuration/InstallationPathConfig.java

@@ -31,7 +31,6 @@ public class InstallationPathConfig {
     private static final String STATIC_PATH;
     private static final String TEMPLATES_PATH;
     private static final String SIGNATURES_PATH;
-    private static final String PRIVATE_KEY_PATH;
 
     static {
         BASE_PATH = initializeBasePath();
@@ -57,7 +56,6 @@ public class InstallationPathConfig {
         STATIC_PATH = CUSTOM_FILES_PATH + "static" + File.separator;
         TEMPLATES_PATH = CUSTOM_FILES_PATH + "templates" + File.separator;
         SIGNATURES_PATH = CUSTOM_FILES_PATH + "signatures" + File.separator;
-        PRIVATE_KEY_PATH = CONFIG_PATH + "db" + File.separator + "keys" + File.separator;
     }
 
     private static String initializeBasePath() {

app/common/src/main/java/stirling/software/common/configuration/RuntimePathConfig.java

@@ -10,10 +10,8 @@ import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.CustomPaths;
 import stirling.software.common.model.ApplicationProperties.CustomPaths.Operations;
 import stirling.software.common.model.ApplicationProperties.CustomPaths.Pipeline;
-import stirling.software.common.model.ApplicationProperties.System;
 
 @Slf4j
 @Configuration
@@ -21,16 +19,8 @@ import stirling.software.common.model.ApplicationProperties.System;
 public class RuntimePathConfig {
     private final ApplicationProperties properties;
     private final String basePath;
-
-    // Operation paths
     private final String weasyPrintPath;
     private final String unoConvertPath;
-    private final String calibrePath;
-    private final String ocrMyPdfPath;
-    private final String sOfficePath;
-
-    // Tesseract data path
-    private final String tessDataPath;
 
     // Pipeline paths
     private final String pipelineWatchedFoldersPath;
@@ -47,10 +37,7 @@ public class RuntimePathConfig {
         String defaultFinishedFolders = Path.of(this.pipelinePath, "finishedFolders").toString();
         String defaultWebUIConfigs = Path.of(this.pipelinePath, "defaultWebUIConfigs").toString();
 
-        System system = properties.getSystem();
-        CustomPaths customPaths = system.getCustomPaths();
-
-        Pipeline pipeline = customPaths.getPipeline();
+        Pipeline pipeline = properties.getSystem().getCustomPaths().getPipeline();
 
         this.pipelineWatchedFoldersPath =
                 resolvePath(
@@ -70,11 +57,8 @@ public class RuntimePathConfig {
         // Initialize Operation paths
         String defaultWeasyPrintPath = isDocker ? "/opt/venv/bin/weasyprint" : "weasyprint";
         String defaultUnoConvertPath = isDocker ? "/opt/venv/bin/unoconvert" : "unoconvert";
-        String defaultCalibrePath = isDocker ? "/opt/calibre/ebook-convert" : "ebook-convert";
-        String defaultOcrMyPdfPath = isDocker ? "/usr/bin/ocrmypdf" : "ocrmypdf";
-        String defaultSOfficePath = isDocker ? "/usr/bin/soffice" : "soffice";
 
-        Operations operations = customPaths.getOperations();
+        Operations operations = properties.getSystem().getCustomPaths().getOperations();
         this.weasyPrintPath =
                 resolvePath(
                         defaultWeasyPrintPath,
@@ -83,28 +67,6 @@ public class RuntimePathConfig {
                 resolvePath(
                         defaultUnoConvertPath,
                         operations != null ? operations.getUnoconvert() : null);
-        this.calibrePath =
-                resolvePath(
-                        defaultCalibrePath, operations != null ? operations.getCalibre() : null);
-        this.ocrMyPdfPath =
-                resolvePath(
-                        defaultOcrMyPdfPath, operations != null ? operations.getOcrmypdf() : null);
-        this.sOfficePath =
-                resolvePath(
-                        defaultSOfficePath, operations != null ? operations.getSoffice() : null);
-
-        // Initialize Tesseract data path
-        String defaultTessDataPath =
-                isDocker ? "/usr/share/tesseract-ocr/5/tessdata" : "/usr/share/tessdata";
-
-        String tessPath = system.getTessdataDir();
-        String tessdataDir = java.lang.System.getenv("TESSDATA_PREFIX");
-
-        this.tessDataPath =
-                resolvePath(
-                        defaultTessDataPath,
-                        (tessPath != null && !tessPath.isEmpty()) ? tessPath : tessdataDir);
-        log.info("Using Tesseract data path: {}", this.tessDataPath);
     }
 
     private String resolvePath(String defaultPath, String customPath) {

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -69,7 +69,6 @@ public class ApplicationProperties {
 
     private AutoPipeline autoPipeline = new AutoPipeline();
     private ProcessExecutor processExecutor = new ProcessExecutor();
-    private PdfEditor pdfEditor = new PdfEditor();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -102,46 +101,6 @@ public class ApplicationProperties {
         private String outputFolder;
     }
 
-    @Data
-    public static class PdfEditor {
-        private Cache cache = new Cache();
-        private FontNormalization fontNormalization = new FontNormalization();
-        private CffConverter cffConverter = new CffConverter();
-        private Type3 type3 = new Type3();
-        private String fallbackFont = "classpath:/static/fonts/NotoSans-Regular.ttf";
-
-        @Data
-        public static class Cache {
-            private long maxBytes = -1;
-            private int maxPercent = 20;
-        }
-
-        @Data
-        public static class FontNormalization {
-            private boolean enabled = false;
-        }
-
-        @Data
-        public static class CffConverter {
-            private boolean enabled = true;
-            private String method = "python";
-            private String pythonCommand = "/opt/venv/bin/python3";
-            private String pythonScript = "/scripts/convert_cff_to_ttf.py";
-            private String fontforgeCommand = "fontforge";
-        }
-
-        @Data
-        public static class Type3 {
-            private Library library = new Library();
-
-            @Data
-            public static class Library {
-                private boolean enabled = true;
-                private String index = "classpath:/type3/library/index.json";
-            }
-        }
-    }
-
     @Data
     public static class Legal {
         private String termsAndConditions;
@@ -153,7 +112,8 @@ public class ApplicationProperties {
 
     @Data
     public static class Security {
-        private boolean enableLogin;
+        private Boolean enableLogin;
+        private Boolean csrfDisabled;
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
@@ -162,7 +122,6 @@ public class ApplicationProperties {
         private String loginMethod = "all";
         private String customGlobalAPIKey;
         private Jwt jwt = new Jwt();
-        private Validation validation = new Validation();
 
         public Boolean isAltLogin() {
             return saml2.getEnabled() || oauth2.getEnabled();
@@ -336,8 +295,8 @@ public class ApplicationProperties {
                                 throw new UnsupportedProviderException(
                                         "Logout from the provider "
                                                 + registrationId
-                                                + " is not supported. Report it at"
-                                                + " https://github.com/Stirling-Tools/Stirling-PDF/issues");
+                                                + " is not supported. "
+                                                + "Report it at https://github.com/Stirling-Tools/Stirling-PDF/issues");
                     };
                 }
             }
@@ -345,79 +304,34 @@ public class ApplicationProperties {
 
         @Data
         public static class Jwt {
-            private boolean enableKeystore = true;
-            private boolean enableKeyRotation = false;
-            private boolean enableKeyCleanup = true;
+            private boolean enabled = true;
+            private boolean keyCleanup = true;
             private int keyRetentionDays = 7;
-        }
-
-        @Data
-        public static class Validation {
-            private Trust trust = new Trust();
-            private boolean allowAIA = false;
-            private Aatl aatl = new Aatl();
-            private Eutl eutl = new Eutl();
-            private Revocation revocation = new Revocation();
-
-            @Data
-            public static class Trust {
-                private boolean serverAsAnchor = true;
-                private boolean useSystemTrust = false;
-                private boolean useMozillaBundle = false;
-                private boolean useAATL = false;
-                private boolean useEUTL = false;
-            }
-
-            @Data
-            public static class Aatl {
-                private String url = "https://trustlist.adobe.com/tl.pdf";
-            }
-
-            @Data
-            public static class Eutl {
-                private String lotlUrl = "https://ec.europa.eu/tools/lotl/eu-lotl.xml";
-                private boolean acceptTransitional = false;
-            }
-
-            @Data
-            public static class Revocation {
-                private String mode = "none";
-                private boolean hardFail = false;
-            }
+            private Boolean secureCookie;
         }
     }
 
     @Data
     public static class System {
         private String defaultLocale;
-        private boolean googlevisibility;
+        private Boolean googlevisibility;
         private boolean showUpdate;
-        private boolean showUpdateOnlyAdmin;
-        private boolean showSettingsWhenNoLogin = true;
+        private Boolean showUpdateOnlyAdmin;
         private boolean customHTMLFiles;
         private String tessdataDir;
-        private boolean enableAlphaFunctionality;
+        private Boolean enableAlphaFunctionality;
         private Boolean enableAnalytics;
         private Boolean enablePosthog;
         private Boolean enableScarf;
-        private Boolean enableDesktopInstallSlide;
         private Datasource datasource;
-        private boolean disableSanitize;
+        private Boolean disableSanitize;
         private int maxDPI;
-        private boolean enableUrlToPDF;
+        private Boolean enableUrlToPDF;
         private Html html = new Html();
         private CustomPaths customPaths = new CustomPaths();
         private String fileUploadLimit;
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
-        private List<String> corsAllowedOrigins = new ArrayList<>();
-        private String backendUrl; // Backend base URL for SAML/OAuth/API callbacks (e.g.
-        // 'http://localhost:8080', 'https://api.example.com'). Required for
-        // SSO.
-        private String frontendUrl; // Frontend URL for invite email links (e.g.
-
-        // 'https://app.example.com'). If not set, falls back to backendUrl.
-        private boolean enableMobileScanner = false; // Enable mobile phone QR code upload feature
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -457,9 +371,6 @@ public class ApplicationProperties {
         public static class Operations {
             private String weasyprint;
             private String unoconvert;
-            private String calibre;
-            private String ocrmypdf;
-            private String soffice;
         }
     }
 
@@ -542,31 +453,34 @@ public class ApplicationProperties {
         @Override
         public String toString() {
             return """
-      Driver {
-        driverName='%s'
-      }
-      """
+                Driver {
+                  driverName='%s'
+                }
+                """
                     .formatted(driverName);
         }
     }
 
     @Data
     public static class Ui {
+        private String appName;
+        private String homeDescription;
         private String appNameNavbar;
         private List<String> languages;
-        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
+
+        public String getAppName() {
+            return appName != null && !appName.trim().isEmpty() ? appName : null;
+        }
+
+        public String getHomeDescription() {
+            return homeDescription != null && !homeDescription.trim().isEmpty()
+                    ? homeDescription
+                    : null;
+        }
 
         public String getAppNameNavbar() {
             return appNameNavbar != null && !appNameNavbar.trim().isEmpty() ? appNameNavbar : null;
         }
-
-        public String getLogoStyle() {
-            // Validate and return either "modern" or "classic"
-            if ("modern".equalsIgnoreCase(logoStyle)) {
-                return "modern";
-            }
-            return "classic"; // default
-        }
     }
 
     @Data
@@ -577,7 +491,7 @@ public class ApplicationProperties {
 
     @Data
     public static class Metrics {
-        private boolean enabled;
+        private Boolean enabled;
     }
 
     @Data
@@ -585,7 +499,6 @@ public class ApplicationProperties {
         @ToString.Exclude private String key;
         private String UUID;
         private String appVersion;
-        private Boolean isNewServer;
     }
 
     // TODO: Remove post migration
@@ -618,23 +531,11 @@ public class ApplicationProperties {
     @Data
     public static class Mail {
         private boolean enabled;
-        private boolean enableInvites = false;
-        private int inviteLinkExpiryHours = 72; // Default: 72 hours (3 days)
         private String host;
         private int port;
         private String username;
         @ToString.Exclude private String password;
         private String from;
-        // STARTTLS upgrades a plain SMTP connection to TLS after connecting (RFC 3207)
-        private Boolean startTlsEnable = true;
-        private Boolean startTlsRequired;
-        // SSL/TLS wrapper for implicit TLS (typically port 465)
-        private Boolean sslEnable;
-        // Hostnames or patterns (e.g., "smtp.example.com" or "*") to trust for TLS certificates;
-        // defaults to "*" (trust all) when not set
-        private String sslTrust;
-        // Enables hostname verification for TLS connections
-        private Boolean sslCheckServerIdentity;
     }
 
     @Data
@@ -650,6 +551,7 @@ public class ApplicationProperties {
             private boolean ssoAutoLogin;
             private boolean database;
             private CustomMetadata customMetadata = new CustomMetadata();
+            private GoogleDrive googleDrive = new GoogleDrive();
 
             @Data
             public static class CustomMetadata {
@@ -668,6 +570,26 @@ public class ApplicationProperties {
                             : producer;
                 }
             }
+
+            @Data
+            public static class GoogleDrive {
+                private boolean enabled;
+                private String clientId;
+                private String apiKey;
+                private String appId;
+
+                public String getClientId() {
+                    return clientId == null || clientId.trim().isEmpty() ? "" : clientId;
+                }
+
+                public String getApiKey() {
+                    return apiKey == null || apiKey.trim().isEmpty() ? "" : apiKey;
+                }
+
+                public String getAppId() {
+                    return appId == null || appId.trim().isEmpty() ? "" : appId;
+                }
+            }
         }
 
         @Data
@@ -722,7 +644,6 @@ public class ApplicationProperties {
             private int weasyPrintSessionLimit;
             private int installAppSessionLimit;
             private int calibreSessionLimit;
-            private int imageMagickSessionLimit;
             private int qpdfSessionLimit;
             private int tesseractSessionLimit;
             private int ghostscriptSessionLimit;
@@ -761,10 +682,6 @@ public class ApplicationProperties {
                 return calibreSessionLimit > 0 ? calibreSessionLimit : 1;
             }
 
-            public int getImageMagickSessionLimit() {
-                return imageMagickSessionLimit > 0 ? imageMagickSessionLimit : 4;
-            }
-
             public int getGhostscriptSessionLimit() {
                 return ghostscriptSessionLimit > 0 ? ghostscriptSessionLimit : 8;
             }
@@ -798,8 +715,6 @@ public class ApplicationProperties {
             @JsonProperty("calibretimeoutMinutes")
             private long calibreTimeoutMinutes;
 
-            private long imageMagickTimeoutMinutes;
-
             private long tesseractTimeoutMinutes;
             private long qpdfTimeoutMinutes;
             private long ghostscriptTimeoutMinutes;
@@ -838,10 +753,6 @@ public class ApplicationProperties {
                 return calibreTimeoutMinutes > 0 ? calibreTimeoutMinutes : 30;
             }
 
-            public long getImageMagickTimeoutMinutes() {
-                return imageMagickTimeoutMinutes > 0 ? imageMagickTimeoutMinutes : 30;
-            }
-
             public long getGhostscriptTimeoutMinutes() {
                 return ghostscriptTimeoutMinutes > 0 ? ghostscriptTimeoutMinutes : 30;
             }

app/common/src/main/java/stirling/software/common/model/InputStreamTemplateResource.java

@@ -4,6 +4,8 @@ package stirling.software.common.model;
  * This class will be removed when frontend migration to React is complete
 
 
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
 
 @RequiredArgsConstructor
 @Getter

app/common/src/main/java/stirling/software/common/model/api/PDFFile.java

@@ -5,8 +5,6 @@ import org.springframework.web.multipart.MultipartFile;
 
 import io.swagger.v3.oas.annotations.media.Schema;
 
-import jakarta.validation.constraints.AssertTrue;
-
 import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.NoArgsConstructor;
@@ -14,9 +12,7 @@ import lombok.NoArgsConstructor;
 @Data
 @NoArgsConstructor
 @EqualsAndHashCode
-@Schema(description = "PDF file input - either upload a file or provide a server-side file ID")
 public class PDFFile {
-
     @Schema(
             description = "The input PDF file",
             contentMediaType = MediaType.APPLICATION_PDF_VALUE,
@@ -24,14 +20,7 @@ public class PDFFile {
     private MultipartFile fileInput;
 
     @Schema(
-            description =
-                    "File ID for server-side files (can be used instead of fileInput if job was previously done on file in async mode)")
+            description = "File ID for server-side files (can be used instead of fileInput)",
+            example = "a1b2c3d4-5678-90ab-cdef-ghijklmnopqr")
     private String fileId;
-
-    @AssertTrue(message = "Either fileInput or fileId must be provided")
-    @Schema(hidden = true)
-    private boolean isValid() {
-        return (fileInput != null && (fileId == null || fileId.trim().isEmpty()))
-                || (fileId != null && !fileId.trim().isEmpty() && fileInput == null);
-    }
 }

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -42,7 +42,7 @@ public class CustomPDFDocumentFactory {
 
     // Memory thresholds and limits
 
-    public static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
+    private static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
     // Files smaller than this threshold are loaded entirely in memory for better performance.
     // These files use IOUtils.createMemoryOnlyStreamCache() which keeps all document data in RAM.
     // No temp files are created for document data, reducing I/O operations but consuming more
@@ -478,6 +478,11 @@ public class CustomPDFDocumentFactory {
         return file;
     }
 
+    /** Create a uniquely named temporary directory */
+    private Path createTempDirectory(String prefix) throws IOException {
+        return Files.createTempDirectory(prefix + tempCounter.incrementAndGet() + "-");
+    }
+
     /** Create new document bytes based on an existing document */
     public byte[] createNewBytesBasedOnOldDocument(byte[] oldDocument) throws IOException {
         try (PDDocument document = load(oldDocument)) {

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -1,6 +1,7 @@
 package stirling.software.common.service;
 
 import java.io.IOException;
+import java.util.Locale;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.CompletableFuture;
@@ -9,7 +10,6 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -38,9 +38,6 @@ public class JobExecutorService {
     private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
     private final long effectiveTimeoutMs;
 
-    @Autowired(required = false)
-    private JobOwnershipService jobOwnershipService;
-
     public JobExecutorService(
             TaskManager taskManager,
             FileStorage fileStorage,
@@ -102,17 +99,11 @@ public class JobExecutorService {
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
-        // Generate base UUID
-        String baseJobId = UUID.randomUUID().toString();
+        String jobId = UUID.randomUUID().toString();
 
