translation additions (#6208 )

fix AUR, publish desktop not server for now (#6204 )
# Description of Changes  --- ## Checklist ### General - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [ ] I have performed a self-review of my own code - [ ] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have run `task check` to verify linters, typechecks, and tests pass - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details.
2026-04-24 14:02:13 +01:00 · 2026-04-24 10:45:58 +01:00 · 2026-04-23 17:22:47 +01:00 · 2026-04-23 15:56:31 +01:00 · 2026-04-23 14:52:25 +01:00 · 2026-04-23 13:19:27 +00:00
1785 changed files with 180687 additions and 122556 deletions
@@ -1,6 +1,8 @@
 # Version control
 .git/
 .gitignore
+.git-blame-ignore-revs
+.gitattributes

 # Build outputs
 build/
@@ -15,22 +17,34 @@ version_builds/
 # Gradle caches (local, not what's in the container)
 .gradle/
 **/.gradle/
+.gradle-home/
+
+# Task (go-task) cache
+.task/

 # Node / frontend
 node_modules/
 **/node_modules/
 frontend/node_modules/
 frontend/dist/
+frontend/playwright-report/
 .npm/
 .yarn/

 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
+frontend/src-tauri/target/
+frontend/src-tauri/dist/

 # IDE and editor
 .idea/
 .vscode/
+.settings/
+.settings.zip
+.classpath
+.project
+.devcontainer/
 *.iml
 *.ipr
 *.iws
@@ -41,6 +55,7 @@ src-tauri/dist/
 *.pid
 .DS_Store
 Thumbs.db
+logs/

 # Docker itself
 Dockerfile*
@@ -54,17 +69,38 @@ Dockerfile*
 # Test reports
 **/test-results/
 **/jacoco/
+test_*.pdf

 # Testing and documentation (not needed in build)
 testing/
 docs/
+devGuide/
+devTools/
 *.md
 README*

+# Separate projects not consumed by the Java/frontend build
+commonforms-onnx/
+
+# Runtime mount points used by docker-compose volumes, not build input
+stirling/
+customFiles/
+configs/
+
+# Claude Code workspace
+.claude/
+
+# Python caches
+.pytest_cache/
+.ruff_cache/
+__pycache__/
+**/__pycache__/
+
 # Local env
 .env
 .env.*
 !.env.example
+!engine/.env

 # Misc
 *.swp
@@ -72,4 +108,3 @@ README*
 *~
 .DS_Store
 .cache/
-.pytest_cache/
@@ -15,6 +15,7 @@ max_line_length = 100

 [*.py]
 indent_size = 4
+max_line_length = 120

 [*.gradle]
 indent_size = 4
@@ -0,0 +1,29 @@
+# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
+pkgname=stirling-pdf-desktop
+pkgver=2.7.3
+pkgrel=1
+pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
+arch=('x86_64')
+url="https://www.stirling.com"
+license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
+depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
+provides=('stirling-pdf')
+conflicts=('stirling-pdf' 'stirling-pdf-git' 'stirling-pdf-bin')
+options=('!strip')
+
+source_x86_64=("${pkgname}-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")
+sha256sums_x86_64=('PLACEHOLDER_DEB_SHA256')
+
+package() {
+    # Extract the .deb archive
+    bsdtar -xf data.tar* -C "${pkgdir}"
+
+    # Fix permissions
+    find "${pkgdir}" -type d -exec chmod 755 {} \;
+
+    # Install license
+    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<EOF
+Copyright (c) 2025 Stirling PDF Inc
+All rights reserved. See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
+EOF
+}
@@ -0,0 +1,77 @@
+# Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
+pkgname=stirling-pdf-server-bin
+pkgver=2.7.3
+pkgrel=1
+pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
+arch=('any')
+url="https://www.stirling.com"
+license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
+depends=('java-runtime>=25')
+provides=('stirling-pdf-server')
+conflicts=('stirling-pdf-server' 'stirling-pdf-server-git')
+backup=('etc/stirling-pdf-server/settings.yml')
+
+source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar")
+sha256sums=('PLACEHOLDER_JAR_SHA256')
+
+package() {
+    # JAR
+    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
+        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
+
+    # Wrapper script
+    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
+#!/bin/sh
+exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
+EOF
+
+    # systemd unit
+    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service" << 'EOF'
+[Unit]
+Description=Stirling-PDF Server
+After=network.target
+
+[Service]
+Type=simple
+User=stirling-pdf
+Group=stirling-pdf
+WorkingDirectory=/var/lib/stirling-pdf-server
+ExecStart=/usr/bin/java -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=stirling-pdf-server
+Environment=JAVA_OPTS=-Xmx512m
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    # sysusers
+    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf" << 'EOF'
+u stirling-pdf - "Stirling-PDF Server" /var/lib/stirling-pdf-server -
+EOF
+
+    # tmpfiles
+    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf" << 'EOF'
+d /var/lib/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
+d /var/log/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
+EOF
+
+    # Default config stub
+    install -dm755 "${pkgdir}/etc/stirling-pdf-server"
+    install -Dm644 /dev/stdin "${pkgdir}/etc/stirling-pdf-server/settings.yml" << 'EOF'
+# Stirling-PDF Server configuration
+# See https://github.com/Stirling-Tools/Stirling-PDF for all options
+server:
+  port: 8080
+EOF
+
+    # License
+    install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
+MIT License with proprietary carve-outs (open-core).
+SPDX: MIT AND LicenseRef-Stirling-PDF-Proprietary
+See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
+EOF
+}
@@ -46,8 +46,7 @@ frontend: &frontend
  - testing/**
  - docker/**
  - scripts/translations/*.py
-  - scripts/build-tauri-jlink.bat
-  - scripts/build-tauri-jlink.sh
+  - .taskfiles/desktop.yml
  - scripts/convert_cff_to_ttf.py
  - scripts/harvest_type3_fonts.py
  - scripts/ignore_translation.toml
@@ -16,7 +16,13 @@ updates:
    rebase-strategy: "auto"

  - package-ecosystem: "docker"
-    directory: "/" # Location of Dockerfile
+    directories:
+      - "/" # Location of Dockerfile
+      - "/docker/backend"
+      - "/docker/embedded"
+      - "/docker/frontend"
+      - "/docker/base"
+      - "/docker/engine"
    schedule:
      interval: "weekly"
    rebase-strategy: "auto"
@@ -28,37 +34,18 @@ updates:
    rebase-strategy: "auto"