-        // Scope job to authenticated user if security is enabled
-        String scopedJobKey = getScopedJobKey(baseJobId);
-
-        log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
-
-        // Store the scoped job ID in the request for potential use by other components
+        // Store the job ID in the request for potential use by other components
         if (request != null) {
-            request.setAttribute("jobId", scopedJobKey);
+            request.setAttribute("jobId", jobId);
 
             // Also track this job ID in the user's session for authorization purposes
             // This ensures users can only cancel their own jobs
@@ -126,13 +117,11 @@ public class JobExecutorService {
                     request.getSession().setAttribute("userJobIds", userJobIds);
                 }
 
-                userJobIds.add(scopedJobKey);
-                log.debug("Added scoped job ID {} to user session", scopedJobKey);
+                userJobIds.add(jobId);
+                log.debug("Added job ID {} to user session", jobId);
             }
         }
 
-        String jobId = scopedJobKey;
-
         // Determine which timeout to use
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
@@ -161,31 +150,17 @@ public class JobExecutorService {
             taskManager.createTask(jobId);
 
             // Create a specialized wrapper that updates the TaskManager
-            final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
-                            // Set jobId in ThreadLocal context for the queued job
-                            stirling.software.common.util.JobContext.setJobId(
-                                    capturedJobIdForQueue);
-                            log.debug(
-                                    "Set jobId {} in JobContext for queued job execution",
-                                    capturedJobIdForQueue);
-
                             Object result = work.get();
-                            processJobResult(capturedJobIdForQueue, result);
+                            processJobResult(jobId, result);
                             return result;
                         } catch (Exception e) {
                             log.error(
-                                    "Error executing queued job {}: {}",
-                                    capturedJobIdForQueue,
-                                    e.getMessage(),
-                                    e);
-                            taskManager.setError(capturedJobIdForQueue, e.getMessage());
+                                    "Error executing queued job {}: {}", jobId, e.getMessage(), e);
+                            taskManager.setError(jobId, e.getMessage());
                             throw e;
-                        } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
-                            stirling.software.common.util.JobContext.clear();
                         }
                     };
 
@@ -197,36 +172,21 @@ public class JobExecutorService {
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
-
-            // Capture the jobId for the async thread
-            final String capturedJobId = jobId;
-
             executor.execute(
                     () -> {
                         try {
                             log.debug(
-                                    "Running async job {} with timeout {} ms",
-                                    capturedJobId,
-                                    timeoutToUse);
-
-                            // Set jobId in ThreadLocal context for the async thread
-                            stirling.software.common.util.JobContext.setJobId(capturedJobId);
-                            log.debug(
-                                    "Set jobId {} in JobContext for async execution",
-                                    capturedJobId);
+                                    "Running async job {} with timeout {} ms", jobId, timeoutToUse);
 
                             // Execute with timeout
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
-                            processJobResult(capturedJobId, result);
+                            processJobResult(jobId, result);
                         } catch (TimeoutException te) {
                             log.error("Job {} timed out after {} ms", jobId, timeoutToUse);
                             taskManager.setError(jobId, "Job timed out");
                         } catch (Exception e) {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
-                        } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
-                            stirling.software.common.util.JobContext.clear();
                         }
                     });
 
@@ -235,10 +195,6 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
-                // Make jobId available to downstream components on the worker thread
-                stirling.software.common.util.JobContext.setJobId(jobId);
-                log.debug("Set jobId {} in JobContext for sync execution", jobId);
-
                 // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
@@ -253,29 +209,11 @@ public class JobExecutorService {
                 log.error("Synchronous job timed out after {} ms", timeoutToUse);
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
-            } catch (RuntimeException e) {
-                // Check if this is a wrapped typed exception that should be handled by
-                // GlobalExceptionHandler
-                Throwable cause = e.getCause();
-                if (cause instanceof stirling.software.common.util.ExceptionUtils.BaseAppException
-                        || cause
-                                instanceof
-                                stirling.software.common.util.ExceptionUtils
-                                        .BaseValidationException) {
-                    // Rethrow so GlobalExceptionHandler can handle with proper HTTP status codes
-                    throw e;
-                }
-                // Handle other RuntimeExceptions as generic errors
-                log.error("Error executing synchronous job: {}", e.getMessage(), e);
-                return ResponseEntity.internalServerError()
-                        .body(Map.of("error", "Job failed: " + e.getMessage()));
             } catch (Exception e) {
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
                 // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
-            } finally {
-                stirling.software.common.util.JobContext.clear();
             }
         }
     }
@@ -503,7 +441,7 @@ public class JobExecutorService {
 
             double numericValue = Double.parseDouble(value);
 
-            return switch (unit.toLowerCase()) {
+            return switch (unit.toLowerCase(Locale.ROOT)) {
                 case "s" -> (long) (numericValue * 1000);
                 case "m" -> (long) (numericValue * 60 * 1000);
                 case "h" -> (long) (numericValue * 60 * 60 * 1000);
@@ -529,23 +467,8 @@ public class JobExecutorService {
             throws TimeoutException, Exception {
         // Use the same executor as other async jobs for consistency
         // This ensures all operations run on the same thread pool
-        String currentJobId = stirling.software.common.util.JobContext.getJobId();
-
         java.util.concurrent.CompletableFuture<T> future =
-                java.util.concurrent.CompletableFuture.supplyAsync(
-                        () -> {
-                            if (currentJobId != null) {
-                                stirling.software.common.util.JobContext.setJobId(currentJobId);
-                            }
-                            try {
-                                return supplier.get();
-                            } finally {
-                                if (currentJobId != null) {
-                                    stirling.software.common.util.JobContext.clear();
-                                }
-                            }
-                        },
-                        executor);
+                java.util.concurrent.CompletableFuture.supplyAsync(supplier, executor);
 
         try {
             return future.get(timeoutMs, TimeUnit.MILLISECONDS);
@@ -561,18 +484,4 @@ public class JobExecutorService {
             throw new Exception("Execution was interrupted", e);
         }
     }
-
-    /**
-     * Get a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param baseJobId the base job identifier
-     * @return scoped job key, or just baseJobId if no ownership service available
-     */
-    private String getScopedJobKey(String baseJobId) {
-        if (jobOwnershipService != null) {
-            return jobOwnershipService.createScopedJobKey(baseJobId);
-        }
-        // Security disabled, return unsecured job key
-        return baseJobId;
-    }
 }

app/common/src/main/java/stirling/software/common/service/JobOwnershipService.java

@@ -1,42 +0,0 @@
-package stirling.software.common.service;
-
-import java.util.Optional;
-
-/**
- * Service interface for managing job ownership and access control. Implementations can provide
- * user-scoped job isolation when security is enabled, or no-op behavior when security is disabled.
- */
-public interface JobOwnershipService {
-
-    /**
-     * Get the current authenticated user's identifier.
-     *
-     * @return Optional containing user identifier, or empty if not authenticated
-     */
-    Optional<String> getCurrentUserId();
-
-    /**
-     * Create a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param jobId the base job identifier
-     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
-     */
-    String createScopedJobKey(String jobId);
-
-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param scopedJobKey the scoped job key to validate
-     * @return true if current user owns the job or no authentication is required
-     * @throws SecurityException if current user does not own the job
-     */
-    boolean validateJobAccess(String scopedJobKey);
-
-    /**
-     * Extract the base job ID from a scoped job key.
-     *
-     * @param scopedJobKey the scoped job key
-     * @return the base job ID without user prefix
-     */
-    String extractJobId(String scopedJobKey);
-}

app/common/src/main/java/stirling/software/common/service/LineArtConversionService.java

@@ -1,12 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
-
-public interface LineArtConversionService {
-    PDImageXObject convertImageToLineArt(
-            PDDocument doc, PDImageXObject originalImage, double threshold, int edgeLevel)
-            throws IOException;
-}

app/common/src/main/java/stirling/software/common/service/MobileScannerService.java

@@ -1,438 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-
-import org.springframework.scheduling.annotation.Scheduled;
-import org.springframework.stereotype.Service;
-import org.springframework.web.multipart.MultipartFile;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Service for handling mobile scanner file uploads and temporary storage. Files are stored
- * temporarily and automatically cleaned up after 10 minutes or upon retrieval.
- */
-@Service
-@Slf4j
-public class MobileScannerService {
-
-    private static final long SESSION_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
-    private final Map<String, SessionData> activeSessions = new ConcurrentHashMap<>();
-    private final Path tempDirectory;
-
-    public MobileScannerService() throws IOException {
-        // Create temp directory for mobile scanner uploads
-        this.tempDirectory =
-                Paths.get(System.getProperty("java.io.tmpdir"), "stirling-mobile-scanner");
-        Files.createDirectories(tempDirectory);
-        log.info("Mobile scanner temp directory: {}", tempDirectory);
-    }
-
-    /**
-     * Register a new session (called by desktop when QR code is generated)
-     *
-     * @param sessionId Unique session identifier
-     * @return SessionInfo with creation time and expiry
-     */
-    public SessionInfo createSession(String sessionId) {
-        validateSessionId(sessionId);
-
-        SessionData session = new SessionData(sessionId);
-        activeSessions.put(sessionId, session);
-
-        log.info("Created mobile scanner session: {}", sessionId);
-        return new SessionInfo(
-                sessionId,
-                session.createdAt,
-                session.createdAt + SESSION_TIMEOUT_MS,
-                SESSION_TIMEOUT_MS);
-    }
-
-    /**
-     * Validate if a session exists and is not expired
-     *
-     * @param sessionId Session identifier to validate
-     * @return SessionInfo if valid, null if invalid/expired
-     */
-    public SessionInfo validateSession(String sessionId) {
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null) {
-            return null;
-        }
-
-        long now = System.currentTimeMillis();
-        long expiryTime = session.getLastAccessTime() + SESSION_TIMEOUT_MS;
-
-        // Check if expired
-        if (now > expiryTime) {
-            deleteSession(sessionId);
-            return null;
-        }
-
-        session.updateLastAccess();
-        return new SessionInfo(sessionId, session.createdAt, expiryTime, SESSION_TIMEOUT_MS);
-    }
-
-    /**
-     * Stores uploaded files for a session
-     *
-     * @param sessionId Unique session identifier
-     * @param files Files to upload
-     * @throws IOException If file storage fails
-     */
-    public void uploadFiles(String sessionId, List<MultipartFile> files) throws IOException {
-        validateSessionId(sessionId);
-
-        SessionData session =
-                activeSessions.computeIfAbsent(sessionId, id -> new SessionData(sessionId));
-
-        // Create session directory
-        Path sessionDir = getSafeSessionDirectory(sessionId);
-        Files.createDirectories(sessionDir);
-
-        // Save each file
-        for (MultipartFile file : files) {
-            if (file.isEmpty()) {
-                continue;
-            }
-
-            String originalFilename = file.getOriginalFilename();
-            if (originalFilename == null || originalFilename.isBlank()) {
-                originalFilename = "upload-" + System.currentTimeMillis();
-            }
-
-            // Sanitize filename
-            String safeFilename = sanitizeFilename(originalFilename);
-            Path filePath = sessionDir.resolve(safeFilename).normalize().toAbsolutePath();
-
-            // Ensure resulting path stays within the session directory
-            if (!filePath.startsWith(sessionDir)) {
-                throw new IOException("Invalid filename");
-            }
-
-            // Handle duplicate filenames
-            int counter = 1;
-            while (Files.exists(filePath)) {
-                String nameWithoutExt = safeFilename.replaceFirst("[.][^.]+$", "");
-                String ext =
-                        safeFilename.contains(".")
-                                ? safeFilename.substring(safeFilename.lastIndexOf("."))
-                                : "";
-                safeFilename = nameWithoutExt + "-" + counter + ext;
-                filePath = sessionDir.resolve(safeFilename).normalize().toAbsolutePath();
-                if (!filePath.startsWith(sessionDir)) {
-                    throw new IOException("Invalid filename");
-                }
-                counter++;
-            }
-
-            file.transferTo(filePath);
-            session.addFile(new FileMetadata(safeFilename, file.getSize(), file.getContentType()));
-            log.info(
-                    "Uploaded file for session {}: {} ({} bytes)",
-                    sessionId,
-                    safeFilename,
-                    file.getSize());
-        }
-
-        session.updateLastAccess();
-    }
-
-    /**
-     * Retrieves file metadata for a session
-     *
-     * @param sessionId Session identifier
-     * @return List of file metadata, or empty list if session doesn't exist
-     */
-    public List<FileMetadata> getSessionFiles(String sessionId) {
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null) {
-            return List.of();
-        }
-        session.updateLastAccess();
-        return new ArrayList<>(session.getFiles());
-    }
-
-    /**
-     * Retrieves actual file data for download
-     *
-     * @param sessionId Session identifier
-     * @param filename Filename to retrieve
-     * @return File path
-     * @throws IOException If file not found or session doesn't exist
-     */
-    public Path getFile(String sessionId, String filename) throws IOException {
-        SessionData session = activeSessions.get(sessionId);
-        if (session == null) {
-            throw new IOException("Session not found: " + sessionId);
-        }
-
-        Path filePath = getSafeFilePath(sessionId, filename);
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found: " + filename);
-        }
-
-        session.updateLastAccess();
-        session.markFileAsDownloaded(filename);
-        return filePath;
-    }
-
-    /**
-     * Deletes a file after it has been served to the client. Should be called after successful
-     * download.
-     *
-     * @param sessionId Session identifier
-     * @param filename Filename to delete
-     */
-    public void deleteFileAfterDownload(String sessionId, String filename) {
-        try {
-            Path filePath = getSafeFilePath(sessionId, filename);
-            Files.deleteIfExists(filePath);
-            log.info("Deleted file after download: {}/{}", sessionId, filename);
-
-            // Check if all files have been downloaded - if so, delete the entire session
-            SessionData session = activeSessions.get(sessionId);
-            if (session != null && session.allFilesDownloaded()) {
-                deleteSession(sessionId);
-                log.info("All files downloaded - deleted session: {}", sessionId);
-            }
-        } catch (IOException | IllegalArgumentException e) {
-            log.warn("Failed to delete file after download: {}/{}", sessionId, filename, e);
-        }
-    }
-
-    /**
-     * Deletes a session and all its files
-     *
-     * @param sessionId Session to delete
-     */
-    public void deleteSession(String sessionId) {
-        SessionData session = activeSessions.remove(sessionId);
-        if (session != null) {
-            try {
-                Path sessionDir = getSafeSessionDirectory(sessionId);
-                if (Files.exists(sessionDir)) {
-                    // Delete all files in session directory
-                    Files.walk(sessionDir)
-                            .sorted(
-                                    (a, b) ->
-                                            -a.compareTo(b)) // Reverse order to delete files before
-                            // directory
-                            .forEach(
-                                    path -> {
-                                        try {
-                                            Files.deleteIfExists(path);
-                                        } catch (IOException e) {
-                                            log.warn("Failed to delete file: {}", path, e);
-                                        }
-                                    });
-                }
-                log.info("Deleted session: {}", sessionId);
-            } catch (IllegalArgumentException e) {
-                log.warn(
-                        "Refused to delete session with invalid sessionId '{}': {}",
-                        sessionId,
-                        e.getMessage());
-            } catch (IOException e) {
-                log.error("Error deleting session directory: {}", sessionId, e);
-            }
-        }
-    }
-
-    /** Scheduled cleanup of expired sessions (runs every 5 minutes) */
-    @Scheduled(fixedRate = 5 * 60 * 1000)
-    public void cleanupExpiredSessions() {
-        long now = System.currentTimeMillis();
-        List<String> expiredSessions = new ArrayList<>();
-
-        activeSessions.forEach(
-                (sessionId, session) -> {
-                    if (now - session.getLastAccessTime() > SESSION_TIMEOUT_MS) {
-                        expiredSessions.add(sessionId);
-                    }
-                });
-
-        if (!expiredSessions.isEmpty()) {
-            log.info("Cleaning up {} expired mobile scanner sessions", expiredSessions.size());
-            expiredSessions.forEach(this::deleteSession);
-        }
-    }
-
-    private void validateSessionId(String sessionId) {
-        if (sessionId == null || sessionId.isBlank()) {
-            throw new IllegalArgumentException("Session ID cannot be empty");
-        }
-        // Basic validation: alphanumeric and hyphens only
-        if (!sessionId.matches("[a-zA-Z0-9-]+")) {
-            throw new IllegalArgumentException("Invalid session ID format");
-        }
-    }
-
-    private String sanitizeFilename(String filename) {
-        // Remove path traversal attempts and dangerous characters
-        String sanitized = filename.replaceAll("[^a-zA-Z0-9._-]", "_");
-        // Ensure we have a non-empty, safe filename
-        if (sanitized.isBlank()) {
-            sanitized = "upload-" + System.currentTimeMillis();
-        }
-        return sanitized;
-    }
-
-    /**
-     * Safely resolves and validates a session directory path to prevent directory traversal
-     * attacks.
-     *
-     * @param sessionId Session identifier
-     * @return Normalized absolute path to the session directory
-     * @throws IllegalArgumentException if the resolved path escapes the temp directory
-     */
-    private Path getSafeSessionDirectory(String sessionId) {
-        validateSessionId(sessionId);
-
-        Path baseDir = tempDirectory.normalize().toAbsolutePath();
-        Path sessionDir = baseDir.resolve(sessionId).normalize().toAbsolutePath();
-
-        // Verify the resolved path is still within the temp directory
-        if (!sessionDir.startsWith(baseDir)) {
-            throw new IllegalArgumentException("Invalid session ID: path traversal detected");
-        }
-
-        return sessionDir;
-    }
-
-    /**
-     * Safely resolves and validates a file path within a session directory to prevent directory
-     * traversal attacks.
-     *
-     * @param sessionId Session identifier
-     * @param filename Filename within the session
-     * @return Normalized absolute path to the file
-     * @throws IOException if the resolved path escapes the session directory
-     */
-    private Path getSafeFilePath(String sessionId, String filename) throws IOException {
-        if (filename == null || filename.isBlank()) {
-            throw new IOException("Filename cannot be empty");
-        }
-
-        // Additional validation: reject filenames with path separators or parent references
-        if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
-            throw new IOException(
-                    "Invalid filename: contains path separators or parent references");
-        }
-
-        Path sessionDir = getSafeSessionDirectory(sessionId);
-        Path filePath = sessionDir.resolve(filename).normalize().toAbsolutePath();
-
-        // Verify the resolved path is still within the session directory
-        if (!filePath.startsWith(sessionDir)) {
-            throw new IOException("Invalid filename: path traversal detected");
-        }
-
-        return filePath;
-    }
-
-    /** Session information for client */
-    public static class SessionInfo {
-        private final String sessionId;
-        private final long createdAt;
-        private final long expiresAt;
-        private final long timeoutMs;
-
-        public SessionInfo(String sessionId, long createdAt, long expiresAt, long timeoutMs) {
-            this.sessionId = sessionId;
-            this.createdAt = createdAt;
-            this.expiresAt = expiresAt;
-            this.timeoutMs = timeoutMs;
-        }
-
-        public String getSessionId() {
-            return sessionId;
-        }
-
-        public long getCreatedAt() {
-            return createdAt;
-        }
-
-        public long getExpiresAt() {
-            return expiresAt;
-        }
-
-        public long getTimeoutMs() {
-            return timeoutMs;
-        }
-    }
-
-    /** File metadata for client */
-    public static class FileMetadata {
-        private final String filename;
-        private final long size;
-        private final String contentType;
-
-        public FileMetadata(String filename, long size, String contentType) {
-            this.filename = filename;
-            this.size = size;
-            this.contentType = contentType;
-        }
-
-        public String getFilename() {
-            return filename;
-        }
-
-        public long getSize() {
-            return size;
-        }
-
-        public String getContentType() {
-            return contentType;
-        }
-    }
-
-    /** Session data tracking */
-    private static class SessionData {
-        private final String sessionId;
-        private final List<FileMetadata> files = new ArrayList<>();
-        private final Map<String, Boolean> downloadedFiles = new HashMap<>();
-        private final long createdAt;
-        private long lastAccessTime;
-
-        public SessionData(String sessionId) {
-            this.sessionId = sessionId;
-            this.createdAt = System.currentTimeMillis();
-            this.lastAccessTime = createdAt;
-        }
-
-        public void addFile(FileMetadata file) {
-            files.add(file);
-            downloadedFiles.put(file.getFilename(), false);
-        }
-
-        public List<FileMetadata> getFiles() {
-            return files;
-        }
-
-        public void markFileAsDownloaded(String filename) {
-            downloadedFiles.put(filename, true);
-        }
-
-        public boolean allFilesDownloaded() {
-            return !downloadedFiles.isEmpty()
-                    && downloadedFiles.values().stream().allMatch(downloaded -> downloaded);
-        }
-
-        public void updateLastAccess() {
-            this.lastAccessTime = System.currentTimeMillis();
-        }
-
-        public long getLastAccessTime() {
-            return lastAccessTime;
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -1,21 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-/**
- * Interface for personal signature access (proprietary feature). Implemented only in proprietary
- * module to provide authenticated users access to their personal signatures.
- */
-public interface PersonalSignatureServiceInterface {
-
-    /**
-     * Get a personal signature from the user's folder. Only checks personal folder, not shared
-     * folder.
-     *
-     * @param username Username of the signature owner
-     * @param fileName Signature filename
-     * @return Personal signature image bytes
-     * @throws IOException If file not found or read error
-     */
-    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
-}

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -253,8 +253,11 @@ public class PostHogService {
         addIfNotEmpty(
                 properties,
                 "security_enableLogin",
-                applicationProperties.getSecurity().isEnableLogin());
-        addIfNotEmpty(properties, "security_csrfDisabled", true);
+                applicationProperties.getSecurity().getEnableLogin());
+        addIfNotEmpty(
+                properties,
+                "security_csrfDisabled",
+                applicationProperties.getSecurity().getCsrfDisabled());
         addIfNotEmpty(
                 properties,
                 "security_loginAttemptCount",
@@ -299,13 +302,13 @@ public class PostHogService {
         addIfNotEmpty(
                 properties,
                 "system_googlevisibility",
-                applicationProperties.getSystem().isGooglevisibility());
+                applicationProperties.getSystem().getGooglevisibility());
         addIfNotEmpty(
                 properties, "system_showUpdate", applicationProperties.getSystem().isShowUpdate());
         addIfNotEmpty(
                 properties,
                 "system_showUpdateOnlyAdmin",
-                applicationProperties.getSystem().isShowUpdateOnlyAdmin());
+                applicationProperties.getSystem().getShowUpdateOnlyAdmin());
         addIfNotEmpty(
                 properties,
                 "system_customHTMLFiles",
@@ -317,27 +320,24 @@ public class PostHogService {
         addIfNotEmpty(
                 properties,
                 "system_enableAlphaFunctionality",
-                applicationProperties.getSystem().isEnableAlphaFunctionality());
+                applicationProperties.getSystem().getEnableAlphaFunctionality());
         addIfNotEmpty(
                 properties,
                 "system_enableAnalytics",
                 applicationProperties.getSystem().isAnalyticsEnabled());
-        addIfNotEmpty(
-                properties,
-                "system_enablePosthog",
-                applicationProperties.getSystem().isPosthogEnabled());
-        addIfNotEmpty(
-                properties,
-                "system_enableScarf",
-                applicationProperties.getSystem().isScarfEnabled());
 
         // Capture UI properties
+        addIfNotEmpty(properties, "ui_appName", applicationProperties.getUi().getAppName());
+        addIfNotEmpty(
+                properties,
+                "ui_homeDescription",
+                applicationProperties.getUi().getHomeDescription());
         addIfNotEmpty(
                 properties, "ui_appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
 
         // Capture Metrics properties
         addIfNotEmpty(
-                properties, "metrics_enabled", applicationProperties.getMetrics().isEnabled());
+                properties, "metrics_enabled", applicationProperties.getMetrics().getEnabled());
 
         // Capture EnterpriseEdition properties
         addIfNotEmpty(
@@ -397,7 +397,7 @@ public class PostHogService {
                 if (hardwareAddress != null) {
                     String[] hexadecimal = new String[hardwareAddress.length];
                     for (int i = 0; i < hardwareAddress.length; i++) {
-                        hexadecimal[i] = String.format("%02X", hardwareAddress[i]);
+                        hexadecimal[i] = String.format(Locale.ROOT, "%02X", hardwareAddress[i]);
                     }
                     return String.join("-", hexadecimal);
                 }

app/common/src/main/java/stirling/software/common/service/UserServiceInterface.java

@@ -6,8 +6,4 @@ public interface UserServiceInterface {
     String getCurrentUsername();
 
     long getTotalUsersCount();
-
-    boolean isCurrentUserAdmin();
-
-    boolean isCurrentUserFirstLogin();
 }

app/common/src/main/java/stirling/software/common/util/AppArgsCapture.java

@@ -1,29 +0,0 @@
-package stirling.software.common.util;
-
-import java.util.List;
-import java.util.concurrent.atomic.AtomicReference;
-
-import org.springframework.boot.ApplicationArguments;
-import org.springframework.boot.ApplicationRunner;
-import org.springframework.stereotype.Component;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Captures application command-line arguments at startup so they can be reused for restart
- * operations. This allows the application to restart with the same configuration.
- */
-@Slf4j
-@Component
-public class AppArgsCapture implements ApplicationRunner {
-
-    public static final AtomicReference<List<String>> APP_ARGS = new AtomicReference<>(List.of());
-
-    @Override
-    public void run(ApplicationArguments args) {
-        APP_ARGS.set(List.of(args.getSourceArgs()));
-        log.debug(
-                "Captured {} application arguments for restart capability",
-                args.getSourceArgs().length);
-    }
-}

app/common/src/main/java/stirling/software/common/util/CbrUtils.java

@@ -59,24 +59,31 @@ public class CbrUtils {
                     log.warn(
                             "Failed to open CBR/RAR archive due to corrupt header: {}",
                             e.getMessage());
-                    throw ExceptionUtils.createCbrInvalidFormatException(null);
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.invalidFormat",
+                            "Invalid or corrupted CBR/RAR archive. The file may be corrupted, use"
+                                    + " an unsupported RAR format (RAR5+), or may not be a valid RAR"
+                                    + " archive. Please ensure the file is a valid RAR archive.");
                 } catch (RarException e) {
                     log.warn("Failed to open CBR/RAR archive: {}", e.getMessage());
+                    String errorMessage;
                     String exMessage = e.getMessage() != null ? e.getMessage() : "";
 
                     if (exMessage.contains("encrypted")) {
-                        throw ExceptionUtils.createCbrEncryptedException();
+                        errorMessage = "Encrypted CBR/RAR archives are not supported.";
                     } else if (exMessage.isEmpty()) {
-                        throw ExceptionUtils.createCbrInvalidFormatException(
+                        errorMessage =
                                 "Invalid CBR/RAR archive. The file may be encrypted, corrupted, or"
-                                        + " use an unsupported format.");
+                                        + " use an unsupported format.";
                     } else {
-                        throw ExceptionUtils.createCbrInvalidFormatException(
+                        errorMessage =
                                 "Invalid CBR/RAR archive: "
                                         + exMessage
                                         + ". The file may be encrypted, corrupted, or use an"
-                                        + " unsupported format.");
+                                        + " unsupported format.";
                     }
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.invalidFormat", errorMessage);
                 } catch (IOException e) {
                     log.warn("IO error reading CBR/RAR archive: {}", e.getMessage());
                     throw ExceptionUtils.createFileProcessingException("CBR extraction", e);
@@ -165,17 +172,17 @@ public class CbrUtils {
 
     private void validateCbrFile(MultipartFile file) {
         if (file == null || file.isEmpty()) {
-            throw ExceptionUtils.createFileNullOrEmptyException();
+            throw new IllegalArgumentException("File cannot be null or empty");
         }
 
         String filename = file.getOriginalFilename();
         if (filename == null) {
-            throw ExceptionUtils.createFileNoNameException();
+            throw new IllegalArgumentException("File must have a name");
         }
 
         String extension = FilenameUtils.getExtension(filename).toLowerCase(Locale.ROOT);
         if (!"cbr".equals(extension) && !"rar".equals(extension)) {
-            throw ExceptionUtils.createNotCbrFileException();
+            throw new IllegalArgumentException("File must be a CBR or RAR archive");
         }
     }
 

app/common/src/main/java/stirling/software/common/util/CbzUtils.java

@@ -56,10 +56,10 @@ public class CbzUtils {
                                     new java.io.FileInputStream(tempFile.getFile()));
                     ZipInputStream zis = new ZipInputStream(bis)) {
                 if (zis.getNextEntry() == null) {
-                    throw ExceptionUtils.createCbzEmptyException();
+                    throw new IllegalArgumentException("Archive is empty or invalid ZIP");
                 }
             } catch (IOException e) {
-                throw ExceptionUtils.createCbzInvalidFormatException(e);
+                throw new IllegalArgumentException("Invalid CBZ/ZIP archive", e);
             }
 
             try (PDDocument document = pdfDocumentFactory.createNewDocument();
@@ -84,7 +84,7 @@ public class CbzUtils {
                         Comparator.comparing(ImageEntryData::name, new NaturalOrderComparator()));
 
                 if (imageEntries.isEmpty()) {
-                    throw ExceptionUtils.createCbzNoImagesException();
+                    throw new IllegalArgumentException("No valid images found in the CBZ file");
                 }
 
                 for (ImageEntryData imageEntry : imageEntries) {
@@ -107,7 +107,8 @@ public class CbzUtils {
                 }
 
                 if (document.getNumberOfPages() == 0) {
-                    throw ExceptionUtils.createCbzCorruptedImagesException();
+                    throw new IllegalArgumentException(
+                            "No images could be processed from the CBZ file");
                 }
                 ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 document.save(baos);
@@ -129,17 +130,17 @@ public class CbzUtils {
 
     private void validateCbzFile(MultipartFile file) {
         if (file == null || file.isEmpty()) {
-            throw ExceptionUtils.createFileNullOrEmptyException();
+            throw new IllegalArgumentException("File cannot be null or empty");
         }
 
         String filename = file.getOriginalFilename();
         if (filename == null) {
-            throw ExceptionUtils.createFileNoNameException();
+            throw new IllegalArgumentException("File must have a name");
         }
 
         String extension = FilenameUtils.getExtension(filename).toLowerCase(Locale.ROOT);
         if (!"cbz".equals(extension) && !"zip".equals(extension)) {
-            throw ExceptionUtils.createNotCbzFileException();
+            throw new IllegalArgumentException("File must be a CBZ or ZIP archive");
         }
     }
 

app/common/src/main/java/stirling/software/common/util/CustomHtmlSanitizer.java

@@ -62,7 +62,8 @@ public class CustomHtmlSanitizer {
                     .and(new HtmlPolicyBuilder().disallowElements("noscript").toFactory());
 
     public String sanitize(String html) {
-        boolean disableSanitize = applicationProperties.getSystem().isDisableSanitize();
+        boolean disableSanitize =
+                Boolean.TRUE.equals(applicationProperties.getSystem().getDisableSanitize());
         return disableSanitize ? html : POLICY.sanitize(html);
     }
 }

app/common/src/main/java/stirling/software/common/util/EmlProcessingUtils.java

@@ -48,11 +48,11 @@ public class EmlProcessingUtils {
 
     public static void validateEmlInput(byte[] emlBytes) {
         if (emlBytes == null || emlBytes.length == 0) {
-            throw ExceptionUtils.createEmlEmptyException();
+            throw new IllegalArgumentException("EML file is empty or null");
         }
 
         if (isInvalidEmlFormat(emlBytes)) {
-            throw ExceptionUtils.createEmlInvalidFormatException();
+            throw new IllegalArgumentException("Invalid EML file format");
         }
     }
 

app/common/src/main/java/stirling/software/common/util/FileToPdf.java

@@ -5,8 +5,11 @@ import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.UncheckedIOException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.SimpleFileVisitor;
+import java.nio.file.attribute.BasicFileAttributes;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
@@ -145,6 +148,64 @@ public class FileToPdf {
         }
     }
 
+    private static void deleteDirectory(Path dir) throws IOException {
+        Files.walkFileTree(
+                dir,
+                new SimpleFileVisitor<Path>() {
+                    @Override
+                    public FileVisitResult visitFile(Path file, BasicFileAttributes attrs)
+                            throws IOException {
+                        Files.delete(file);
+                        return FileVisitResult.CONTINUE;
+                    }
+
+                    @Override
+                    public FileVisitResult postVisitDirectory(Path dir, IOException exc)
+                            throws IOException {
+                        Files.delete(dir);
+                        return FileVisitResult.CONTINUE;
+                    }
+                });
+    }
+
+    private static Path unzipAndGetMainHtml(byte[] fileBytes) throws IOException {
+        Path tempDirectory = Files.createTempDirectory("unzipped_");
+        try (ZipInputStream zipIn =
+                ZipSecurity.createHardenedInputStream(new ByteArrayInputStream(fileBytes))) {
+            ZipEntry entry = zipIn.getNextEntry();
+            while (entry != null) {
+                Path filePath = tempDirectory.resolve(sanitizeZipFilename(entry.getName()));
+                if (entry.isDirectory()) {
+                    Files.createDirectories(filePath); // Explicitly create the directory structure
+                } else {
+                    Files.createDirectories(
+                            filePath.getParent()); // Create parent directories if they don't exist
+                    Files.copy(zipIn, filePath);
+                }
+                zipIn.closeEntry();
+                entry = zipIn.getNextEntry();
+            }
+        }
+
+        // Search for the main HTML file.
+        try (Stream<Path> walk = Files.walk(tempDirectory)) {
+            List<Path> htmlFiles = walk.filter(file -> file.toString().endsWith(".html")).toList();
+
+            if (htmlFiles.isEmpty()) {
+                throw new IOException("No HTML files found in the unzipped directory.");
+            }
+
+            // Prioritize 'index.html' if it exists, otherwise use the first .html file
+            for (Path htmlFile : htmlFiles) {
+                if ("index.html".equals(htmlFile.getFileName().toString())) {
+                    return htmlFile;
+                }
+            }
+
+            return htmlFiles.get(0);
+        }
+    }
+
     static String sanitizeZipFilename(String entryName) {
         if (entryName == null || entryName.trim().isEmpty()) {
             return "";