  - package-ecosystem: npm
-    directory: /devTools
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/backend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/embedded
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: docker
-    directory: /docker/frontend
-    schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-
-  - package-ecosystem: npm
-    directory: /frontend
+    directories:
+      - /devTools
+      - /frontend
    schedule:
      interval: "weekly"
    rebase-strategy: "auto"

  - package-ecosystem: cargo
-    directory: /frontend/src-tauri
+    directories:
+      - /frontend/src-tauri
+      - /frontend/src-tauri/thumbnail-handler
+      - /frontend/src-tauri/provisioner
    schedule:
      interval: "weekly"
    rebase-strategy: "auto"
@@ -68,8 +55,3 @@ updates:
    schedule:
      interval: "weekly"
    rebase-strategy: "auto"
-
-  - package-ecosystem: cargo
-    directory: /frontend/src-tauri/provisioner
-    schedule:
-      interval: daily
@@ -17,7 +17,7 @@ Closes #(issue_number)
 ### General

 - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable)
+- [ ] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md) (if applicable)
 - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable)
 - [ ] I have performed a self-review of my own code
 - [ ] My changes generate no new warnings
@@ -37,4 +37,5 @@ Closes #(issue_number)

 ### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.
+- [ ] I have run `task check` to verify linters, typechecks, and tests pass
+- [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing) for more details.
@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
    # via
-    #   -r requirements_dev.in
+    #   -r .github/scripts/requirements_dev.in
    #   fonttools
 cffi==2.0.0 \
    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -101,270 +101,274 @@ cfgv==3.5.0 \
    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
    # via pre-commit
-cssselect2==0.8.0 \
-    --hash=sha256:46fc70ebc41ced7a32cd42d58b1884d72ade23d21e5a4eaaf022401c13f0e76e \
-    --hash=sha256:7674ffb954a3b46162392aee2a3a0aedb2e14ecf99fcc28644900f4e6e3e9d3a
+cssselect2==0.9.0 \
+    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
+    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
    # via weasyprint
 distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.3 \
-    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
-    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
-    # via virtualenv
-fonttools==4.61.1 \
-    --hash=sha256:0de30bfe7745c0d1ffa2b0b7048fb7123ad0d71107e10ee090fa0b16b9452e87 \
-    --hash=sha256:10d88e55330e092940584774ee5e8a6971b01fc2f4d3466a1d6c158230880796 \
-    --hash=sha256:11f35ad7805edba3aac1a3710d104592df59f4b957e30108ae0ba6c10b11dd75 \
-    --hash=sha256:15acc09befd16a0fb8a8f62bc147e1a82817542d72184acca9ce6e0aeda9fa6d \
-    --hash=sha256:17d2bf5d541add43822bcf0c43d7d847b160c9bb01d15d5007d84e2217aaa371 \
-    --hash=sha256:2180f14c141d2f0f3da43f3a81bc8aa4684860f6b0e6f9e165a4831f24e6a23b \
-    --hash=sha256:21e7c8d76f62ab13c9472ccf74515ca5b9a761d1bde3265152a6dc58700d895b \
-    --hash=sha256:41a7170d042e8c0024703ed13b71893519a1a6d6e18e933e3ec7507a2c26a4b2 \
-    --hash=sha256:41ed4b5ec103bd306bb68f81dc166e77409e5209443e5773cb4ed837bcc9b0d3 \
-    --hash=sha256:497c31ce314219888c0e2fce5ad9178ca83fe5230b01a5006726cdf3ac9f24d9 \
-    --hash=sha256:4c1b526c8d3f615a7b1867f38a9410849c8f4aef078535742198e942fba0e9bd \
-    --hash=sha256:4d7092bb38c53bbc78e9255a59158b150bcdc115a1e3b3ce0b5f267dc35dd63c \
-    --hash=sha256:4f5686e1fe5fce75d82d93c47a438a25bf0d1319d2843a926f741140b2b16e0c \
-    --hash=sha256:58b0ee0ab5b1fc9921eccfe11d1435added19d6494dde14e323f25ad2bc30c56 \
-    --hash=sha256:5ce02f38a754f207f2f06557523cd39a06438ba3aafc0639c477ac409fc64e37 \
-    --hash=sha256:5fade934607a523614726119164ff621e8c30e8fa1ffffbbd358662056ba69f0 \
-    --hash=sha256:5fe9fd43882620017add5eabb781ebfbc6998ee49b35bd7f8f79af1f9f99a958 \
-    --hash=sha256:64102ca87e84261419c3747a0d20f396eb024bdbeb04c2bfb37e2891f5fadcb5 \
-    --hash=sha256:664c5a68ec406f6b1547946683008576ef8b38275608e1cee6c061828171c118 \
-    --hash=sha256:6675329885c44657f826ef01d9e4fb33b9158e9d93c537d84ad8399539bc6f69 \
-    --hash=sha256:75c1a6dfac6abd407634420c93864a1e274ebc1c7531346d9254c0d8f6ca00f9 \
-    --hash=sha256:75da8f28eff26defba42c52986de97b22106cb8f26515b7c22443ebc9c2d3261 \
-    --hash=sha256:77efb033d8d7ff233385f30c62c7c79271c8885d5c9657d967ede124671bbdfb \
-    --hash=sha256:78a7d3ab09dc47ac1a363a493e6112d8cabed7ba7caad5f54dbe2f08676d1b47 \
-    --hash=sha256:7c7db70d57e5e1089a274cbb2b1fd635c9a24de809a231b154965d415d6c6d24 \
-    --hash=sha256:8c56c488ab471628ff3bfa80964372fc13504ece601e0d97a78ee74126b2045c \
-    --hash=sha256:91669ccac46bbc1d09e9273546181919064e8df73488ea087dcac3e2968df9ba \
-    --hash=sha256:9b666a475a65f4e839d3d10473fad6d47e0a9db14a2f4a224029c5bfde58ad2c \
-    --hash=sha256:9cfef3ab326780c04d6646f68d4b4742aae222e8b8ea1d627c74e38afcbc9d91 \
-    --hash=sha256:a13fc8aeb24bad755eea8f7f9d409438eb94e82cf86b08fe77a03fbc8f6a96b1 \
-    --hash=sha256:a75c301f96db737e1c5ed5fd7d77d9c34466de16095a266509e13da09751bd19 \
-    --hash=sha256:a76d4cb80f41ba94a6691264be76435e5f72f2cb3cab0b092a6212855f71c2f6 \
-    --hash=sha256:aed04cabe26f30c1647ef0e8fbb207516fd40fe9472e9439695f5c6998e60ac5 \
-    --hash=sha256:b148b56f5de675ee16d45e769e69f87623a4944f7443850bf9a9376e628a89d2 \
-    --hash=sha256:b501c862d4901792adaec7c25b1ecc749e2662543f68bb194c42ba18d6eec98d \
-    --hash=sha256:b846a1fcf8beadeb9ea4f44ec5bdde393e2f1569e17d700bfc49cd69bde75881 \
-    --hash=sha256:b931ae8f62db78861b0ff1ac017851764602288575d65b8e8ff1963fed419063 \
-    --hash=sha256:c33ab3ca9d3ccd581d58e989d67554e42d8d4ded94ab3ade3508455fe70e65f7 \
-    --hash=sha256:c6604b735bb12fef8e0efd5578c9fb5d3d8532d5001ea13a19cddf295673ee09 \
-    --hash=sha256:d8db08051fc9e7d8bc622f2112511b8107d8f27cd89e2f64ec45e9825e8288da \
-    --hash=sha256:d9203500f7c63545b4ce3799319fe4d9feb1a1b89b28d3cb5abd11b9dd64147e \
-    --hash=sha256:dc492779501fa723b04d0ab1f5be046797fee17d27700476edc7ee9ae535a61e \
-    --hash=sha256:e6bcdf33aec38d16508ce61fd81838f24c83c90a1d1b8c68982857038673d6b8 \
-    --hash=sha256:e76ce097e3c57c4bcb67c5aa24a0ecdbd9f74ea9219997a707a4061fbe2707aa \
-    --hash=sha256:eff1ac3cc66c2ac7cda1e64b4e2f3ffef474b7335f92fc3833fc632d595fcee6 \
-    --hash=sha256:f3cb4a569029b9f291f88aafc927dd53683757e640081ca8c412781ea144565e \
-    --hash=sha256:f79b168428351d11e10c5aeb61a74e1851ec221081299f4cf56036a95431c43a \
-    --hash=sha256:fa646ecec9528bef693415c79a86e733c70a4965dd938e9a226b0fc64c9d2e6c \
-    --hash=sha256:fe2efccb324948a11dd09d22136fe2ac8a97d6c1347cf0b58a911dcd529f66b7 \
-    --hash=sha256:fff4f534200a04b4a36e7ae3cb74493afe807b517a09e99cb4faa89a34ed6ecd
+filelock==3.29.0 \
+    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