app/common/src/main/java/stirling/software/common/util/FormUtils.java

@@ -0,0 +1,658 @@
+package stirling.software.common.util;
+
+import java.io.IOException;
+import java.lang.reflect.Method;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.PDResources;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDType1Font;
+import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
+import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
+import org.apache.pdfbox.pdmodel.interactive.form.*;
+
+import lombok.extern.slf4j.Slf4j;
+
+@Slf4j
+public final class FormUtils {
+
+    private FormUtils() {}
+
+    public static boolean hasAnyRotatedPage(PDDocument document) {
+        try {
+            for (PDPage page : document.getPages()) {
+                int rot = page.getRotation();
+                int norm = ((rot % 360) + 360) % 360;
+                if (norm != 0) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to inspect page rotations: {}", e.getMessage(), e);
+        }
+        return false;
+    }
+
+    public static void copyAndTransformFormFields(
+            PDDocument sourceDocument,
+            PDDocument newDocument,
+            int totalPages,
+            int pagesPerSheet,
+            int cols,
+            int rows,
+            float cellWidth,
+            float cellHeight)
+            throws IOException {
+
+        PDDocumentCatalog sourceCatalog = sourceDocument.getDocumentCatalog();
+        PDAcroForm sourceAcroForm = sourceCatalog.getAcroForm();
+
+        if (sourceAcroForm == null || sourceAcroForm.getFields().isEmpty()) {
+            return;
+        }
+
+        PDDocumentCatalog newCatalog = newDocument.getDocumentCatalog();
+        PDAcroForm newAcroForm = new PDAcroForm(newDocument);
+        newCatalog.setAcroForm(newAcroForm);
+
+        PDResources dr = new PDResources();
+        PDType1Font helvetica = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+        PDType1Font zapfDingbats = new PDType1Font(Standard14Fonts.FontName.ZAPF_DINGBATS);
+        dr.put(COSName.getPDFName("Helv"), helvetica);
+        dr.put(COSName.getPDFName("ZaDb"), zapfDingbats);
+        newAcroForm.setDefaultResources(dr);
+        newAcroForm.setDefaultAppearance("/Helv 12 Tf 0 g");
+
+        // Do not mutate the source AcroForm; skip bad widgets during copy
+        newAcroForm.setNeedAppearances(true);
+
+        Map<String, Integer> fieldNameCounters = new HashMap<>();
+
+        // Build widget -> field map once for efficient lookups
+        Map<PDAnnotationWidget, PDField> widgetFieldMap = buildWidgetFieldMap(sourceAcroForm);
+
+        for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
+            PDPage sourcePage = sourceDocument.getPage(pageIndex);
+            List<PDAnnotation> annotations = sourcePage.getAnnotations();
+
+            if (annotations.isEmpty()) {
+                continue;
+            }
+
+            int destinationPageIndex = pageIndex / pagesPerSheet;
+            int adjustedPageIndex = pageIndex % pagesPerSheet;
+            int rowIndex = adjustedPageIndex / cols;
+            int colIndex = adjustedPageIndex % cols;
+
+            if (destinationPageIndex >= newDocument.getNumberOfPages()) {
+                continue;
+            }
+
+            PDPage destinationPage = newDocument.getPage(destinationPageIndex);
+            PDRectangle sourceRect = sourcePage.getMediaBox();
+
+            float scaleWidth = cellWidth / sourceRect.getWidth();
+            float scaleHeight = cellHeight / sourceRect.getHeight();
+            float scale = Math.min(scaleWidth, scaleHeight);
+
+            float x = colIndex * cellWidth + (cellWidth - sourceRect.getWidth() * scale) / 2;
+            float y =
+                    destinationPage.getMediaBox().getHeight()
+                            - ((rowIndex + 1) * cellHeight
+                                    - (cellHeight - sourceRect.getHeight() * scale) / 2);
+
+            copyBasicFormFields(
+                    sourceAcroForm,
+                    newAcroForm,
+                    sourcePage,
+                    destinationPage,
+                    x,
+                    y,
+                    scale,
+                    pageIndex,
+                    fieldNameCounters,
+                    widgetFieldMap);
+        }
+
+        // Refresh appearances to ensure widgets render correctly across viewers
+        try {
+            // Use reflection to avoid compile-time dependency on PDFBox version
+            Method m = newAcroForm.getClass().getMethod("refreshAppearances");
+            m.invoke(newAcroForm);
+        } catch (NoSuchMethodException nsme) {
+            log.warn(
+                    "AcroForm.refreshAppearances() not available in this PDFBox version; relying on NeedAppearances.");
+        } catch (Throwable t) {
+            log.warn("Failed to refresh field appearances via AcroForm: {}", t.getMessage(), t);
+        }
+    }
+
+    private static void copyBasicFormFields(
+            PDAcroForm sourceAcroForm,
+            PDAcroForm newAcroForm,
+            PDPage sourcePage,
+            PDPage destinationPage,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters,
+            Map<PDAnnotationWidget, PDField> widgetFieldMap) {
+
+        try {
+            List<PDAnnotation> sourceAnnotations = sourcePage.getAnnotations();
+            List<PDAnnotation> destinationAnnotations = destinationPage.getAnnotations();
+
+            for (PDAnnotation annotation : sourceAnnotations) {
+                if (annotation instanceof PDAnnotationWidget widgetAnnotation) {
+                    if (widgetAnnotation.getRectangle() == null) {
+                        continue;
+                    }
+                    PDField sourceField =
+                            widgetFieldMap != null ? widgetFieldMap.get(widgetAnnotation) : null;
+                    if (sourceField == null) {
+                        continue; // skip widgets without a matching field
+                    }
+                    if (sourceField instanceof PDTextField pdtextfield) {
+                        createSimpleTextField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdtextfield,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    } else if (sourceField instanceof PDCheckBox pdCheckBox) {
+                        createSimpleCheckBoxField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdCheckBox,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    } else if (sourceField instanceof PDRadioButton pdRadioButton) {
+                        createSimpleRadioButtonField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdRadioButton,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    } else if (sourceField instanceof PDComboBox pdComboBox) {
+                        createSimpleComboBoxField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdComboBox,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    } else if (sourceField instanceof PDListBox pdlistbox) {
+                        createSimpleListBoxField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdlistbox,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    } else if (sourceField instanceof PDSignatureField pdSignatureField) {
+                        createSimpleSignatureField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdSignatureField,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    } else if (sourceField instanceof PDPushButton pdPushButton) {
+                        createSimplePushButtonField(
+                                newAcroForm,
+                                destinationPage,
+                                destinationAnnotations,
+                                pdPushButton,
+                                widgetAnnotation,
+                                offsetX,
+                                offsetY,
+                                scale,
+                                pageIndex,
+                                fieldNameCounters);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to copy basic form fields for page {}: {}",
+                    pageIndex,
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimpleTextField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDTextField sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDTextField newTextField = new PDTextField(newAcroForm);
+            newTextField.setDefaultAppearance("/Helv 12 Tf 0 g");
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newTextField,
+                            sourceField.getPartialName(),
+                            "textField",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+
+            if (sourceField.getValueAsString() != null) {
+                newTextField.setValue(sourceField.getValueAsString());
+            }
+
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create text field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimpleCheckBoxField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDCheckBox sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDCheckBox newCheckBox = new PDCheckBox(newAcroForm);
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newCheckBox,
+                            sourceField.getPartialName(),
+                            "checkBox",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+
+            if (sourceField.isChecked()) {
+                newCheckBox.check();
+            } else {
+                newCheckBox.unCheck();
+            }
+
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create checkbox field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimpleRadioButtonField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDRadioButton sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDRadioButton newRadioButton = new PDRadioButton(newAcroForm);
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newRadioButton,
+                            sourceField.getPartialName(),
+                            "radioButton",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+
+            if (sourceField.getExportValues() != null) {
+                newRadioButton.setExportValues(sourceField.getExportValues());
+            }
+            if (sourceField.getValue() != null) {
+                newRadioButton.setValue(sourceField.getValue());
+            }
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create radio button field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimpleComboBoxField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDComboBox sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDComboBox newComboBox = new PDComboBox(newAcroForm);
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newComboBox,
+                            sourceField.getPartialName(),
+                            "comboBox",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+
+            if (sourceField.getOptions() != null) {
+                newComboBox.setOptions(sourceField.getOptions());
+            }
+            if (sourceField.getValue() != null && !sourceField.getValue().isEmpty()) {
+                newComboBox.setValue(sourceField.getValue());
+            }
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create combo box field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimpleListBoxField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDListBox sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDListBox newListBox = new PDListBox(newAcroForm);
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newListBox,
+                            sourceField.getPartialName(),
+                            "listBox",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+
+            if (sourceField.getOptions() != null) {
+                newListBox.setOptions(sourceField.getOptions());
+            }
+            if (sourceField.getValue() != null && !sourceField.getValue().isEmpty()) {
+                newListBox.setValue(sourceField.getValue());
+            }
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create list box field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimpleSignatureField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDSignatureField sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDSignatureField newSignatureField = new PDSignatureField(newAcroForm);
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newSignatureField,
+                            sourceField.getPartialName(),
+                            "signature",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+            if (!initialized) {
+                return;
+            }
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create signature field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static void createSimplePushButtonField(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            PDPushButton sourceField,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        try {
+            PDPushButton newPushButton = new PDPushButton(newAcroForm);
+
+            boolean initialized =
+                    initializeFieldWithWidget(
+                            newAcroForm,
+                            destinationPage,
+                            destinationAnnotations,
+                            newPushButton,
+                            sourceField.getPartialName(),
+                            "pushButton",
+                            sourceWidget,
+                            offsetX,
+                            offsetY,
+                            scale,
+                            pageIndex,
+                            fieldNameCounters);
+
+        } catch (Exception e) {
+            log.warn(
+                    "Failed to create push button field '{}': {}",
+                    sourceField.getPartialName(),
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    private static <T extends PDTerminalField> boolean initializeFieldWithWidget(
+            PDAcroForm newAcroForm,
+            PDPage destinationPage,
+            List<PDAnnotation> destinationAnnotations,
+            T newField,
+            String originalName,
+            String fallbackName,
+            PDAnnotationWidget sourceWidget,
+            float offsetX,
+            float offsetY,
+            float scale,
+            int pageIndex,
+            Map<String, Integer> fieldNameCounters) {
+
+        String baseName = (originalName != null) ? originalName : fallbackName;
+        String newFieldName = generateUniqueFieldName(baseName, pageIndex, fieldNameCounters);
+        newField.setPartialName(newFieldName);
+
+        PDAnnotationWidget newWidget = new PDAnnotationWidget();
+        PDRectangle sourceRect = sourceWidget.getRectangle();
+        if (sourceRect == null) {
+            return false;
+        }
+
+        float newX = (sourceRect.getLowerLeftX() * scale) + offsetX;
+        float newY = (sourceRect.getLowerLeftY() * scale) + offsetY;
+        float newWidth = sourceRect.getWidth() * scale;
+        float newHeight = sourceRect.getHeight() * scale;
+        newWidget.setRectangle(new PDRectangle(newX, newY, newWidth, newHeight));
+        newWidget.setPage(destinationPage);
+
+        newField.getWidgets().add(newWidget);
+        newWidget.setParent(newField);
+        newAcroForm.getFields().add(newField);
+        destinationAnnotations.add(newWidget);
+        return true;
+    }
+
+    private static String generateUniqueFieldName(
+            String originalName, int pageIndex, Map<String, Integer> fieldNameCounters) {
+        String baseName = "page" + pageIndex + "_" + originalName;
+
+        Integer counter = fieldNameCounters.get(baseName);
+        if (counter == null) {
+            counter = 0;
+        } else {
+            counter++;
+        }
+        fieldNameCounters.put(baseName, counter);
+
+        return counter == 0 ? baseName : baseName + "_" + counter;
+    }
+
+    private static Map<PDAnnotationWidget, PDField> buildWidgetFieldMap(PDAcroForm acroForm) {
+        Map<PDAnnotationWidget, PDField> map = new HashMap<>();
+        if (acroForm == null) {
+            return map;
+        }
+        try {
+            for (PDField field : acroForm.getFieldTree()) {
+                List<PDAnnotationWidget> widgets = field.getWidgets();
+                if (widgets != null) {
+                    for (PDAnnotationWidget w : widgets) {
+                        if (w != null) {
+                            map.put(w, field);
+                        }
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to build widget->field map: {}", e.getMessage(), e);
+        }
+        return map;
+    }
+}

app/common/src/main/java/stirling/software/common/util/GeneralFormCopyUtils.java

@@ -1,350 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDResources;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.font.PDType1Font;
-import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
-import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
-import org.apache.pdfbox.pdmodel.interactive.form.PDField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDTerminalField;
-
-import lombok.experimental.UtilityClass;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Utility class for copying and transforming PDF form fields during page operations. Used by
- * multi-page layout and other page manipulation operations that need to preserve form fields.
- */
-@Slf4j
-@UtilityClass
-public class GeneralFormCopyUtils {
-
-    public boolean hasAnyRotatedPage(PDDocument document) {
-        try {
-            for (PDPage page : document.getPages()) {
-                int rot = page.getRotation();
-                int norm = ((rot % 360) + 360) % 360;
-                if (norm != 0) {
-                    return true;
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to inspect page rotations: {}", e.getMessage(), e);
-        }
-        return false;
-    }
-
-    public void copyAndTransformFormFields(
-            PDDocument sourceDocument,
-            PDDocument newDocument,
-            int totalPages,
-            int pagesPerSheet,
-            int cols,
-            int rows,
-            float cellWidth,
-            float cellHeight)
-            throws IOException {
-
-        PDDocumentCatalog sourceCatalog = sourceDocument.getDocumentCatalog();
-        PDAcroForm sourceAcroForm = sourceCatalog.getAcroForm();
-
-        if (sourceAcroForm == null || sourceAcroForm.getFields().isEmpty()) {
-            return;
-        }
-
-        PDDocumentCatalog newCatalog = newDocument.getDocumentCatalog();
-        PDAcroForm newAcroForm = new PDAcroForm(newDocument);
-        newCatalog.setAcroForm(newAcroForm);
-
-        PDResources dr = new PDResources();
-        PDType1Font helvetica = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
-        PDType1Font zapfDingbats = new PDType1Font(Standard14Fonts.FontName.ZAPF_DINGBATS);
-        dr.put(COSName.getPDFName("Helv"), helvetica);
-        dr.put(COSName.getPDFName("ZaDb"), zapfDingbats);
-        newAcroForm.setDefaultResources(dr);
-        newAcroForm.setDefaultAppearance("/Helv 12 Tf 0 g");
-
-        // Temporarily set NeedAppearances to true during field creation
-        newAcroForm.setNeedAppearances(true);
-
-        Map<String, Integer> fieldNameCounters = new HashMap<>();
-
-        // Build widget -> field map once for efficient lookups
-        Map<PDAnnotationWidget, PDField> widgetFieldMap = buildWidgetFieldMap(sourceAcroForm);
-
-        for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-            PDPage sourcePage = sourceDocument.getPage(pageIndex);
-            List<PDAnnotation> annotations = sourcePage.getAnnotations();
-
-            if (annotations.isEmpty()) {
-                continue;
-            }
-
-            int destinationPageIndex = pageIndex / pagesPerSheet;
-            int adjustedPageIndex = pageIndex % pagesPerSheet;
-            int rowIndex = adjustedPageIndex / cols;
-            int colIndex = adjustedPageIndex % cols;
-
-            if (rowIndex >= rows) {
-                continue;
-            }
-
-            if (destinationPageIndex >= newDocument.getNumberOfPages()) {
-                continue;
-            }
-
-            PDPage destinationPage = newDocument.getPage(destinationPageIndex);
-            PDRectangle sourceRect = sourcePage.getMediaBox();
-
-            float scaleWidth = cellWidth / sourceRect.getWidth();
-            float scaleHeight = cellHeight / sourceRect.getHeight();
-            float scale = Math.min(scaleWidth, scaleHeight);
-
-            float x = colIndex * cellWidth + (cellWidth - sourceRect.getWidth() * scale) / 2;
-            float y =
-                    destinationPage.getMediaBox().getHeight()
-                            - ((rowIndex + 1) * cellHeight
-                                    - (cellHeight - sourceRect.getHeight() * scale) / 2);
-
-            copyBasicFormFields(
-                    sourceAcroForm,
-                    newAcroForm,
-                    sourcePage,
-                    destinationPage,
-                    x,
-                    y,
-                    scale,
-                    pageIndex,
-                    fieldNameCounters,
-                    widgetFieldMap);
-        }
-
-        // Generate appearance streams and embed them authoritatively
-        boolean appearancesGenerated = false;
-        try {
-            newAcroForm.refreshAppearances();
-            appearancesGenerated = true;
-        } catch (NoSuchMethodError nsme) {
-            log.warn(
-                    "AcroForm.refreshAppearances() not available in this PDFBox version; "
-                            + "leaving NeedAppearances=true for viewer-side rendering.");
-        } catch (Exception t) {
-            log.warn(
-                    "Failed to refresh field appearances via AcroForm: {}. "
-                            + "Leaving NeedAppearances=true as fallback.",
-                    t.getMessage(),
-                    t);
-        }
-
-        // After successful appearance generation, set NeedAppearances to false
-        // to signal that appearance streams are now embedded authoritatively
-        if (appearancesGenerated) {
-            try {
-                newAcroForm.setNeedAppearances(false);
-            } catch (Exception e) {
-                log.debug(
-                        "Failed to set NeedAppearances to false: {}. "
-                                + "Appearances were generated but flag could not be updated.",
-                        e.getMessage());
-            }
-        }
-    }
-
-    private void copyBasicFormFields(
-            PDAcroForm sourceAcroForm,
-            PDAcroForm newAcroForm,
-            PDPage sourcePage,
-            PDPage destinationPage,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters,
-            Map<PDAnnotationWidget, PDField> widgetFieldMap) {
-
-        try {
-            List<PDAnnotation> sourceAnnotations = sourcePage.getAnnotations();
-            List<PDAnnotation> destinationAnnotations = destinationPage.getAnnotations();
-
-            for (PDAnnotation annotation : sourceAnnotations) {
-                if (annotation instanceof PDAnnotationWidget widgetAnnotation) {
-                    if (widgetAnnotation.getRectangle() == null) {
-                        continue;
-                    }
-                    PDField sourceField =
-                            widgetFieldMap != null ? widgetFieldMap.get(widgetAnnotation) : null;
-                    if (sourceField == null) {
-                        continue; // skip widgets without a matching field
-                    }
-                    if (!(sourceField instanceof PDTerminalField terminalField)) {
-                        continue;
-                    }
-
-                    GeneralFormFieldTypeSupport handler =
-                            GeneralFormFieldTypeSupport.forField(terminalField);
-                    if (handler == null) {
-                        log.debug(
-                                "Skipping unsupported field type '{}' for widget '{}'",
-                                sourceField.getClass().getSimpleName(),
-                                Optional.ofNullable(sourceField.getFullyQualifiedName())
-                                        .orElseGet(sourceField::getPartialName));
-                        continue;
-                    }
-
-                    copyFieldUsingHandler(
-                            handler,
-                            terminalField,
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            widgetAnnotation,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-                }
-            }
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to copy basic form fields for page {}: {}",
-                    pageIndex,
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private void copyFieldUsingHandler(
-            GeneralFormFieldTypeSupport handler,
-            PDTerminalField sourceField,
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        try {
-            PDTerminalField newField = handler.createField(newAcroForm);
-            boolean initialized =
-                    initializeFieldWithWidget(
-                            newAcroForm,
-                            destinationPage,
-                            destinationAnnotations,
-                            newField,
-                            sourceField.getPartialName(),
-                            handler.fallbackWidgetName(),
-                            sourceWidget,
-                            offsetX,
-                            offsetY,
-                            scale,
-                            pageIndex,
-                            fieldNameCounters);
-
-            if (!initialized) {
-                return;
-            }
-
-            handler.copyFromOriginal(sourceField, newField);
-        } catch (Exception e) {
-            log.warn(
-                    "Failed to copy {} field '{}': {}",
-                    handler.typeName(),
-                    Optional.ofNullable(sourceField.getFullyQualifiedName())
-                            .orElseGet(sourceField::getPartialName),
-                    e.getMessage(),
-                    e);
-        }
-    }
-
-    private <T extends PDTerminalField> boolean initializeFieldWithWidget(
-            PDAcroForm newAcroForm,
-            PDPage destinationPage,
-            List<PDAnnotation> destinationAnnotations,
-            T newField,
-            String originalName,
-            String fallbackName,
-            PDAnnotationWidget sourceWidget,
-            float offsetX,
-            float offsetY,
-            float scale,
-            int pageIndex,
-            Map<String, Integer> fieldNameCounters) {
-
-        String baseName = (originalName != null) ? originalName : fallbackName;
-        String newFieldName = generateUniqueFieldName(baseName, pageIndex, fieldNameCounters);
-        newField.setPartialName(newFieldName);
-
-        PDAnnotationWidget newWidget = new PDAnnotationWidget();
-        PDRectangle sourceRect = sourceWidget.getRectangle();
-        if (sourceRect == null) {
-            return false;
-        }
-
-        float newX = (sourceRect.getLowerLeftX() * scale) + offsetX;
-        float newY = (sourceRect.getLowerLeftY() * scale) + offsetY;
-        float newWidth = sourceRect.getWidth() * scale;
-        float newHeight = sourceRect.getHeight() * scale;
-        newWidget.setRectangle(new PDRectangle(newX, newY, newWidth, newHeight));
-        newWidget.setPage(destinationPage);
-
-        newField.getWidgets().add(newWidget);
-        newWidget.setParent(newField);
-        newAcroForm.getFields().add(newField);
-        destinationAnnotations.add(newWidget);
-        return true;
-    }
-
-    private String generateUniqueFieldName(
-            String originalName, int pageIndex, Map<String, Integer> fieldNameCounters) {
-        String baseName = "page" + pageIndex + "_" + originalName;
-
-        Integer counter = fieldNameCounters.get(baseName);
-        if (counter == null) {
-            counter = 0;
-        } else {
-            counter++;
-        }
-        fieldNameCounters.put(baseName, counter);
-
-        return counter == 0 ? baseName : baseName + "_" + counter;
-    }
-
-    private Map<PDAnnotationWidget, PDField> buildWidgetFieldMap(PDAcroForm acroForm) {
-        Map<PDAnnotationWidget, PDField> map = new HashMap<>();
-        if (acroForm == null) {
-            return map;
-        }
-        try {
-            for (PDField field : acroForm.getFieldTree()) {
-                List<PDAnnotationWidget> widgets = field.getWidgets();
-                if (widgets == null) {
-                    continue;
-                }
-                for (PDAnnotationWidget widget : widgets) {
-                    if (widget != null) {
-                        map.put(widget, field);
-                    }
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Failed to build widget->field map: {}", e.getMessage(), e);
-        }
-        return map;
-    }
-}

app/common/src/main/java/stirling/software/common/util/GeneralFormFieldTypeSupport.java

@@ -1,165 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-
-import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
-import org.apache.pdfbox.pdmodel.interactive.form.PDCheckBox;
-import org.apache.pdfbox.pdmodel.interactive.form.PDComboBox;
-import org.apache.pdfbox.pdmodel.interactive.form.PDField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDListBox;
-import org.apache.pdfbox.pdmodel.interactive.form.PDPushButton;
-import org.apache.pdfbox.pdmodel.interactive.form.PDRadioButton;
-import org.apache.pdfbox.pdmodel.interactive.form.PDSignatureField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDTerminalField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDTextField;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Simplified form field type support for general PDF operations. This is a subset of the full
- * proprietary FormFieldTypeSupport, containing only what's needed for basic form field copying
- * during page operations.
- */
-@Slf4j
-public enum GeneralFormFieldTypeSupport {
-    TEXT("text", "textField", PDTextField.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            PDTextField textField = new PDTextField(acroForm);
-            textField.setDefaultAppearance("/Helv 12 Tf 0 g");
-            return textField;
-        }
-
-        @Override
-        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
-            PDTextField src = (PDTextField) source;
-            PDTextField dst = (PDTextField) target;
-            String value = src.getValueAsString();
-            if (value != null) {
-                dst.setValue(value);
-            }
-        }
-    },
-    CHECKBOX("checkbox", "checkBox", PDCheckBox.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            return new PDCheckBox(acroForm);
-        }
-
-        @Override
-        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
-            PDCheckBox src = (PDCheckBox) source;
-            PDCheckBox dst = (PDCheckBox) target;
-            if (src.isChecked()) {
-                dst.check();
-            } else {
-                dst.unCheck();
-            }
-        }
-    },
-    RADIO("radio", "radioButton", PDRadioButton.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            return new PDRadioButton(acroForm);
-        }
-
-        @Override
-        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
-            PDRadioButton src = (PDRadioButton) source;
-            PDRadioButton dst = (PDRadioButton) target;
-            if (src.getExportValues() != null) {
-                dst.setExportValues(src.getExportValues());
-            }
-            if (src.getValue() != null) {
-                dst.setValue(src.getValue());
-            }
-        }
-    },
-    COMBOBOX("combobox", "comboBox", PDComboBox.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            return new PDComboBox(acroForm);
-        }
-
-        @Override
-        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
-            PDComboBox src = (PDComboBox) source;
-            PDComboBox dst = (PDComboBox) target;
-            if (src.getOptions() != null) {
-                dst.setOptions(src.getOptions());
-            }
-            if (src.getValue() != null && !src.getValue().isEmpty()) {
-                dst.setValue(src.getValue());
-            }
-        }
-    },
-    LISTBOX("listbox", "listBox", PDListBox.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            return new PDListBox(acroForm);
-        }
-
-        @Override
-        void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
-            PDListBox src = (PDListBox) source;
-            PDListBox dst = (PDListBox) target;
-            if (src.getOptions() != null) {
-                dst.setOptions(src.getOptions());
-            }
-            if (src.getValue() != null && !src.getValue().isEmpty()) {
-                dst.setValue(src.getValue());
-            }
-        }
-    },
-    SIGNATURE("signature", "signature", PDSignatureField.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            return new PDSignatureField(acroForm);
-        }
-    },
-    BUTTON("button", "pushButton", PDPushButton.class) {
-        @Override
-        PDTerminalField createField(PDAcroForm acroForm) {
-            return new PDPushButton(acroForm);
-        }
-    };
-
-    private final String typeName;
-    private final String fallbackWidgetName;
-    private final Class<? extends PDTerminalField> fieldClass;
-
-    GeneralFormFieldTypeSupport(
-            String typeName,
-            String fallbackWidgetName,
-            Class<? extends PDTerminalField> fieldClass) {
-        this.typeName = typeName;
-        this.fallbackWidgetName = fallbackWidgetName;
-        this.fieldClass = fieldClass;
-    }
-
-    public static GeneralFormFieldTypeSupport forField(PDField field) {
-        if (field == null) {
-            return null;
-        }
-        for (GeneralFormFieldTypeSupport handler : values()) {
-            if (handler.fieldClass.isInstance(field)) {
-                return handler;
-            }
-        }
-        return null;
-    }
-
-    String typeName() {
-        return typeName;
-    }
-
-    String fallbackWidgetName() {
-        return fallbackWidgetName;
-    }
-
-    abstract PDTerminalField createField(PDAcroForm acroForm);
-
-    void copyFromOriginal(PDTerminalField source, PDTerminalField target) throws IOException {
-        // default no-op
-    }
-}

app/common/src/main/java/stirling/software/common/util/GeneralUtils.java

@@ -43,7 +43,6 @@ public class GeneralUtils {
             Set.of(
                     "OCR images.json",
                     "Prepare-pdfs-for-email.json",
-                    "Pre-publish-sanitization.json",
                     "split-rotate-auto-rename.json");
 
     private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";
@@ -91,18 +90,36 @@ public class GeneralUtils {
             while ((bytesRead = inputStream.read(buffer)) != -1) {
                 outputStream.write(buffer, 0, bytesRead);
             }
-        } catch (IOException e) {
-            if (tempFile.exists()) {
-                try {
-                    Files.delete(tempFile.toPath());
-                } catch (IOException ignored) {
-                }
-            }
-            throw e;
         }
         return tempFile;
     }
 
+    /*
+     * Gets the configured temporary directory, creating it if necessary.
+     *
+     * @return Path to the temporary directory
+     * @throws IOException if directory creation fails
+     */
+    private Path getTempDirectory() throws IOException {
+        String customTempDir = System.getenv("STIRLING_TEMPFILES_DIRECTORY");
+        if (customTempDir == null || customTempDir.isEmpty()) {
+            customTempDir = System.getProperty("stirling.tempfiles.directory");
+        }
+
+        Path tempDir;
+        if (customTempDir != null && !customTempDir.isEmpty()) {
+            tempDir = Path.of(customTempDir);
+        } else {
+            tempDir = Path.of(System.getProperty("java.io.tmpdir"), "stirling-pdf");
+        }
+
+        if (!Files.exists(tempDir)) {
+            Files.createDirectories(tempDir);
+        }
+
+        return tempDir;
+    }
+
     /*
      * Remove file extension
      *
@@ -507,12 +524,6 @@ public class GeneralUtils {
             while ((bytesRead = in.read(buffer)) != -1) {
                 out.write(buffer, 0, bytesRead);
             }
-        } catch (IOException e) {
-            try {
-                Files.deleteIfExists(tempFile);
-            } catch (IOException ignored) {
-            }
-            throw e;
         }
         return tempFile.toFile();
     }
@@ -1089,29 +1100,17 @@ public class GeneralUtils {
                     ProcessExecutor.getInstance(ProcessExecutor.Processes.GHOSTSCRIPT)
                             .runCommandWithOutputHandling(command);
 
-            ExceptionUtils.GhostscriptException detectedError =
-                    ExceptionUtils.detectGhostscriptCriticalError(result.getMessages());
-            if (detectedError != null) {
-                log.warn(
-                        "Ghostscript ebook optimization reported a critical error: {}",
-                        detectedError.getMessage());
-                throw detectedError;
-            }
-
             if (result.getRc() != 0) {
                 log.warn(
                         "Ghostscript ebook optimization failed with return code: {}",
                         result.getRc());
-                throw ExceptionUtils.createGhostscriptCompressionException(result.getMessages());
+                throw ExceptionUtils.createGhostscriptCompressionException();
             }
 
             return Files.readAllBytes(tempOutput);
 
         } catch (Exception e) {
             log.warn("Ghostscript ebook optimization failed", e);
-            if (e instanceof ExceptionUtils.GhostscriptException ghostscriptException) {
-                throw ghostscriptException;
-            }
             throw ExceptionUtils.createGhostscriptCompressionException(e);
         } finally {
             if (tempInput != null) {

app/common/src/main/java/stirling/software/common/util/ImageProcessingUtils.java

@@ -63,16 +63,15 @@ public class ImageProcessingUtils {
         } else {
             int width = image.getWidth();
             int height = image.getHeight();
-            int[] pixels = new int[width * height];
-
-            image.getRGB(0, 0, width, height, pixels, 0, width);
-
             byte[] data = new byte[width * height * 3];
             int index = 0;
-            for (int rgb : pixels) {
-                data[index++] = (byte) ((rgb >> 16) & 0xFF); // Red
-                data[index++] = (byte) ((rgb >> 8) & 0xFF); // Green
-                data[index++] = (byte) (rgb & 0xFF); // Blue
+            for (int y = 0; y < height; y++) {
+                for (int x = 0; x < width; x++) {
+                    int rgb = image.getRGB(x, y);
+                    data[index++] = (byte) ((rgb >> 16) & 0xFF); // Red
+                    data[index++] = (byte) ((rgb >> 8) & 0xFF); // Green
+                    data[index++] = (byte) (rgb & 0xFF); // Blue
+                }
             }
             return data;
         }
@@ -145,7 +144,7 @@ public class ImageProcessingUtils {
         }
 
         if (image == null) {
-            throw ExceptionUtils.createImageReadException(filename);
+            throw new IOException("Unable to read image from file: " + filename);
         }
 
         double orientation = extractImageOrientation(file.getInputStream());

app/common/src/main/java/stirling/software/common/util/JarPathUtil.java

@@ -1,103 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.File;
-import java.net.URISyntaxException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-
-import lombok.extern.slf4j.Slf4j;
-
-/** Utility class to locate JAR files at runtime for restart operations */
-@Slf4j
-public class JarPathUtil {
-
-    /**
-     * Gets the path to the currently running JAR file
-     *
-     * @return Path to the current JAR, or null if not running from a JAR
-     */
-    public static Path currentJar() {
-        try {
-            Path jar =
-                    Paths.get(
-                                    JarPathUtil.class
-                                            .getProtectionDomain()
-                                            .getCodeSource()
-                                            .getLocation()
-                                            .toURI())
-                            .toAbsolutePath();
-
-            // Check if we're actually running from a JAR (not from IDE/classes directory)
-            if (jar.toString().endsWith(".jar")) {
-                log.debug("Current JAR located at: {}", jar);
-                return jar;
-            } else {
-                log.warn("Not running from JAR, current location: {}", jar);
-                return null;
-            }
-        } catch (URISyntaxException e) {
-            log.error("Failed to determine current JAR location", e);
-            return null;
-        }
-    }
-
-    /**
-     * Gets the path to the restart-helper.jar file. Checks multiple possible locations: 1. Same
-     * directory as the main JAR (production deployment) 2. ./build/libs/restart-helper.jar
-     * (development build) 3. app/common/build/libs/restart-helper.jar (multi-module build)
-     *
-     * @return Path to restart-helper.jar, or null if not found
-     */
-    public static Path restartHelperJar() {
-        Path appJar = currentJar();
-
-        // Define possible locations to check (in order of preference)
-        Path[] possibleLocations = new Path[4];
-
-        // Location 1: Same directory as main JAR (production)
-        if (appJar != null) {
-            possibleLocations[0] = appJar.getParent().resolve("restart-helper.jar");
-        }
-
-        // Location 2: ./build/libs/ (development build)
-        possibleLocations[1] = Paths.get("build", "libs", "restart-helper.jar").toAbsolutePath();
-
-        // Location 3: app/common/build/libs/ (multi-module build)
-        possibleLocations[2] =
-                Paths.get("app", "common", "build", "libs", "restart-helper.jar").toAbsolutePath();
-
-        // Location 4: Current working directory
-        possibleLocations[3] = Paths.get("restart-helper.jar").toAbsolutePath();
-
-        // Check each location
-        for (Path location : possibleLocations) {
-            if (location != null && Files.isRegularFile(location)) {
-                log.info("Restart helper JAR found at: {}", location);
-                return location;
-            } else if (location != null) {
-                log.debug("Restart helper JAR not found at: {}", location);
-            }
-        }
-
-        log.warn("Restart helper JAR not found in any expected location");
-        return null;
-    }
-
-    /**
-     * Gets the java binary path for the current JVM
-     *
-     * @return Path to java executable
-     */
-    public static String javaExecutable() {
-        String javaHome = System.getProperty("java.home");
-        String javaBin = javaHome + File.separator + "bin" + File.separator + "java";
-
-        // On Windows, add .exe extension
-        if (System.getProperty("os.name").toLowerCase().contains("win")) {
-            javaBin += ".exe";
-        }
-
-        return javaBin;
-    }
-}

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -1,18 +0,0 @@
-package stirling.software.common.util;
-
-/** Thread-local context for passing job ID across async boundaries */
-public class JobContext {
-    private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
-
-    public static void setJobId(String jobId) {
-        CURRENT_JOB_ID.set(jobId);
-    }
-
-    public static String getJobId() {
-        return CURRENT_JOB_ID.get();
-    }
-
-    public static void clear() {
-        CURRENT_JOB_ID.remove();
-    }
-}

app/common/src/main/java/stirling/software/common/util/PDFToFile.java

@@ -27,22 +27,15 @@ import io.github.pixee.security.Filenames;
 
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 
 @Slf4j
 public class PDFToFile {
 
     private final TempFileManager tempFileManager;
-    private final RuntimePathConfig runtimePathConfig;
 
     public PDFToFile(TempFileManager tempFileManager) {
-        this(tempFileManager, null);
-    }
-
-    public PDFToFile(TempFileManager tempFileManager, RuntimePathConfig runtimePathConfig) {
         this.tempFileManager = tempFileManager;
-        this.runtimePathConfig = runtimePathConfig;
     }
 
     public ResponseEntity<byte[]> processPdfToMarkdown(MultipartFile inputFile)
@@ -248,65 +241,31 @@ public class PDFToFile {
         byte[] fileBytes;
         String fileName;
 
-        Path libreOfficeProfile = null;
         try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
                 TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {
 
             Path tempInputFile = inputFileTemp.getPath();
             Path tempOutputDir = outputDirTemp.getPath();
-            Path unoOutputFile =
-                    tempOutputDir.resolve(
-                            pdfBaseName + "." + resolvePrimaryExtension(outputFormat));
 
             // Save the uploaded file to a temporary location
             inputFile.transferTo(tempInputFile);
 
             // Run the LibreOffice command
-            ProcessExecutorResult returnCode = null;
-            IOException unoconvertException = null;
-
-            if (isUnoConvertEnabled()) {
-                try {
-                    List<String> unoCommand =
-                            buildUnoConvertCommand(
-                                    tempInputFile, unoOutputFile, outputFormat, libreOfficeFilter);
-                    returnCode =
-                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                    .runCommandWithOutputHandling(unoCommand);
-                } catch (IOException e) {
-                    unoconvertException = e;
-                    log.warn(
-                            "Unoconvert command failed ({}). Falling back to soffice command.",
-                            e.getMessage());
-                }
-            }
-
-            if (returnCode == null) {
-                // Run the LibreOffice command as a fallback
-                libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
-                List<String> command = new ArrayList<>();
-                command.add(runtimePathConfig.getSOfficePath());
-                command.add("-env:UserInstallation=" + libreOfficeProfile.toUri().toString());
-                command.add("--headless");
-                command.add("--nologo");
-                command.add("--infilter=" + libreOfficeFilter);
-                command.add("--convert-to");
-                command.add(outputFormat);
-                command.add("--outdir");
-                command.add(tempOutputDir.toString());
-                command.add(tempInputFile.toString());
-
-                try {
-                    returnCode =
-                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                    .runCommandWithOutputHandling(command);
-                } catch (IOException e) {
-                    if (unoconvertException != null) {
-                        e.addSuppressed(unoconvertException);
-                    }
-                    throw e;
-                }
-            }
+            List<String> command =
+                    new ArrayList<>(
+                            Arrays.asList(
+                                    "soffice",
+                                    "--headless",
+                                    "--nologo",
+                                    "--infilter=" + libreOfficeFilter,
+                                    "--convert-to",
+                                    outputFormat,
+                                    "--outdir",
+                                    tempOutputDir.toString(),
+                                    tempInputFile.toString()));
+            ProcessExecutorResult returnCode =
+                    ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                            .runCommandWithOutputHandling(command);
 