+    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+    # via
+    #   python-discovery
+    #   virtualenv
+fonttools==4.62.1 \
+    --hash=sha256:0aa72c43a601cfa9273bb1ae0518f1acadc01ee181a6fc60cd758d7fdadffc04 \
+    --hash=sha256:0b3ae47e8636156a9accff64c02c0924cbebad62854c4a6dbdc110cd5b4b341a \
+    --hash=sha256:12859ff0b47dd20f110804c3e0d0970f7b832f561630cd879969011541a464a9 \
+    --hash=sha256:149f7d84afca659d1a97e39a4778794a2f83bf344c5ee5134e09995086cc2392 \
+    --hash=sha256:1596aeaddf7f78e21e68293c011316a25267b3effdaccaf4d59bc9159d681b82 \
+    --hash=sha256:19177c8d96c7c36359266e571c5173bcee9157b59cfc8cb0153c5673dc5a3a7d \
+    --hash=sha256:1c5c25671ce8805e0d080e2ffdeca7f1e86778c5cbfbeae86d7f866d8830517b \
+    --hash=sha256:1eecc128c86c552fb963fe846ca4e011b1be053728f798185a1687502f6d398e \
+    --hash=sha256:268abb1cb221e66c014acc234e872b7870d8b5d4657a83a8f4205094c32d2416 \
+    --hash=sha256:2d850f66830a27b0d498ee05adb13a3781637b1826982cd7e2b3789ef0cc71ae \
+    --hash=sha256:2e7abd2b1e11736f58c1de27819e1955a53267c21732e78243fa2fa2e5c1e069 \
+    --hash=sha256:403d28ce06ebfc547fbcb0cb8b7f7cc2f7a2d3e1a67ba9a34b14632df9e080f9 \
+    --hash=sha256:40975849bac44fb0b9253d77420c6d8b523ac4dcdcefeff6e4d706838a5b80f7 \
+    --hash=sha256:486f32c8047ccd05652aba17e4a8819a3a9d78570eb8a0e3b4503142947880ed \
+    --hash=sha256:49a445d2f544ce4a69338694cad575ba97b9a75fff02720da0882d1a73f12800 \
+    --hash=sha256:59b372b4f0e113d3746b88985f1c796e7bf830dd54b28374cd85c2b8acd7583e \
+    --hash=sha256:5a648bde915fba9da05ae98856987ca91ba832949a9e2888b48c47ef8b96c5a9 \
+    --hash=sha256:5f37df1cac61d906e7b836abe356bc2f34c99d4477467755c216b72aa3dc748b \
+    --hash=sha256:6706d1cb1d5e6251a97ad3c1b9347505c5615c112e66047abbef0f8545fa30d1 \
+    --hash=sha256:68959f5fc58ed4599b44aad161c2837477d7f35f5f79402d97439974faebfebe \
+    --hash=sha256:6acb4109f8bee00fec985c8c7afb02299e35e9c94b57287f3ea542f28bd0b0a7 \
+    --hash=sha256:7487782e2113861f4ddcc07c3436450659e3caa5e470b27dc2177cade2d8e7fd \
+    --hash=sha256:7aa21ff53e28a9c2157acbc44e5b401149d3c9178107130e82d74ceb500e5056 \
+    --hash=sha256:7bca7a1c1faf235ffe25d4f2e555246b4750220b38de8261d94ebc5ce8a23c23 \
+    --hash=sha256:8d337fdd49a79b0d51c4da87bc38169d21c3abbf0c1aa9367eff5c6656fb6dae \
+    --hash=sha256:8f8fca95d3bb3208f59626a4b0ea6e526ee51f5a8ad5d91821c165903e8d9260 \
+    --hash=sha256:90365821debbd7db678809c7491ca4acd1e0779b9624cdc6ddaf1f31992bf974 \
+    --hash=sha256:92bb00a947e666169c99b43753c4305fc95a890a60ef3aeb2a6963e07902cc87 \
+    --hash=sha256:93c316e0f5301b2adbe6a5f658634307c096fd5aae60a5b3412e4f3e1728ab24 \
+    --hash=sha256:942b03094d7edbb99bdf1ae7e9090898cad7bf9030b3d21f33d7072dbcb51a53 \
+    --hash=sha256:9c125ffa00c3d9003cdaaf7f2c79e6e535628093e14b5de1dccb08859b680936 \
+    --hash=sha256:9dde91633f77fa576879a0c76b1d89de373cae751a98ddf0109d54e173b40f14 \
+    --hash=sha256:9e7863e10b3de72376280b515d35b14f5eeed639d1aa7824f4cf06779ec65e42 \
+    --hash=sha256:a24decd24d60744ee8b4679d38e88b8303d86772053afc29b19d23bb8207803c \
+    --hash=sha256:a5d8825e1140f04e6c99bb7d37a9e31c172f3bc208afbe02175339e699c710e1 \
+    --hash=sha256:aa69d10ed420d8121118e628ad47d86e4caa79ba37f968597b958f6cceab7eca \
+    --hash=sha256:ad5cca75776cd453b1b035b530e943334957ae152a36a88a320e779d61fc980c \
+    --hash=sha256:b4e0fcf265ad26e487c56cb12a42dffe7162de708762db951e1b3f755319507d \
+    --hash=sha256:b820fcb92d4655513d8402d5b219f94481c4443d825b4372c75a2072aa4b357a \
+    --hash=sha256:bd13b7999d59c5eb1c2b442eb2d0c427cb517a0b7a1f5798fc5c9e003f5ff782 \
+    --hash=sha256:bdfe592802ef939a0e33106ea4a318eeb17822c7ee168c290273cbd5fabd746c \
+    --hash=sha256:c05557a78f8fa514da0f869556eeda40887a8abc77c76ee3f74cf241778afd5a \
+    --hash=sha256:c22b1014017111c401469e3acc5433e6acf6ebcc6aa9efb538a533c800971c79 \
+    --hash=sha256:c9b9e288b4da2f64fd6180644221749de651703e8d0c16bd4b719533a3a7d6e3 \
+    --hash=sha256:d241cdc4a67b5431c6d7f115fdf63335222414995e3a1df1a41e1182acd4bcc7 \
+    --hash=sha256:e54c75fd6041f1122476776880f7c3c3295ffa31962dc6ebe2543c00dca58b5d \
+    --hash=sha256:e8514f4924375f77084e81467e63238b095abda5107620f49421c368a6017ed2 \
+    --hash=sha256:ee91628c08e76f77b533d65feb3fbe6d9dad699f95be51cf0d022db94089cdc4 \
+    --hash=sha256:ef46db46c9447103b8f3ff91e8ba009d5fe181b1920a83757a5762551e32bb68 \
+    --hash=sha256:fa1d16210b6b10a826d71bed68dd9ec24a9e218d5a5e2797f37c573e7ec215ca
    # via weasyprint
-identify==2.6.16 \
-    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
-    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
    # via pre-commit
 nodeenv==1.10.0 \
    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
    # via pre-commit
-numpy==2.4.1 \
-    --hash=sha256:0093e85df2960d7e4049664b26afc58b03236e967fb942354deef3208857a04c \
-    --hash=sha256:09aa8a87e45b55a1c2c205d42e2808849ece5c484b2aab11fecabec3841cafba \
-    --hash=sha256:0cce2a669e3c8ba02ee563c7835f92c153cf02edff1ae05e1823f1dde21b16a5 \
-    --hash=sha256:0e6e8f9d9ecf95399982019c01223dc130542960a12edfa8edd1122dfa66a8a8 \
-    --hash=sha256:0f118ce6b972080ba0758c6087c3617b5ba243d806268623dc34216d69099ba0 \
-    --hash=sha256:178de8f87948163d98a4c9ab5bee4ce6519ca918926ec8df195af582de28544d \
-    --hash=sha256:18e14c4d09d55eef39a6ab5b08406e84bc6869c1e34eef45564804f90b7e0574 \
-    --hash=sha256:2023ef86243690c2791fd6353e5b4848eedaa88ca8a2d129f462049f6d484696 \
-    --hash=sha256:20d4649c773f66cc2fc36f663e091f57c3b7655f936a4c681b4250855d1da8f5 \
-    --hash=sha256:2302dc0224c1cbc49bb94f7064f3f923a971bfae45c33870dcbff63a2a550505 \
-    --hash=sha256:26f0bcd9c79a00e339565b303badc74d3ea2bd6d52191eeca5f95936cad107d0 \
-    --hash=sha256:297c72b1b98100c2e8f873d5d35fb551fce7040ade83d67dd51d38c8d42a2162 \
-    --hash=sha256:2f44de05659b67d20499cbc96d49f2650769afcb398b79b324bb6e297bfe3844 \
-    --hash=sha256:2ffd257026eb1b34352e749d7cc1678b5eeec3e329ad8c9965a797e08ccba205 \
-    --hash=sha256:382ad67d99ef49024f11d1ce5dcb5ad8432446e4246a4b014418ba3a1175a1f4 \
-    --hash=sha256:3869ea1ee1a1edc16c29bbe3a2f2a4e515cc3a44d43903ad41e0cacdbaf733dc \
-    --hash=sha256:3d1a100e48cb266090a031397863ff8a30050ceefd798f686ff92c67a486753d \
-    --hash=sha256:423797bdab2eeefbe608d7c1ec7b2b4fd3c58d51460f1ee26c7500a1d9c9ee93 \
-    --hash=sha256:42d7dd5fa36d16d52a84f821eb96031836fd405ee6955dd732f2023724d0aa01 \
-    --hash=sha256:49e792ec351315e16da54b543db06ca8a86985ab682602d90c60ef4ff4db2a9c \
-    --hash=sha256:4e53170557d37ae404bf8d542ca5b7c629d6efa1117dac6a83e394142ea0a43f \
-    --hash=sha256:4f1b68ff47680c2925f8063402a693ede215f0257f02596b1318ecdfb1d79e33 \
-    --hash=sha256:4f9c360ecef085e5841c539a9a12b883dff005fbd7ce46722f5e9cef52634d82 \
-    --hash=sha256:529050522e983e00a6c1c6b67411083630de8b57f65e853d7b03d9281b8694d2 \
-    --hash=sha256:52b5f61bdb323b566b528899cc7db2ba5d1015bda7ea811a8bcf3c89c331fa42 \