             // Get output files
             List<File> outputFiles = Arrays.asList(tempOutputDir.toFile().listFiles());
@@ -341,42 +300,8 @@ public class PDFToFile {
 
                 fileBytes = byteArrayOutputStream.toByteArray();
             }
-        } finally {
-            if (libreOfficeProfile != null) {
-                FileUtils.deleteQuietly(libreOfficeProfile.toFile());
-            }
         }
         return WebResponseUtils.bytesToWebResponse(
                 fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
     }
-
-    private boolean isUnoConvertEnabled() {
-        return runtimePathConfig != null
-                && runtimePathConfig.getUnoConvertPath() != null
-                && !runtimePathConfig.getUnoConvertPath().isBlank();
-    }
-
-    private List<String> buildUnoConvertCommand(
-            Path inputFile, Path outputFile, String outputFormat, String libreOfficeFilter) {
-        List<String> command = new ArrayList<>();
-        command.add(runtimePathConfig.getUnoConvertPath());
-        command.add("--port");
-        command.add("2003");
-        command.add("--convert-to");
-        command.add(outputFormat);
-        if (libreOfficeFilter != null && !libreOfficeFilter.isBlank()) {
-            command.add("--input-filter=" + libreOfficeFilter);
-        }
-        command.add(inputFile.toString());
-        command.add(outputFile.toString());
-        return command;
-    }
-
-    private String resolvePrimaryExtension(String outputFormat) {
-        if (outputFormat == null) {
-            return "";
-        }
-        int colonIndex = outputFormat.indexOf(':');
-        return colonIndex > 0 ? outputFormat.substring(0, colonIndex) : outputFormat;
-    }
 }

app/common/src/main/java/stirling/software/common/util/PdfToCbrUtils.java

@@ -35,7 +35,7 @@ public class PdfToCbrUtils {
 
         try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
             if (document.getNumberOfPages() == 0) {
-                throw ExceptionUtils.createPdfNoPages();
+                throw new IllegalArgumentException("PDF file contains no pages");
             }
 
             return createCbrFromPdf(document, dpi);
@@ -44,17 +44,17 @@ public class PdfToCbrUtils {
 
     private static void validatePdfFile(MultipartFile file) {
         if (file == null || file.isEmpty()) {
-            throw ExceptionUtils.createFileNullOrEmptyException();
+            throw new IllegalArgumentException("File cannot be null or empty");
         }
 
         String filename = file.getOriginalFilename();
         if (filename == null) {
-            throw ExceptionUtils.createFileNoNameException();
+            throw new IllegalArgumentException("File must have a name");
         }
 
         String extension = FilenameUtils.getExtension(filename).toLowerCase(Locale.ROOT);
         if (!"pdf".equals(extension)) {
-            throw ExceptionUtils.createPdfFileRequiredException();
+            throw new IllegalArgumentException("File must be a PDF");
         }
     }
 
@@ -67,36 +67,28 @@ public class PdfToCbrUtils {
             int totalPages = document.getNumberOfPages();
 
             for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-                final int currentPage = pageIndex;
                 try {
                     BufferedImage image =
-                            ExceptionUtils.handleOomRendering(
-                                    currentPage + 1,
-                                    dpi,
-                                    () ->
-                                            pdfRenderer.renderImageWithDPI(
-                                                    currentPage, dpi, ImageType.RGB));
+                            pdfRenderer.renderImageWithDPI(pageIndex, dpi, ImageType.RGB);
 
                     String imageFilename =
-                            String.format(Locale.ROOT, "page_%03d.png", currentPage + 1);
+                            String.format(Locale.ROOT, "page_%03d.png", pageIndex + 1);
                     Path imagePath = tempDir.resolve(imageFilename);
 
                     ImageIO.write(image, "PNG", imagePath.toFile());
                     generatedImages.add(imagePath);
 
-                } catch (ExceptionUtils.OutOfMemoryDpiException e) {
-                    // Re-throw OOM exceptions without wrapping
-                    throw e;
                 } catch (IOException e) {
-                    // Wrap other IOExceptions with context
-                    throw ExceptionUtils.createFileProcessingException(
-                            "CBR creation for page " + (currentPage + 1), e);
+                    log.warn("Error processing page {}: {}", pageIndex + 1, e.getMessage());
+                } catch (OutOfMemoryError e) {
+                    throw ExceptionUtils.createOutOfMemoryDpiException(pageIndex + 1, dpi, e);
+                } catch (NegativeArraySizeException e) {
+                    throw ExceptionUtils.createOutOfMemoryDpiException(pageIndex + 1, dpi, e);
                 }
             }
 
             if (generatedImages.isEmpty()) {
-                throw ExceptionUtils.createFileProcessingException(
-                        "CBR conversion", new IOException("No pages were successfully rendered"));
+                throw new IOException("Failed to render any pages to images for CBR conversion");
             }
 
             return createRarArchive(tempDir, generatedImages);
@@ -125,18 +117,15 @@ public class PdfToCbrUtils {
             ProcessExecutorResult result =
                     executor.runCommandWithOutputHandling(command, tempDir.toFile());
             if (result.getRc() != 0) {
-                throw ExceptionUtils.createFileProcessingException(
-                        "RAR archive creation",
-                        new IOException("RAR command failed with code " + result.getRc()));
+                throw new IOException("RAR command failed: " + result.getMessages());
             }
         } catch (InterruptedException e) {
             Thread.currentThread().interrupt();
-            throw ExceptionUtils.createProcessingInterruptedException("RAR creation", e);
+            throw new IOException("RAR command interrupted", e);
         }
 
         if (!Files.exists(rarFile)) {
-            throw ExceptionUtils.createFileProcessingException(
-                    "RAR archive creation", new IOException("RAR file was not created"));
+            throw new IOException("RAR file was not created");
         }
 
         try (FileInputStream fis = new FileInputStream(rarFile.toFile());

app/common/src/main/java/stirling/software/common/util/PdfToCbzUtils.java

@@ -30,7 +30,7 @@ public class PdfToCbzUtils {
 
         try (PDDocument document = pdfDocumentFactory.load(pdfFile)) {
             if (document.getNumberOfPages() == 0) {
-                throw ExceptionUtils.createPdfNoPages();
+                throw new IllegalArgumentException("PDF file contains no pages");
             }
 
             return createCbzFromPdf(document, dpi);
@@ -39,17 +39,17 @@ public class PdfToCbzUtils {
 
     private static void validatePdfFile(MultipartFile file) {
         if (file == null || file.isEmpty()) {
-            throw ExceptionUtils.createFileNullOrEmptyException();
+            throw new IllegalArgumentException("File cannot be null or empty");
         }
 
         String filename = file.getOriginalFilename();
         if (filename == null) {
-            throw ExceptionUtils.createFileNoNameException();
+            throw new IllegalArgumentException("File must have a name");
         }
 
         String extension = FilenameUtils.getExtension(filename).toLowerCase(Locale.ROOT);
         if (!"pdf".equals(extension)) {
-            throw ExceptionUtils.createPdfFileRequiredException();
+            throw new IllegalArgumentException("File must be a PDF");
         }
     }
 
@@ -62,31 +62,25 @@ public class PdfToCbzUtils {
             int totalPages = document.getNumberOfPages();
 
             for (int pageIndex = 0; pageIndex < totalPages; pageIndex++) {
-                final int currentPage = pageIndex;
                 try {
                     BufferedImage image =
-                            ExceptionUtils.handleOomRendering(
-                                    currentPage + 1,
-                                    dpi,
-                                    () ->
-                                            pdfRenderer.renderImageWithDPI(
-                                                    currentPage, dpi, ImageType.RGB));
+                            pdfRenderer.renderImageWithDPI(pageIndex, dpi, ImageType.RGB);
 
                     String imageFilename =
-                            String.format(Locale.ROOT, "page_%03d.png", currentPage + 1);
+                            String.format(Locale.ROOT, "page_%03d.png", pageIndex + 1);
+
                     ZipEntry zipEntry = new ZipEntry(imageFilename);
                     zipOut.putNextEntry(zipEntry);
 
                     ImageIO.write(image, "PNG", zipOut);
                     zipOut.closeEntry();
 
-                } catch (ExceptionUtils.OutOfMemoryDpiException e) {
-                    // Re-throw OOM exceptions without wrapping
-                    throw e;
                 } catch (IOException e) {
-                    // Wrap other IOExceptions with context
-                    throw ExceptionUtils.createFileProcessingException(
-                            "CBZ creation for page " + (currentPage + 1), e);
+                    log.warn("Error processing page {}: {}", pageIndex + 1, e.getMessage());
+                } catch (OutOfMemoryError e) {
+                    throw ExceptionUtils.createOutOfMemoryDpiException(pageIndex + 1, dpi, e);
+                } catch (NegativeArraySizeException e) {
+                    throw ExceptionUtils.createOutOfMemoryDpiException(pageIndex + 1, dpi, e);
                 }
             }
 

app/common/src/main/java/stirling/software/common/util/PdfUtils.java

@@ -179,20 +179,9 @@ public class PdfUtils {
                         writer.prepareWriteSequence(null);
 
                         for (int i = 0; i < pageCount; ++i) {
-                            final int pageIndex = i;
                             BufferedImage image;
                             try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        document.getPage(pageIndex), pageIndex + 1, DPI);
-
-                                image =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
+                                image = pdfRenderer.renderImageWithDPI(i, DPI, colorType);
                             } catch (IllegalArgumentException e) {
                                 if (e.getMessage() != null
                                         && e.getMessage()
@@ -206,6 +195,10 @@ public class PdfUtils {
                                             DPI);
                                 }
                                 throw e;
+                            } catch (OutOfMemoryError e) {
+                                throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
+                            } catch (NegativeArraySizeException e) {
+                                throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
                             }
                             writer.writeToSequence(new IIOImage(image, null, null), param);
                         }
@@ -229,7 +222,6 @@ public class PdfUtils {
                     HashMap<PdfRenderSettingsKey, PdfImageDimensionValue> pageSizes =
                             new HashMap<>();
                     for (int i = 0; i < pageCount; ++i) {
-                        final int pageIndex = i;
                         PDPage page = document.getPage(i);
                         PDRectangle mediaBox = page.getMediaBox();
                         int rotation = page.getRotation();
@@ -240,17 +232,7 @@ public class PdfUtils {
                         if (dimension == null) {
                             // Render the image to get the dimensions
                             try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        page, pageIndex + 1, DPI);
-
-                                pdfSizeImage =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
+                                pdfSizeImage = pdfRenderer.renderImageWithDPI(i, DPI, colorType);
                             } catch (IllegalArgumentException e) {
                                 if (e.getMessage() != null
                                         && e.getMessage()
@@ -265,6 +247,10 @@ public class PdfUtils {
                                             DPI);
                                 }
                                 throw e;
+                            } catch (OutOfMemoryError e) {
+                                throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
+                            } catch (NegativeArraySizeException e) {
+                                throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
                             }
                             pdfSizeImageIndex = i;
                             dimension =
@@ -290,22 +276,11 @@ public class PdfUtils {
                     boolean firstImageAlreadyRendered = pdfSizeImageIndex == 0;
 
                     for (int i = 0; i < pageCount; ++i) {
-                        final int pageIndex = i;
                         if (firstImageAlreadyRendered && i == 0) {
                             pageImage = pdfSizeImage;
                         } else {
                             try {
-                                // Validate dimensions before rendering
-                                ExceptionUtils.validateRenderingDimensions(
-                                        document.getPage(pageIndex), pageIndex + 1, DPI);
-
-                                pageImage =
-                                        ExceptionUtils.handleOomRendering(
-                                                pageIndex + 1,
-                                                DPI,
-                                                () ->
-                                                        pdfRenderer.renderImageWithDPI(
-                                                                pageIndex, DPI, colorType));
+                                pageImage = pdfRenderer.renderImageWithDPI(i, DPI, colorType);
                             } catch (IllegalArgumentException e) {
                                 if (e.getMessage() != null
                                         && e.getMessage()
@@ -319,6 +294,10 @@ public class PdfUtils {
                                             DPI);
                                 }
                                 throw e;
+                            } catch (OutOfMemoryError e) {
+                                throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
+                            } catch (NegativeArraySizeException e) {
+                                throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
                             }
                         }
 
@@ -339,20 +318,9 @@ public class PdfUtils {
                 // Zip the images and return as byte array
                 try (ZipOutputStream zos = new ZipOutputStream(baos)) {
                     for (int i = 0; i < pageCount; ++i) {
-                        final int pageIndex = i;
                         BufferedImage image;
                         try {
-                            // Validate dimensions before rendering
-                            ExceptionUtils.validateRenderingDimensions(
-                                    document.getPage(pageIndex), pageIndex + 1, DPI);
-
-                            image =
-                                    ExceptionUtils.handleOomRendering(
-                                            pageIndex + 1,
-                                            DPI,
-                                            () ->
-                                                    pdfRenderer.renderImageWithDPI(
-                                                            pageIndex, DPI, colorType));
+                            image = pdfRenderer.renderImageWithDPI(i, DPI, colorType);
                         } catch (IllegalArgumentException e) {
                             if (e.getMessage() != null
                                     && e.getMessage().contains("Maximum size of image exceeded")) {
@@ -364,6 +332,10 @@ public class PdfUtils {
                                         DPI);
                             }
                             throw e;
+                        } catch (OutOfMemoryError e) {
+                            throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
+                        } catch (NegativeArraySizeException e) {
+                            throw ExceptionUtils.createOutOfMemoryDpiException(i + 1, DPI, e);
                         }
                         try (ByteArrayOutputStream baosImage = new ByteArrayOutputStream()) {
                             ImageIO.write(image, imageType, baosImage);
@@ -403,7 +375,6 @@ public class PdfUtils {
         PDFRenderer pdfRenderer = new PDFRenderer(document);
         pdfRenderer.setSubsamplingAllowed(true);
         for (int page = 0; page < document.getNumberOfPages(); ++page) {
-            final int pageIndex = page;
             BufferedImage bim;
 
             // Use global maximum DPI setting, fallback to 300 if not set
@@ -413,16 +384,9 @@ public class PdfUtils {
             if (properties != null && properties.getSystem() != null) {
                 renderDpi = properties.getSystem().getMaxDPI();
             }
-            final int dpi = renderDpi;
 
             try {
-                bim =
-                        ExceptionUtils.handleOomRendering(
-                                pageIndex + 1,
-                                dpi,
-                                () ->
-                                        pdfRenderer.renderImageWithDPI(
-                                                pageIndex, dpi, ImageType.RGB));
+                bim = pdfRenderer.renderImageWithDPI(page, renderDpi, ImageType.RGB);
             } catch (IllegalArgumentException e) {
                 if (e.getMessage() != null
                         && e.getMessage().contains("Maximum size of image exceeded")) {
@@ -431,9 +395,13 @@ public class PdfUtils {
                             "PDF page {0} is too large to render at 300 DPI. The resulting image"
                                     + " would exceed Java's maximum array size. Please use a lower DPI"
                                     + " value for PDF-to-image conversion.",
-                            pageIndex + 1);
+                            page + 1);
                 }
                 throw e;
+            } catch (OutOfMemoryError e) {
+                throw ExceptionUtils.createOutOfMemoryDpiException(page + 1, 300, e);
+            } catch (NegativeArraySizeException e) {
+                throw ExceptionUtils.createOutOfMemoryDpiException(page + 1, 300, e);
             }
             PDPage originalPage = document.getPage(page);
 

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -71,6 +71,11 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getInstallAppSessionLimit();
+                                case FFMPEG ->
+                                        applicationProperties
+                                                .getProcessExecutor()
+                                                .getSessionLimit()
+                                                .getFfmpegSessionLimit();
                                 case TESSERACT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -86,11 +91,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getCalibreSessionLimit();
-                                case IMAGEMAGICK ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getSessionLimit()
-                                                .getImageMagickSessionLimit();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -101,12 +101,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getOcrMyPdfSessionLimit();
-                                case CFF_CONVERTER -> 1;
-                                case FFMPEG ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getSessionLimit()
-                                                .getFfmpegSessionLimit();
                             };
 
                     long timeoutMinutes =
@@ -136,6 +130,11 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getInstallAppTimeoutMinutes();
+                                case FFMPEG ->
+                                        applicationProperties
+                                                .getProcessExecutor()
+                                                .getTimeoutMinutes()
+                                                .getFfmpegTimeoutMinutes();
                                 case TESSERACT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -151,11 +150,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getCalibreTimeoutMinutes();
-                                case IMAGEMAGICK ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getTimeoutMinutes()
-                                                .getImageMagickTimeoutMinutes();
                                 case GHOSTSCRIPT ->
                                         applicationProperties
                                                 .getProcessExecutor()
@@ -166,12 +160,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getOcrMyPdfTimeoutMinutes();
-                                case CFF_CONVERTER -> 5L;
-                                case FFMPEG ->
-                                        applicationProperties
-                                                .getProcessExecutor()
-                                                .getTimeoutMinutes()
-                                                .getFfmpegTimeoutMinutes();
                             };
                     return new ProcessExecutor(semaphoreLimit, liveUpdates, timeoutMinutes);
                 });
@@ -321,12 +309,10 @@ public class ProcessExecutor {
         WEASYPRINT,
         INSTALL_APP,
         CALIBRE,
-        IMAGEMAGICK,
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,
         OCR_MY_PDF,
-        CFF_CONVERTER,
         FFMPEG
     }
 

app/common/src/main/java/stirling/software/common/util/RegexPatternUtils.java

@@ -1,6 +1,5 @@
 package stirling.software.common.util;
 
-import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Pattern;
 import java.util.regex.PatternSyntaxException;
@@ -242,11 +241,6 @@ public final class RegexPatternUtils {
         return getPattern("\\s+");
     }
 
-    /** Pattern for matching punctuation characters */
-    public Pattern getPunctuationPattern() {
-        return getPattern("[\\p{Punct}]+");
-    }
-
     /** Pattern for matching newlines (Windows and Unix style) */
     public Pattern getNewlinesPattern() {
         return getPattern("\\r?\\n");
@@ -292,24 +286,6 @@ public final class RegexPatternUtils {
         return getPattern("[^a-zA-Z0-9 ]");
     }
 
-    /** Pattern for removing bracketed indices like [0], [Child], etc. in field names */
-    public Pattern getFormFieldBracketPattern() {
-        return getPattern("\\[[^\\]]*\\]");
-    }
-
-    /** Pattern that replaces underscores or hyphens with spaces */
-    public Pattern getUnderscoreHyphenPattern() {
-        return getPattern("[-_]+");
-    }
-
-    /**
-     * Pattern that matches camelCase or alpha-numeric boundaries to allow inserting spaces.
-     * Examples: firstName -> first Name, field1 -> field 1, A5Size -> A5 Size
-     */
-    public Pattern getCamelCaseBoundaryPattern() {
-        return getPattern("(?<=[a-z])(?=[A-Z])|(?<=[A-Za-z])(?=\\d)|(?<=\\d)(?=[A-Za-z])");
-    }
-
     /** Pattern for removing angle brackets */
     public Pattern getAngleBracketsPattern() {
         return getPattern("[<>]");
@@ -325,11 +301,6 @@ public final class RegexPatternUtils {
         return getPattern("\\+");
     }
 
-    /** Pattern for splitting on pipe delimiter (used for hint lists in i18n messages) */
-    public Pattern getPipeDelimiterPattern() {
-        return getPattern("\\|");
-    }
-
     /** Pattern for username validation */
     public Pattern getUsernameValidationPattern() {
         return getPattern("^[a-zA-Z0-9](?!.*[-@._+]{2,})[a-zA-Z0-9@._+-]{1,48}[a-zA-Z0-9]$");
@@ -364,26 +335,6 @@ public final class RegexPatternUtils {
         return getPattern("[1-9][0-9]{0,2}");
     }
 
-    /**
-     * Pattern for very simple generic field tokens such as "field", "text", "checkbox" with
-     * optional numeric suffix (e.g. "field 1"). Case-insensitive.
-     */
-    public Pattern getGenericFieldNamePattern() {
-        return getPattern(
-                "^(field|text|checkbox|radio|button|signature|name|value|option|select|choice)(\\s*\\d+)?$",
-                Pattern.CASE_INSENSITIVE);
-    }
-
-    /** Pattern for short identifiers like t1, f2, a10 etc. */
-    public Pattern getSimpleFormFieldPattern() {
-        return getPattern("^[A-Za-z]{1,2}\\s*\\d{1,3}$");
-    }
-
-    /** Pattern for optional leading 't' followed by digits, e.g., t1, 1, t 12. */
-    public Pattern getOptionalTNumericPattern() {
-        return getPattern("^(?:t\\s*)?\\d+$", Pattern.CASE_INSENSITIVE);
-    }
-
     /** Pattern for validating mathematical expressions */
     public Pattern getMathExpressionPattern() {
         return getPattern("[0-9n+\\-*/() ]+");
@@ -516,11 +467,6 @@ public final class RegexPatternUtils {
         return getPattern("/");
     }
 
-    /** Supported logical types when creating new fields programmatically */
-    public Set<String> getSupportedNewFieldTypes() {
-        return Set.of("text", "checkbox", "combobox", "listbox", "radio", "button", "signature");
-    }
-
     /**
      * Pre-compile commonly used patterns for immediate availability. This eliminates first-call
      * compilation overhead for frequent patterns.
@@ -572,16 +518,6 @@ public final class RegexPatternUtils {
         return getPattern("^[a-zA-Z0-9]{2,4}$", Pattern.CASE_INSENSITIVE);
     }
 
-    /** Pattern for splitting on line breaks (Unicode line separator) */
-    public Pattern getLineSeparatorPattern() {
-        return getPattern("\\R");
-    }
-
-    /** Pattern for removing leading asterisks and whitespace */
-    public Pattern getLeadingAsterisksWhitespacePattern() {
-        return getPattern("^[*\\s]+");
-    }
-
     private record PatternKey(String regex, int flags) {
         // Record automatically provides equals, hashCode, and toString
     }

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -7,111 +7,23 @@ public class RequestUriUtils {
     }
 
     public static boolean isStaticResource(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // API routes are never static except for the public status endpoint
-        if (normalizedUri.startsWith("/api/")) {
-            return normalizedUri.startsWith("/api/v1/info/status");
-        }
-
-        // Well-known static asset directories (backend + React build artifacts)
-        if (normalizedUri.startsWith("/css/")
-                || normalizedUri.startsWith("/fonts/")
-                || normalizedUri.startsWith("/js/")
-                || normalizedUri.startsWith("/images/")
-                || normalizedUri.startsWith("/public/")
-                || normalizedUri.startsWith("/pdfjs/")
-                || normalizedUri.startsWith("/pdfjs-legacy/")
-                || normalizedUri.startsWith("/pdfium/")
-                || normalizedUri.startsWith("/assets/")
-                || normalizedUri.startsWith("/locales/")
-                || normalizedUri.startsWith("/Login/")
-                || normalizedUri.startsWith("/samples/")
-                || normalizedUri.startsWith("/classic-logo/")
-                || normalizedUri.startsWith("/modern-logo/")
-                || normalizedUri.startsWith("/og_images/")) {
-            return true;
-        }
-
-        // Specific static files bundled with the frontend
-        if (normalizedUri.equals("/robots.txt")
-                || normalizedUri.equals("/favicon.ico")
-                || normalizedUri.equals("/manifest.json")
-                || normalizedUri.equals("/site.webmanifest")
-                || normalizedUri.equals("/manifest-classic.json")
-                || normalizedUri.equals("/index.html")) {
-            return true;
-        }
-
-        // Login/error pages remain public
-        if (normalizedUri.startsWith("/login") || normalizedUri.startsWith("/error")) {
-            return true;
-        }
-
-        // Mobile scanner page for QR code-based file uploads (peer-to-peer, no backend auth needed)
-        if (normalizedUri.startsWith("/mobile-scanner")) {
-            return true;
-        }
-
-        // Treat common static file extensions as static resources
-        return normalizedUri.endsWith(".svg")
-                || normalizedUri.endsWith(".png")
-                || normalizedUri.endsWith(".ico")
-                || normalizedUri.endsWith(".txt")
-                || normalizedUri.endsWith(".webmanifest")
-                || normalizedUri.endsWith(".js")
-                || normalizedUri.endsWith(".css")
-                || normalizedUri.endsWith(".mjs")
-                || normalizedUri.endsWith(".html")
-                || normalizedUri.endsWith(".toml")
-                || normalizedUri.endsWith(".wasm");
-    }
-
-    public static boolean isFrontendRoute(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // APIs are never treated as frontend routes
-        if (normalizedUri.startsWith("/api/")) {
-            return false;
-        }
-
-        // Blocklist of backend/non-frontend paths that should still go through filters
-        String[] backendOnlyPrefixes = {
-            "/register",
-            "/invite",
-            "/pipeline",
-            "/pdfjs",
-            "/pdfjs-legacy",
-            "/fonts",
-            "/images",
-            "/files",
-            "/css",
-            "/js",
-            "/swagger",
-            "/v1/api-docs",
-            "/actuator"
-        };
-
-        for (String prefix : backendOnlyPrefixes) {
-            if (normalizedUri.equals(prefix) || normalizedUri.startsWith(prefix + "/")) {
-                return false;
-            }
-        }
-
-        if (normalizedUri.isBlank()) {
-            return false;
-        }
-
-        // Allow root and any extensionless path (React Router will handle these)
-        return !normalizedUri.contains(".");
+        return requestURI.startsWith(contextPath + "/css/")
+                || requestURI.startsWith(contextPath + "/fonts/")
+                || requestURI.startsWith(contextPath + "/js/")
+                || requestURI.endsWith(contextPath + "robots.txt")
+                || requestURI.startsWith(contextPath + "/images/")
+                || requestURI.startsWith(contextPath + "/public/")
+                || requestURI.startsWith(contextPath + "/pdfjs/")
+                || requestURI.startsWith(contextPath + "/pdfjs-legacy/")
+                || requestURI.startsWith(contextPath + "/login")
+                || requestURI.startsWith(contextPath + "/error")
+                || requestURI.startsWith(contextPath + "/favicon")
+                || requestURI.endsWith(".svg")
+                || requestURI.endsWith(".png")
+                || requestURI.endsWith(".ico")
+                || requestURI.endsWith(".txt")
+                || requestURI.endsWith(".webmanifest")
+                || requestURI.startsWith(contextPath + "/api/v1/info/status");
     }
 
     public static boolean isTrackableResource(String requestURI) {
@@ -131,57 +43,10 @@ public class RequestUriUtils {
                 || requestURI.endsWith(".svg")
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
-                || requestURI.endsWith(".toml")
-                || requestURI.endsWith(".wasm")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
                 || requestURI.startsWith("/fonts")
-                || requestURI.startsWith("/pdfjs")
-                || requestURI.startsWith("/pdfium"));
-    }
-
-    /**
-     * Checks if the request URI is a public authentication endpoint that doesn't require
-     * authentication. This includes login, signup, OAuth callbacks, and public config endpoints.
-     *
-     * @param requestURI The full request URI
-     * @param contextPath The servlet context path
-     * @return true if the endpoint is public and doesn't require authentication
-     */
-    public static boolean isPublicAuthEndpoint(String requestURI, String contextPath) {
-        // Remove context path from URI to normalize path matching
-        String trimmedUri =
-                requestURI.startsWith(contextPath)
-                        ? requestURI.substring(contextPath.length())
-                        : requestURI;
-
-        // Public auth endpoints that don't require authentication
-        return trimmedUri.startsWith("/login")
-                || trimmedUri.startsWith("/auth/")
-                || trimmedUri.startsWith("/oauth2")
-                || trimmedUri.startsWith("/saml2")
-                || trimmedUri.contains("/login/oauth2/code/") // Spring Security OAuth2 callback
-                || trimmedUri.contains("/oauth2/authorization/") // OAuth2 authorization endpoint
-                || trimmedUri.startsWith("/api/v1/auth/login")
-                || trimmedUri.startsWith("/api/v1/auth/refresh")
-                || trimmedUri.startsWith("/api/v1/auth/logout")
-                || trimmedUri.startsWith(
-                        "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
-                // enableLogin)
-                || trimmedUri.startsWith(
-                        "/api/v1/ui-data/footer-info") // Public footer configuration
-                || trimmedUri.startsWith("/api/v1/invite/validate")
-                || trimmedUri.startsWith("/api/v1/invite/accept")
-                || trimmedUri.startsWith(
-                        "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
-                || trimmedUri.startsWith("/v1/api-docs");
-    }
-
-    private static String stripContextPath(String contextPath, String requestURI) {
-        if (contextPath != null && !contextPath.isBlank() && requestURI.startsWith(contextPath)) {
-            return requestURI.substring(contextPath.length());
-        }
-        return requestURI;
+                || requestURI.startsWith("/pdfjs"));
     }
 }

app/common/src/main/java/stirling/software/common/util/YamlHelper.java

@@ -10,7 +10,6 @@ import java.util.Arrays;
 import java.util.Deque;
 import java.util.LinkedHashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
@@ -136,17 +135,6 @@ public class YamlHelper {
                 } else if ("true".equals(newValue) || "false".equals(newValue)) {
                     newValueNode =
                             new ScalarNode(Tag.BOOL, String.valueOf(newValue), ScalarStyle.PLAIN);
-                } else if (newValue instanceof Map<?, ?> map) {
-                    // Handle Map objects - convert to MappingNode
-                    List<NodeTuple> mapTuples = new ArrayList<>();
-                    for (Map.Entry<?, ?> entry : map.entrySet()) {
-                        ScalarNode mapKeyNode =
-                                new ScalarNode(
-                                        Tag.STR, String.valueOf(entry.getKey()), ScalarStyle.PLAIN);
-                        Node mapValueNode = convertValueToNode(entry.getValue());
-                        mapTuples.add(new NodeTuple(mapKeyNode, mapValueNode));
-                    }
-                    newValueNode = new MappingNode(Tag.MAP, mapTuples, FlowStyle.BLOCK);
                 } else if (newValue instanceof List<?> list) {
                     List<Node> sequenceNodes = new ArrayList<>();
                     for (Object item : list) {
@@ -470,43 +458,6 @@ public class YamlHelper {
         return isInteger(object) || isShort(object) || isByte(object) || isLong(object);
     }
 
-    /**
-     * Converts a Java value to a YAML Node.
-     *
-     * @param value The value to convert.
-     * @return The corresponding YAML Node.
-     */
-    private Node convertValueToNode(Object value) {
-        if (value == null) {
-            return new ScalarNode(Tag.NULL, "null", ScalarStyle.PLAIN);
-        } else if (isAnyInteger(value)) {
-            return new ScalarNode(Tag.INT, String.valueOf(value), ScalarStyle.PLAIN);
-        } else if (isFloat(value)) {
-            Object floatValue = Float.valueOf(String.valueOf(value));
-            return new ScalarNode(Tag.FLOAT, String.valueOf(floatValue), ScalarStyle.PLAIN);
-        } else if (value instanceof Boolean || "true".equals(value) || "false".equals(value)) {
-            return new ScalarNode(Tag.BOOL, String.valueOf(value), ScalarStyle.PLAIN);
-        } else if (value instanceof Map<?, ?> map) {
-            // Recursively handle nested maps
-            List<NodeTuple> mapTuples = new ArrayList<>();
-            for (Map.Entry<?, ?> entry : map.entrySet()) {
-                ScalarNode mapKeyNode =
-                        new ScalarNode(Tag.STR, String.valueOf(entry.getKey()), ScalarStyle.PLAIN);
-                Node mapValueNode = convertValueToNode(entry.getValue());
-                mapTuples.add(new NodeTuple(mapKeyNode, mapValueNode));
-            }
-            return new MappingNode(Tag.MAP, mapTuples, FlowStyle.BLOCK);
-        } else if (value instanceof List<?> list) {
-            List<Node> sequenceNodes = new ArrayList<>();
-            for (Object item : list) {
-                sequenceNodes.add(convertValueToNode(item));
-            }
-            return new SequenceNode(Tag.SEQ, sequenceNodes, FlowStyle.FLOW);
-        } else {
-            return new ScalarNode(Tag.STR, String.valueOf(value), ScalarStyle.PLAIN);
-        }
-    }
-
     /**
      * Copies comments from an old node to a new one.
      *

app/common/src/main/java/stirling/software/common/util/misc/InvertFullColorStrategy.java

@@ -32,76 +32,85 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
 
     @Override
     public InputStreamResource replace() throws IOException {
-        try (TempFile tempFile =
-                new TempFile(
-                        Files.createTempFile("temp", getFileInput().getOriginalFilename())
-                                .toFile())) {
+
+        File file = null;
+        try {
+            // Create a temporary file, with the original filename from the multipart file
+            file = Files.createTempFile("temp", getFileInput().getOriginalFilename()).toFile();
+
             // Transfer the content of the multipart file to the file
-            getFileInput().transferTo(tempFile.getFile());
+            getFileInput().transferTo(file);
 
             // Load the uploaded PDF
-            try (PDDocument document = Loader.loadPDF(tempFile.getFile())) {
-                // Render each page and invert colors
-                PDFRenderer pdfRenderer = new PDFRenderer(document);
-                for (int page = 0; page < document.getNumberOfPages(); page++) {
-                    BufferedImage image;
+            PDDocument document = Loader.loadPDF(file);
 
-                    // Use global maximum DPI setting, fallback to 300 if not set
-                    int renderDpi = 300; // Default fallback
-                    ApplicationProperties properties =
-                            ApplicationContextProvider.getBean(ApplicationProperties.class);
-                    if (properties != null && properties.getSystem() != null) {
-                        renderDpi = properties.getSystem().getMaxDPI();
-                    }
-                    final int dpi = renderDpi;
-                    final int pageNum = page;
+            // Render each page and invert colors
+            PDFRenderer pdfRenderer = new PDFRenderer(document);
+            for (int page = 0; page < document.getNumberOfPages(); page++) {
+                BufferedImage image;
 
-                    image =
-                            ExceptionUtils.handleOomRendering(
-                                    pageNum + 1,
-                                    dpi,
-                                    () -> pdfRenderer.renderImageWithDPI(pageNum, dpi));
-
-                    // Invert the colors
-                    invertImageColors(image);
-
-                    // Create a new PDPage from the inverted image
-                    PDPage pdPage = document.getPage(page);
-                    File tempImageFile = null;
-                    try {
-                        tempImageFile = convertToBufferedImageTpFile(image);
-                        PDImageXObject pdImage =
-                                PDImageXObject.createFromFileByContent(tempImageFile, document);
-
-                        try (PDPageContentStream contentStream =
-                                new PDPageContentStream(
-                                        document,
-                                        pdPage,
-                                        PDPageContentStream.AppendMode.OVERWRITE,
-                                        true)) {
-                            contentStream.drawImage(
-                                    pdImage,
-                                    0,
-                                    0,
-                                    pdPage.getMediaBox().getWidth(),
-                                    pdPage.getMediaBox().getHeight());
-                        }
-                    } finally {
-                        if (tempImageFile != null && tempImageFile.exists()) {
-                            Files.delete(tempImageFile.toPath());
-                        }
-                    }
+                // Use global maximum DPI setting, fallback to 300 if not set
+                int renderDpi = 300; // Default fallback
+                ApplicationProperties properties =
+                        ApplicationContextProvider.getBean(ApplicationProperties.class);
+                if (properties != null && properties.getSystem() != null) {
+                    renderDpi = properties.getSystem().getMaxDPI();
                 }
 
-                // Save the modified PDF to a ByteArrayOutputStream
-                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
-                document.save(byteArrayOutputStream);
+                try {
+                    image =
+                            pdfRenderer.renderImageWithDPI(
+                                    page, renderDpi); // Render page with global DPI setting
+                } catch (OutOfMemoryError e) {
+                    throw ExceptionUtils.createOutOfMemoryDpiException(page + 1, renderDpi, e);
+                } catch (NegativeArraySizeException e) {
+                    throw ExceptionUtils.createOutOfMemoryDpiException(page + 1, renderDpi, e);
+                }
 