-    --hash=sha256:538bf4ec353709c765ff75ae616c34d3c3dca1a68312727e8f2676ea644f8509 \
-    --hash=sha256:5adf01965456a664fc727ed69cc71848f28d063217c63e1a0e200a118d5eec9a \
-    --hash=sha256:5b55aa56165b17aaf15520beb9cbd33c9039810e0d9643dd4379e44294c7303e \
-    --hash=sha256:5d558123217a83b2d1ba316b986e9248a1ed1971ad495963d555ccd75dcb1556 \
-    --hash=sha256:5de60946f14ebe15e713a6f22850c2372fa72f4ff9a432ab44aa90edcadaa65a \
-    --hash=sha256:62fea415f83ad8fdb6c20840578e5fbaf5ddd65e0ec6c3c47eda0f69da172510 \
-    --hash=sha256:6436cffb4f2bf26c974344439439c95e152c9a527013f26b3577be6c2ca64295 \
-    --hash=sha256:6461de5113088b399d655d45c3897fa188766415d0f568f175ab071c8873bd73 \
-    --hash=sha256:69e7419c9012c4aaf695109564e3387f1259f001b4326dfa55907b098af082d3 \
-    --hash=sha256:71abbea030f2cfc3092a0ff9f8c8fdefdc5e0bf7d9d9c99663538bb0ecdac0b9 \
-    --hash=sha256:7211b95ca365519d3596a1d8688a95874cc94219d417504d9ecb2df99fa7bfa8 \
-    --hash=sha256:727c6c3275ddefa0dc078524a85e064c057b4f4e71ca5ca29a19163c607be745 \
-    --hash=sha256:79e9e06c4c2379db47f3f6fc7a8652e7498251789bf8ff5bd43bf478ef314ca2 \
-    --hash=sha256:7ad270f438cbdd402c364980317fb6b117d9ec5e226fff5b4148dd9aa9fc6e02 \
-    --hash=sha256:7d5d7999df434a038d75a748275cd6c0094b0ecdb0837342b332a82defc4dc4d \
-    --hash=sha256:8097529164c0f3e32bb89412a0905d9100bf434d9692d9fc275e18dcf53c9344 \
-    --hash=sha256:82c55962006156aeef1629b953fd359064aa47e4d82cfc8e67f0918f7da3344f \
-    --hash=sha256:8361ea4220d763e54cff2fbe7d8c93526b744f7cd9ddab47afeff7e14e8503be \
-    --hash=sha256:899d2c18024984814ac7e83f8f49d8e8180e2fbe1b2e252f2e7f1d06bea92425 \
-    --hash=sha256:8ad35f20be147a204e28b6a0575fbf3540c5e5f802634d4258d55b1ff5facce1 \
-    --hash=sha256:8f085da926c0d491ffff3096f91078cc97ea67e7e6b65e490bc8dcda65663be2 \
-    --hash=sha256:9171a42fcad32dcf3fa86f0a4faa5e9f8facefdb276f54b8b390d90447cff4e2 \
-    --hash=sha256:92a0e65272fd60bfa0d9278e0484c2f52fe03b97aedc02b357f33fe752c52ffb \
-    --hash=sha256:941c2a93313d030f219f3a71fd3d91a728b82979a5e8034eb2e60d394a2b83f9 \
-    --hash=sha256:98b35775e03ab7f868908b524fc0a84d38932d8daf7b7e1c3c3a1b6c7a2c9f15 \
-    --hash=sha256:a1ceafc5042451a858231588a104093474c6a5c57dcc724841f5c888d237d690 \
-    --hash=sha256:a73044b752f5d34d4232f25f18160a1cc418ea4507f5f11e299d8ac36875f8a0 \
-    --hash=sha256:a7870e8c5fc11aef57d6fea4b4085e537a3a60ad2cdd14322ed531fdca68d261 \
-    --hash=sha256:a92f227dbcdc9e4c3e193add1a189a9909947d4f8504c576f4a732fd0b54240a \
-    --hash=sha256:ac08c63cb7779b85e9d5318e6c3518b424bc1f364ac4cb2c6136f12e5ff2dccc \
-    --hash=sha256:b6bcf39112e956594b3331316d90c90c90fb961e39696bda97b89462f5f3943f \
-    --hash=sha256:c0faba4a331195bfa96f93dd9dfaa10b2c7aa8cda3a02b7fd635e588fe821bf5 \
-    --hash=sha256:ce9ce141a505053b3c7bce3216071f3bf5c182b8b28930f14cd24d43932cd2df \
-    --hash=sha256:cf6470d91d34bf669f61d515499859fa7a4c2f7c36434afb70e82df7217933f9 \
-    --hash=sha256:d3703409aac693fa82c0aee023a1ae06a6e9d065dba10f5e8e80f642f1e9d0a2 \
-    --hash=sha256:d3e3087f53e2b4428766b54932644d148613c5a595150533ae7f00dab2f319a8 \
-    --hash=sha256:d3f8f0df9f4b8be57b3bf74a1d087fec68f927a2fab68231fdb442bf2c12e426 \
-    --hash=sha256:d797454e37570cfd61143b73b8debd623c3c0952959adb817dd310a483d58a1b \
-    --hash=sha256:e1a27bb1b2dee45a2a53f5ca6ff2d1a7f135287883a1689e930d44d1ff296c87 \
-    --hash=sha256:e3bd2cb07841166420d2fa7146c96ce00cb3410664cbc1a6be028e456c4ee220 \
-    --hash=sha256:e7b6b5e28bbd47b7532698e5db2fe1db693d84b58c254e4389d99a27bb9b8f6b \
-    --hash=sha256:e867df947d427cdd7a60e3e271729090b0f0df80f5f10ab7dd436f40811699c3 \
-    --hash=sha256:ea66d2b41ca4a1630aae5507ee0a71647d3124d1741980138aa8f28f44dac36e \
-    --hash=sha256:edee228f76ee2dab4579fad6f51f6a305de09d444280109e0f75df247ff21501 \
-    --hash=sha256:f0a90aba7d521e6954670550e561a4cb925713bd944445dbe9e729b71f6cabee \
-    --hash=sha256:f93bc6892fe7b0663e5ffa83b61aab510aacffd58c16e012bb9352d489d90cb7 \
-    --hash=sha256:fb1461c99de4d040666ca0444057b06541e5642f800b71c56e6ea92d6a853a0c
+numpy==2.4.4 \
+    --hash=sha256:07077278157d02f65c43b1b26a3886bce886f95d20aabd11f87932750dfb14ed \
+    --hash=sha256:08f2e31ed5e6f04b118e49821397f12767934cfdd12a1ce86a058f91e004ee50 \
+    --hash=sha256:0aec54fd785890ecca25a6003fd9a5aed47ad607bbac5cd64f836ad8666f4959 \
+    --hash=sha256:0d35aea54ad1d420c812bfa0385c71cd7cc5bcf7c65fed95fc2cd02fe8c79827 \
+    --hash=sha256:0d4e437e295f18ec29bc79daf55e8a47a9113df44d66f702f02a293d93a2d6dd \
+    --hash=sha256:0dfd3f9d3adbe2920b68b5cd3d51444e13a10792ec7154cd0a2f6e74d4ab3233 \
+    --hash=sha256:1378871da56ca8943c2ba674530924bb8ca40cd228358a3b5f302ad60cf875fc \
+    --hash=sha256:15716cfef24d3a9762e3acdf87e27f58dc823d1348f765bbea6bef8c639bfa1b \
+    --hash=sha256:19710a9ca9992d7174e9c52f643d4272dcd1558c5f7af7f6f8190f633bd651a7 \
+    --hash=sha256:23cbfd4c17357c81021f21540da84ee282b9c8fba38a03b7b9d09ba6b951421e \
+    --hash=sha256:2483e4584a1cb3092da4470b38866634bafb223cbcd551ee047633fd2584599a \
+    --hash=sha256:27a8d92cd10f1382a67d7cf4db7ce18341b66438bdd9f691d7b0e48d104c2a9d \
+    --hash=sha256:28a650663f7314afc3e6ec620f44f333c386aad9f6fc472030865dc0ebb26ee3 \
+    --hash=sha256:2aa0613a5177c264ff5921051a5719d20095ea586ca88cc802c5c218d1c67d3e \
+    --hash=sha256:2c194dd721e54ecad9ad387c1d35e63dce5c4450c6dc7dd5611283dda239aabb \
+    --hash=sha256:2d19e6e2095506d1736b7d80595e0f252d76b89f5e715c35e06e937679ea7d7a \
+    --hash=sha256:2d390634c5182175533585cc89f3608a4682ccb173cc9bb940b2881c8d6f8fa0 \
+    --hash=sha256:30caa73029a225b2d40d9fae193e008e24b2026b7ee1a867b7ee8d96ca1a448e \
+    --hash=sha256:42c16925aa5a02362f986765f9ebabf20de75cdefdca827d14315c568dcab113 \
+    --hash=sha256:45dbed2ab436a9e826e302fcdcbe9133f9b0006e5af7168afb8963a6520da103 \
+    --hash=sha256:4636de7fd195197b7535f231b5de9e4b36d2c440b6e566d2e4e4746e6af0ca93 \
+    --hash=sha256:4a19d9dba1a76618dd86b164d608566f393f8ec6ac7c44f0cc879011c45e65af \
+    --hash=sha256:4bbc7f303d125971f60ec0aaad5e12c62d0d2c925f0ab1273debd0e4ba37aba5 \
+    --hash=sha256:4d6d57903571f86180eb98f8f0c839fa9ebbfb031356d87f1361be91e433f5b7 \
+    --hash=sha256:4e874c976154687c1f71715b034739b45c7711bec81db01914770373d125e392 \
+    --hash=sha256:51fc224f7ca4d92656d5a5eb315f12eb5fe2c97a66249aa7b5f562528a3be38c \
+    --hash=sha256:58c8b5929fcb8287cbd6f0a3fae19c6e03a5c48402ae792962ac465224a629a4 \
+    --hash=sha256:5a285b3b96f951841799528cd1f4f01cd70e7e0204b4abebac9463eecfcf2a40 \
+    --hash=sha256:5c70f1cc1c4efbe316a572e2d8b9b9cc44e89b95f79ca3331553fbb63716e2bf \
+    --hash=sha256:62d6b0f03b694173f9fcb1fb317f7222fd0b0b103e784c6549f5e53a27718c44 \
+    --hash=sha256:6a246d5914aa1c820c9443ddcee9c02bec3e203b0c080349533fae17727dfd1b \
+    --hash=sha256:6aa3236c78803afbcb255045fbef97a9e25a1f6c9888357d205ddc42f4d6eba5 \
+    --hash=sha256:6bbe4eb67390b0a0265a2c25458f6b90a409d5d069f1041e6aff1e27e3d9a79e \
+    --hash=sha256:715d1c092715954784bc79e1174fc2a90093dc4dc84ea15eb14dad8abdcdeb74 \
+    --hash=sha256:72944b19f2324114e9dc86a159787333b77874143efcf89a5167ef83cfee8af0 \
+    --hash=sha256:81f4a14bee47aec54f883e0cad2d73986640c1590eb9bfaaba7ad17394481e6e \
+    --hash=sha256:846300f379b5b12cc769334464656bc882e0735d27d9726568bc932fdc49d5ec \
+    --hash=sha256:86b6f55f5a352b48d7fbfd2dbc3d5b780b2d79f4d3c121f33eb6efb22e9a2015 \
+    --hash=sha256:874f200b2a981c647340f841730fc3a2b54c9d940566a3c4149099591e2c4c3d \
+    --hash=sha256:8a87ec22c87be071b6bdbd27920b129b94f2fc964358ce38f3822635a3e2e03d \
+    --hash=sha256:8b3b60bb7cba2c8c81837661c488637eee696f59a877788a396d33150c35d842 \
+    --hash=sha256:8e3ed142f2728df44263aaf5fb1f5b0b99f4070c553a0d7f033be65338329150 \
+    --hash=sha256:93e15038125dc1e5345d9b5b68aa7f996ec33b98118d18c6ca0d0b7d6198b7e8 \
+    --hash=sha256:989824e9faf85f96ec9c7761cd8d29c531ad857bfa1daa930cba85baaecf1a9a \
+    --hash=sha256:99d838547ace2c4aace6c4f76e879ddfe02bb58a80c1549928477862b7a6d6ed \
+    --hash=sha256:9b2aec6af35c113b05695ebb5749a787acd63cafc83086a05771d1e1cd1e555f \
+    --hash=sha256:9c585a1790d5436a5374bac930dad6ed244c046ed91b2b2a3634eb2971d21008 \
+    --hash=sha256:a7164afb23be6e37ad90b2f10426149fd75aee07ca55653d2aa41e66c4ef697e \
+    --hash=sha256:ac6b31e35612a26483e20750126d30d0941f949426974cace8e6b5c58a3657b0 \
+    --hash=sha256:ad2e2ef14e0b04e544ea2fa0a36463f847f113d314aa02e5b402fdf910ef309e \
+    --hash=sha256:b268594bccac7d7cf5844c7732e3f20c50921d94e36d7ec9b79e9857694b1b2f \
+    --hash=sha256:b5f0362dc928a6ecd9db58868fca5e48485205e3855957bdedea308f8672ea4a \
+    --hash=sha256:ba1f4fc670ed79f876f70082eff4f9583c15fb9a4b89d6188412de4d18ae2f40 \
+    --hash=sha256:ba203255017337d39f89bdd58417f03c4426f12beed0440cfd933cb15f8669c7 \
+    --hash=sha256:c901b15172510173f5cb310eae652908340f8dede90fff9e3bf6c0d8dfd92f83 \
+    --hash=sha256:c9b39d38a9bd2ae1becd7eac1303d031c5c110ad31f2b319c6e7d98b135c934d \
+    --hash=sha256:d2a8490669bfe99a233298348acc2d824d496dee0e66e31b66a6022c2ad74a5c \
+    --hash=sha256:dddbbd259598d7240b18c9d87c56a9d2fb3b02fe266f49a7c101532e78c1d871 \
+    --hash=sha256:df3775294accfdd75f32c74ae39fcba920c9a378a2fc18a12b6820aa8c1fb502 \
+    --hash=sha256:e44319a2953c738205bf3354537979eaa3998ed673395b964c1176083dd46252 \
+    --hash=sha256:e4a010c27ff6f210ff4c6ef34394cd61470d01014439b192ec22552ee867f2a8 \
+    --hash=sha256:e823b8b6edc81e747526f70f71a9c0a07ac4e7ad13020aa736bb7c9d67196115 \
+    --hash=sha256:e892aff75639bbef0d2a2cfd55535510df26ff92f63c92cd84ef8d4ba5a5557f \
+    --hash=sha256:eea7ac5d2dce4189771cedb559c738a71512768210dc4e4753b107a2048b3d0e \
+    --hash=sha256:ef4059d6e5152fa1a39f888e344c73fdc926e1b2dd58c771d67b0acfbf2aa67d \
+    --hash=sha256:f169b9a863d34f5d11b8698ead99febeaa17a13ca044961aa8e2662a6c7766a0 \
+    --hash=sha256:f2cf083b324a467e1ab358c105f6cad5ea950f50524668a80c486ff1db24e119 \
+    --hash=sha256:f8474c4241bc18b750be2abea9d7a9ec84f46ef861dbacf86a4f6e043401f79e \
+    --hash=sha256:f983334aea213c99992053ede6168500e5f086ce74fbc4acc3f2b00f5762e9db \
+    --hash=sha256:f9e75681b59ddaa5e659898085ae0eaea229d054f2ac0c7e563a62205a700121 \
+    --hash=sha256:fbc356aae7adf9e6336d336b9c8111d390a05df88f1805573ebb0807bd06fd1d \
+    --hash=sha256:fcfe2045fd2e8f3cb0ce9d4ba6dba6333b8fa05bb8a4939c908cd43322d14c7e
    # via opencv-python-headless
-opencv-python-headless==4.13.0.90 \
-    --hash=sha256:0e0c8c9f620802fddc4fa7f471a1d263c7b0dca16cd9e7e2f996bb8bd2128c0c \
-    --hash=sha256:12a28674f215542c9bf93338de1b5bffd76996d32da9acb9e739fdb9c8bbd738 \
-    --hash=sha256:32255203040dc98803be96362e13f9e4bce20146898222d2e5c242f80de50da5 \
-    --hash=sha256:96060fc57a1abb1144b0b8129e2ff3bfcdd0ccd8e8bd05bd85256ff4ed587d3b \
-    --hash=sha256:dbc1f4625e5af3a80ebdbd84380227c0f445228588f2521b11af47710caca1ba \
-    --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
-    --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
-    --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
-    # via -r requirements_dev.in
+opencv-python-headless==4.13.0.92 \
+    --hash=sha256:0525a3d2c0b46c611e2130b5fdebc94cf404845d8fa64d2f3a3b679572a5bd22 \
+    --hash=sha256:0bd48544f77c68b2941392fcdf9bcd2b9cdf00e98cb8c29b2455d194763cf99e \
+    --hash=sha256:1a7d040ac656c11b8c38677cc8cccdc149f98535089dbe5b081e80a4e5903209 \
+    --hash=sha256:3e0a6f0a37994ec6ce5f59e936be21d5d6384a4556f2d2da9c2f9c5dc948394c \
+    --hash=sha256:5c8cfc8e87ed452b5cecb9419473ee5560a989859fe1d10d1ce11ae87b09a2cb \
+    --hash=sha256:77a82fe35ddcec0f62c15f2ba8a12ecc2ed4207c17b0902c7a3151ae29f37fb6 \
+    --hash=sha256:a7cf08e5b191f4ebb530791acc0825a7986e0d0dee2a3c491184bd8599848a4b \
+    --hash=sha256:eb60e36b237b1ebd40a912da5384b348df8ed534f6f644d8e0b4f103e272ba7d
+    # via -r .github/scripts/requirements_dev.in
 pdf2image==1.17.0 \
    --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
    --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r requirements_dev.in
-pillow==12.1.1 \
-    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
-    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
-    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
-    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
-    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
-    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
-    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
-    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
-    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
-    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
-    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
-    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
-    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
-    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
-    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
-    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
-    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
-    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
-    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
-    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
-    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
-    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
-    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
-    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
-    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
-    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
-    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
-    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
-    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
-    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
-    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