-                // Prepare the modified PDF for download
-                ByteArrayInputStream inputStream =
-                        new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
-                InputStreamResource resource = new InputStreamResource(inputStream);
-                return resource;
+                // Invert the colors
+                invertImageColors(image);
+
+                // Create a new PDPage from the inverted image
+                PDPage pdPage = document.getPage(page);
+                File tempImageFile = null;
+                try {
+                    tempImageFile = convertToBufferedImageTpFile(image);
+                    PDImageXObject pdImage =
+                            PDImageXObject.createFromFileByContent(tempImageFile, document);
+
+                    PDPageContentStream contentStream =
+                            new PDPageContentStream(
+                                    document,
+                                    pdPage,
+                                    PDPageContentStream.AppendMode.OVERWRITE,
+                                    true);
+                    contentStream.drawImage(
+                            pdImage,
+                            0,
+                            0,
+                            pdPage.getMediaBox().getWidth(),
+                            pdPage.getMediaBox().getHeight());
+                    contentStream.close();
+                } finally {
+                    if (tempImageFile != null && tempImageFile.exists()) {
+                        Files.delete(tempImageFile.toPath());
+                    }
+                }
+            }
+
+            // Save the modified PDF to a ByteArrayOutputStream
+            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
+            document.save(byteArrayOutputStream);
+            document.close();
+
+            // Prepare the modified PDF for download
+            ByteArrayInputStream inputStream =
+                    new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
+            InputStreamResource resource = new InputStreamResource(inputStream);
+            return resource;
+        } finally {
+            if (file != null && file.exists()) {
+                Files.delete(file.toPath());
             }
         }
     }
@@ -110,20 +119,18 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
     private void invertImageColors(BufferedImage image) {
         int width = image.getWidth();
         int height = image.getHeight();
-        int[] pixels = new int[width * height];
-        image.getRGB(0, 0, width, height, pixels, 0, width);
-        for (int i = 0; i < pixels.length; i++) {
-            int pixel = pixels[i];
-
-            int a = 0xff;
-
-            int r = (pixel >> 16) & 0xff;
-            int g = (pixel >> 8) & 0xff;
-            int b = pixel & 0xff;
-
-            pixels[i] = (a << 24) | ((255 - r) << 16) | ((255 - g) << 8) | (255 - b);
+        for (int x = 0; x < width; x++) {
+            for (int y = 0; y < height; y++) {
+                int rgba = image.getRGB(x, y);
+                Color color = new Color(rgba, true);
+                Color invertedColor =
+                        new Color(
+                                255 - color.getRed(),
+                                255 - color.getGreen(),
+                                255 - color.getBlue());
+                image.setRGB(x, y, invertedColor.getRGB());
+            }
         }
-        image.setRGB(0, 0, width, height, pixels, 0, width);
     }
 
     // Helper method to convert BufferedImage to InputStream
@@ -132,23 +139,4 @@ public class InvertFullColorStrategy extends ReplaceAndInvertColorStrategy {
         ImageIO.write(image, "png", file);
         return file;
     }
-
-    private static class TempFile implements AutoCloseable {
-        private final File file;
-
-        public TempFile(File file) {
-            this.file = file;
-        }
-
-        public File getFile() {
-            return file;
-        }
-
-        @Override
-        public void close() throws IOException {
-            if (file != null && file.exists()) {
-                Files.delete(file.toPath());
-            }
-        }
-    }
 }

app/common/src/test/java/stirling/software/common/model/ApplicationPropertiesLogicTest.java

@@ -2,10 +2,12 @@ package stirling.software.common.model;
 
 import static org.junit.jupiter.api.Assertions.*;
 
+import java.io.File;
 import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
+import java.util.Locale;
 import java.util.function.Function;
 
 import org.junit.jupiter.api.Test;
@@ -45,11 +47,15 @@ class ApplicationPropertiesLogicTest {
         String expectedLibre = Paths.get(expectedBase, "libreoffice").toString();
         assertEquals(expectedLibre, tfm.getLibreofficeDir());
 
-        tfm.setBaseTmpDir("/custom/base");
-        assertEquals(normalize.apply("/custom/base"), normalize.apply(tfm.getBaseTmpDir()));
+        tfm.setBaseTmpDir(File.separator + "custom" + File.separator + "base");
+        assertEquals(
+                File.separator + "custom" + File.separator + "base",
+                normalize.apply(tfm.getBaseTmpDir()));
 
-        tfm.setLibreofficeDir("/opt/libre");
-        assertEquals(normalize.apply("/opt/libre"), normalize.apply(tfm.getLibreofficeDir()));
+        tfm.setLibreofficeDir(File.separator + "opt" + File.separator + "libre");
+        assertEquals(
+                File.separator + "opt" + File.separator + "libre",
+                normalize.apply(tfm.getLibreofficeDir()));
     }
 
     @Test
@@ -109,17 +115,25 @@ class ApplicationPropertiesLogicTest {
 
         UnsupportedProviderException ex =
                 assertThrows(UnsupportedProviderException.class, () -> client.get("unknown"));
-        assertTrue(ex.getMessage().toLowerCase().contains("not supported"));
+        assertTrue(ex.getMessage().toLowerCase(Locale.ROOT).contains("not supported"));
     }
 
     @Test
     void ui_getters_return_null_for_blank() {
         ApplicationProperties.Ui ui = new ApplicationProperties.Ui();
+        ui.setAppName("   ");
+        ui.setHomeDescription("");
         ui.setAppNameNavbar(null);
 
+        assertNull(ui.getAppName());
+        assertNull(ui.getHomeDescription());
         assertNull(ui.getAppNameNavbar());
 
+        ui.setAppName("Stirling-PDF");
+        ui.setHomeDescription("Home");
         ui.setAppNameNavbar("Nav");
+        assertEquals("Stirling-PDF", ui.getAppName());
+        assertEquals("Home", ui.getHomeDescription());
         assertEquals("Nav", ui.getAppNameNavbar());
     }
 
@@ -208,7 +222,7 @@ class ApplicationPropertiesLogicTest {
         Collection<String> nullColl = null;
         Collection<String> empty = List.of();
 
-        assertFalse(oauth2.isValid(nullColl, "scopes"));
+        assertFalse(oauth2.isValid((Collection<String>) null, "scopes"));
         assertFalse(oauth2.isValid(empty, "scopes"));
     }
 
@@ -216,12 +230,13 @@ class ApplicationPropertiesLogicTest {
     void collection_isValid_true_when_non_empty_even_if_element_is_blank() {
         ApplicationProperties.Security.OAUTH2 oauth2 = new ApplicationProperties.Security.OAUTH2();
 
-        // Aktuelles Verhalten: prüft NUR !isEmpty(), nicht Inhalt
+        // Current behavior: checks ONLY !isEmpty(), not the content
         Collection<String> oneBlank = new ArrayList<>();
         oneBlank.add("   ");
 
         assertTrue(
                 oauth2.isValid(oneBlank, "scopes"),
-                "Dokumentiert aktuelles Verhalten: nicht-leere Liste gilt als gültig, auch wenn Element leer/blank ist");
+                "Documents current behavior: non-empty list is considered valid, even if an element"
+                        + " is empty/blank");
     }
 }

app/common/src/test/java/stirling/software/common/model/FileInfoTest.java

@@ -13,8 +13,6 @@ import org.junit.jupiter.params.provider.CsvSource;
 
 public class FileInfoTest {
 
-    private static final LocalDateTime FIXED_NOW = LocalDateTime.of(2025, 11, 1, 12, 0, 0);
-
     @ParameterizedTest(name = "{index}: fileSize={0}")
     @CsvSource({
         "0, '0 Bytes'",
@@ -30,9 +28,9 @@ public class FileInfoTest {
                 new FileInfo(
                         "example.txt",
                         "/path/to/example.txt",
-                        FIXED_NOW,
+                        LocalDateTime.now(),
                         fileSize,
-                        FIXED_NOW.minusDays(1));
+                        LocalDateTime.now().minusDays(1));
 
         assertEquals(expectedFormattedSize, fileInfo.getFormattedFileSize());
     }
@@ -47,9 +45,9 @@ public class FileInfoTest {
                     new FileInfo(
                             "example.txt",
                             "/path/to/example.txt",
-                            FIXED_NOW,
+                            LocalDateTime.now(),
                             123,
-                            FIXED_NOW.minusDays(1));
+                            LocalDateTime.now().minusDays(1));
 
             Path path = fi.getFilePathAsPath();
 
@@ -105,7 +103,7 @@ public class FileInfoTest {
                             "/path/to/example.txt",
                             null, // modificationDate null
                             1,
-                            FIXED_NOW);
+                            LocalDateTime.now());
 
             assertThrows(
                     NullPointerException.class,
@@ -122,7 +120,7 @@ public class FileInfoTest {
                     new FileInfo(
                             "example.txt",
                             "/path/to/example.txt",
-                            FIXED_NOW,
+                            LocalDateTime.now(),
                             1,
                             null); // creationDate null
 
@@ -144,9 +142,9 @@ public class FileInfoTest {
                     new FileInfo(
                             "example.txt",
                             "/path/to/example.txt",
-                            FIXED_NOW,
+                            LocalDateTime.now(),
                             1536, // 1.5 KB
-                            FIXED_NOW.minusDays(1));
+                            LocalDateTime.now().minusDays(1));
 
             assertEquals("1.50 KB", fi.getFormattedFileSize());
         }
@@ -160,9 +158,9 @@ public class FileInfoTest {
                     new FileInfo(
                             "example.txt",
                             "/path/to/example.txt",
-                            FIXED_NOW,
+                            LocalDateTime.now(),
                             twoTB,
-                            FIXED_NOW.minusDays(1));
+                            LocalDateTime.now().minusDays(1));
 
             // 2 TB equals 2048.00 GB with current implementation
             assertEquals(

app/common/src/test/java/stirling/software/common/model/InputStreamTemplateResourceTest.java

@@ -1,8 +1,16 @@
 package stirling.software.common.model;
 
-/* Commented out - InputStreamTemplateResource class removed with Thymeleaf migration
- * This test will be removed when frontend migration to React is complete
+import static org.junit.jupiter.api.Assertions.*;
 
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.io.Reader;
+import java.lang.reflect.Field;
+import java.lang.reflect.Modifier;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+
+import org.junit.jupiter.api.Test;
 
 public class InputStreamTemplateResourceTest {
 
@@ -40,7 +48,7 @@ public class InputStreamTemplateResourceTest {
     @Test
     void readerReturnsCorrectContent() throws Exception {
         String content = "Hello, world!";
-        InputStream is = new ByteArrayInputStream(content.getBytes("UTF-8"));
+        InputStream is = new ByteArrayInputStream(content.getBytes(StandardCharsets.UTF_8));
         InputStreamTemplateResource resource = new InputStreamTemplateResource(is, "UTF-8");
 
         try (Reader reader = resource.reader()) {
@@ -85,4 +93,3 @@ public class InputStreamTemplateResourceTest {
         assertFalse(resource.exists());
     }
 }
-*/

app/common/src/test/java/stirling/software/common/service/FileStorageTest.java

@@ -6,6 +6,7 @@ import static org.mockito.Mockito.*;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.UUID;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -82,7 +83,7 @@ class FileStorageTest {
     void testRetrieveFile() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-1";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -102,7 +103,7 @@ class FileStorageTest {
     void testRetrieveBytes() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-2";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -135,7 +136,7 @@ class FileStorageTest {
     void testDeleteFile() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-3";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 
@@ -163,7 +164,7 @@ class FileStorageTest {
     void testFileExists() throws IOException {
         // Arrange
         byte[] fileContent = "Test PDF content".getBytes();
-        String fileId = "test-file-4";
+        String fileId = UUID.randomUUID().toString();
         Path filePath = tempDir.resolve(fileId);
         Files.write(filePath, fileContent);
 

app/common/src/test/java/stirling/software/common/service/JobExecutorServiceTest.java

@@ -1,9 +1,6 @@
 package stirling.software.common.service;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
@@ -64,7 +61,7 @@ class JobExecutorServiceTest {
     }
 
     @Test
-    void shouldRunSyncJobSuccessfully() throws Exception {
+    void shouldRunSyncJobSuccessfully() {
         // Given
         Supplier<Object> work = () -> "test-result";
 
@@ -80,24 +77,7 @@ class JobExecutorServiceTest {
     }
 
     @Test
-    void shouldExposeJobIdInJobContextDuringSyncExecution() throws Exception {
-        // Given
-        Supplier<Object> work = stirling.software.common.util.JobContext::getJobId;
-
-        // When
-        ResponseEntity<?> response = jobExecutorService.runJobGeneric(false, work);
-
-        // Then
-        assertEquals(HttpStatus.OK, response.getStatusCode());
-        assertNotNull(response.getBody());
-
-        var requestJobIdCaptor = ArgumentCaptor.forClass(String.class);
-        verify(request).setAttribute(eq("jobId"), requestJobIdCaptor.capture());
-        assertEquals(requestJobIdCaptor.getValue(), response.getBody());
-    }
-
-    @Test
-    void shouldRunAsyncJobSuccessfully() throws Exception {
+    void shouldRunAsyncJobSuccessfully() {
         // Given
         Supplier<Object> work = () -> "test-result";
 
@@ -131,11 +111,12 @@ class JobExecutorServiceTest {
 
         @SuppressWarnings("unchecked")
         Map<String, String> errorMap = (Map<String, String>) response.getBody();
+        assertNotNull(errorMap);
         assertEquals("Job failed: Test error", errorMap.get("error"));
     }
 
     @Test
-    void shouldQueueJobWhenResourcesLimited() throws Exception {
+    void shouldQueueJobWhenResourcesLimited() {
         // Given
         Supplier<Object> work = () -> "test-result";
         CompletableFuture<ResponseEntity<?>> future = new CompletableFuture<>();
@@ -185,13 +166,13 @@ class JobExecutorServiceTest {
         // Given
         Supplier<Object> work =
                 () -> {
-                    // Simulate long-running job without actual sleep
-                    // Use a loop to consume time instead of Thread.sleep
-                    long startTime = System.nanoTime();
-                    while (System.nanoTime() - startTime < 100_000_000) { // 100ms in nanoseconds
-                        // Busy wait to simulate work without Thread.sleep
+                    try {
+                        Thread.sleep(100); // Simulate long-running job
+                        return "test-result";
+                    } catch (InterruptedException e) {
+                        Thread.currentThread().interrupt();
+                        throw new RuntimeException(e);
                     }
-                    return "test-result";
                 };
 
         // Use reflection to access the private executeWithTimeout method

app/common/src/test/java/stirling/software/common/service/ResourceMonitorTest.java

@@ -126,15 +126,12 @@ class ResourceMonitorTest {
 
     @Test
     void resourceMetricsShouldDetectStaleState() {
-        // Capture test time at the beginning for deterministic calculations
-        final Instant testTime = Instant.now();
-
         // Given
-        Instant pastInstant =
-                testTime.minusMillis(6000); // 6 seconds ago (relative to test start time)
+        Instant now = Instant.now();
+        Instant pastInstant = now.minusMillis(6000);
 
         ResourceMetrics staleMetrics = new ResourceMetrics(0.5, 0.5, 1024, 2048, 4096, pastInstant);
-        ResourceMetrics freshMetrics = new ResourceMetrics(0.5, 0.5, 1024, 2048, 4096, testTime);
+        ResourceMetrics freshMetrics = new ResourceMetrics(0.5, 0.5, 1024, 2048, 4096, now);
 
         // When/Then
         assertTrue(

app/common/src/test/java/stirling/software/common/service/TaskManagerTest.java

@@ -5,6 +5,7 @@ import static org.mockito.Mockito.*;
 
 import java.time.LocalDateTime;
 import java.util.Map;
+import java.util.UUID;
 
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -41,7 +42,7 @@ class TaskManagerTest {
     @Test
     void testCreateTask() {
         // Act
-        String jobId = "test-job-1";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
 
         // Assert
@@ -55,7 +56,7 @@ class TaskManagerTest {
     @Test
     void testSetResult() {
         // Arrange
-        String jobId = "test-job-2";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
         Object resultObject = "Test result";
 
@@ -73,7 +74,7 @@ class TaskManagerTest {
     @Test
     void testSetFileResult() throws Exception {
         // Arrange
-        String jobId = "test-job-3";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
         String fileId = "file-id";
         String originalFileName = "test.pdf";
@@ -107,7 +108,7 @@ class TaskManagerTest {
     @Test
     void testSetError() {
         // Arrange
-        String jobId = "test-job-4";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
         String errorMessage = "Test error";
 
@@ -125,7 +126,7 @@ class TaskManagerTest {
     @Test
     void testSetComplete_WithExistingResult() {
         // Arrange
-        String jobId = "test-job-5";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
         Object resultObject = "Test result";
         taskManager.setResult(jobId, resultObject);
@@ -143,7 +144,7 @@ class TaskManagerTest {
     @Test
     void testSetComplete_WithoutExistingResult() {
         // Arrange
-        String jobId = "test-job-6";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
 
         // Act
@@ -159,7 +160,7 @@ class TaskManagerTest {
     @Test
     void testIsComplete() {
         // Arrange
-        String jobId = "test-job-7";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
 
         // Assert - not complete initially
@@ -215,8 +216,6 @@ class TaskManagerTest {
 
     @Test
     void testCleanupOldJobs() {
-        // Capture test time at the beginning for deterministic calculations
-        final LocalDateTime testTime = LocalDateTime.now();
         // Arrange
         // 1. Create a recent completed job
         String recentJobId = "recent-job";
@@ -228,9 +227,8 @@ class TaskManagerTest {
         taskManager.createTask(oldJobId);
         JobResult oldJob = taskManager.getJobResult(oldJobId);
 
-        // Manually set the completion time to be older than the expiry (relative to test start
-        // time)
-        LocalDateTime oldTime = testTime.minusHours(1);
+        // Manually set the completion time to be older than the expiry
+        LocalDateTime oldTime = LocalDateTime.now().minusHours(1);
         ReflectionTestUtils.setField(oldJob, "completedAt", oldTime);
         ReflectionTestUtils.setField(oldJob, "complete", true);
 
@@ -282,7 +280,7 @@ class TaskManagerTest {
     @Test
     void testAddNote() {
         // Arrange
-        String jobId = "test-job-8";
+        String jobId = UUID.randomUUID().toString();
         taskManager.createTask(jobId);
         String note = "Test note";