-    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
-    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
-    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
-    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
-    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
-    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
-    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
-    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
-    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
-    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
-    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
-    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
-    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
-    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
-    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
-    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
-    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
-    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
-    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
-    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
-    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
-    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
-    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
-    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
-    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
-    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
-    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
-    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
-    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
-    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
-    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
-    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
-    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
-    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
-    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
-    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
-    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
-    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
-    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
-    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
-    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
-    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
-    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
-    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
-    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
-    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
-    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
-    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
-    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
-    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
-    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
-    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
-    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
-    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
-    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
-    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
-    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
-    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
-    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
-    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
+    # via -r .github/scripts/requirements_dev.in
+pillow==12.2.0 \
+    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
+    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
+    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
+    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
+    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
+    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
+    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
+    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
+    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
+    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
+    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
+    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
+    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
+    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
+    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
+    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
+    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
+    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
+    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
+    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
+    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
+    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
+    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
+    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
+    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
+    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
+    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
+    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
+    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
+    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
+    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
+    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
+    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
+    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
+    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
+    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
+    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
+    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
+    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
+    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
+    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
+    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
+    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
+    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
+    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
+    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
+    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
+    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
+    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
+    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
+    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
+    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
+    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
+    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
+    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
+    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
+    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
+    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
+    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
+    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
+    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
+    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
+    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
+    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
+    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
+    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
+    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
+    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
+    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
+    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
+    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
+    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
+    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
+    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
+    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
+    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
+    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
+    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
+    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
+    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
+    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
+    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
+    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
+    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
+    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
+    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
+    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
+    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
+    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
+    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
+    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
    # via
-    #   -r requirements_dev.in
+    #   -r .github/scripts/requirements_dev.in
    #   pdf2image
    #   weasyprint
-platformdirs==4.5.1 \
-    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
-    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
-    # via virtualenv
-pre-commit==4.5.1 \
-    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
-    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
-    # via -r requirements_dev.in
+platformdirs==4.9.6 \
+    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
+    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+    # via -r .github/scripts/requirements_dev.in
 pycparser==3.0 \
    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
@@ -377,6 +381,10 @@ pyphen==0.17.2 \
    --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
    --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
    # via weasyprint
+python-discovery==1.2.2 \
+    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
+    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+    # via virtualenv
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -458,22 +466,22 @@ tinycss2==1.5.1 \
    # via
    #   cssselect2
    #   weasyprint
-tinyhtml5==2.0.0 \
-    --hash=sha256:086f998833da24c300c414d9fe81d9b368fd04cb9d2596a008421cbc705fcfcc \
-    --hash=sha256:13683277c5b176d070f82d099d977194b7a1e26815b016114f581a74bbfbf47e
+tinyhtml5==2.1.0 \
+    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
+    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
    # via weasyprint
 unoserver==3.6 \
    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r requirements_dev.in
-virtualenv==20.36.1 \
-    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
-    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
+    # via -r .github/scripts/requirements_dev.in
+virtualenv==21.2.4 \
+    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
+    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
    # via pre-commit
-weasyprint==68.0 \
-    --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
-    --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
-    # via -r requirements_dev.in
+weasyprint==68.1 \
+    --hash=sha256:4dc3ba63c68bbbce3e9617cb2226251c372f5ee90a8a484503b1c099da9cf5be \
+    --hash=sha256:d3b752049b453a5c95edb27ce78d69e9319af5a34f257fa0f4c738c701b4184e
+    # via -r .github/scripts/requirements_dev.in
 webencodings==0.5.1 \
    --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
    --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -481,27 +489,27 @@ webencodings==0.5.1 \
    #   cssselect2
    #   tinycss2
    #   tinyhtml5
-zopfli==0.4.0 \
-    --hash=sha256:03181d48e719fcb6cf8340189c61e8f9883d8bbbdf76bf5212a74457f7d083c1 \
-    --hash=sha256:18b5f1570f64d4988482e4466f10ef5f2a30f687c19ad62a64560f2152dc89eb \
-    --hash=sha256:25e4863b8dc30e5d5309f87c106b0b7d3da4ed0e340b8a52b36d4471e797589f \
-    --hash=sha256:7d66337be6d5613dec55213e9ac28f378c41e2cc04fbad4a10748e4df774ca85 \
-    --hash=sha256:9097e8e1dfdb7f5aea5464e469946857e80502b6d29ba1b232450916bd4a74d1 \
-    --hash=sha256:a8ee992b2549e090cd3f0178bf606dd41a29e0613a04cdf5054224662c72dce6 \
-    --hash=sha256:b72a010d205d00b2855acc2302772067362f9ab5a012e3550662aec60d28e6b3 \
-    --hash=sha256:b8bdb41fbfdc4738b7bdc09ed7c1e951579fae192391a5e694d59bb186cdbec7 \
-    --hash=sha256:c3ba02a9a6ca90481d2b2f68bab038b310d63a1e3b5ae305e95a6599787ed941 \
-    --hash=sha256:d1b98ad47c434ef213444a03ef2f826eeec100144d64f6a57504b9893d3931ce \
-    --hash=sha256:f67d04280065e24cb9a4174cb6b3d1f763687f8cb2963aa135ad8f57c6995f5a \
-    --hash=sha256:f94e4dd7d76b4fe9f5d9229372be20d7f786164eea5152d1af1c34298c3d5975
+zopfli==0.4.1 \
+    --hash=sha256:02086247dd12fda929f9bfe8b3962b6bcdbfc8c82e99255aebcf367867cf0760 \
+    --hash=sha256:07a5cdc5d1aaa6c288c5d9f5a5383042ba743641abf8e2fd898dcad622d8a38e \
+    --hash=sha256:27823dc1161a4031d1c25925fd45d9868ec0cbc7692341830a7dcfa25063662c \
+    --hash=sha256:2f992ac7d83cbddd889e1813ace576cbc91a05d5d7a0a21b366e2e5f492e7707 \
+    --hash=sha256:4238d4d746d1095e29c9125490985e0c12ffd3654f54a24af551e2391e936d54 \
+    --hash=sha256:5a4c22b6161f47f5bd34637dbaee6735abd287cd64e0d1ce28ef1871bf625f4b \
+    --hash=sha256:84a31ba9edc921b1d3a4449929394a993888f32d70de3a3617800c428a947b9b \
+    --hash=sha256:a899eca405662a23ae75054affa3517a060362eae1185d3d791c86a50153c4dd \
+    --hash=sha256:a93c2ecafff372de6c0aa2212eff18a75f6c71a100372fee7b4b129cc0b6f9a7 \
+    --hash=sha256:cb136a74d14a4ecfae29cb0fdecece58a6c115abc9a74c12bc6ac62e80f229d7 \
+    --hash=sha256:d7bcee1b189d64ec33d1e05cfa1b6a1268c29329c382f6ca1bd6245b04925c57 \
+    --hash=sha256:fdfb7ce9f5de37a5b2f75dd2642fd7717956ef2a72e0387302a36d382440db07
    # via fonttools

 # The following packages are considered to be unsafe in a requirements file:
-pip==26.0 \
-    --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
-    --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
-    # via -r requirements_dev.in
-setuptools==80.10.2 \
-    --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
-    --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
-    # via -r requirements_dev.in
+pip==26.0.1 \
+    --hash=sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b \
+    --hash=sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8
+    # via -r .github/scripts/requirements_dev.in
+setuptools==82.0.1 \
+    --hash=sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9 \
+    --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb
+    # via -r .github/scripts/requirements_dev.in
@@ -12,26 +12,34 @@ distlib==0.4.0 \
    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
    # via virtualenv
-filelock==3.20.3 \
-    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
-    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
-    # via virtualenv
-identify==2.6.16 \
-    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
-    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
+filelock==3.29.0 \
+    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
+    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+    # via
+    #   python-discovery
+    #   virtualenv
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
    # via pre-commit
 nodeenv==1.10.0 \
    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
    # via pre-commit
-platformdirs==4.5.1 \
-    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
-    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
-    # via virtualenv
-pre-commit==4.5.1 \
-    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
-    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+platformdirs==4.9.6 \
+    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
+    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
    # via -r .github/scripts/requirements_pre_commit.in
+python-discovery==1.2.2 \
+    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
+    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+    # via virtualenv
 pyyaml==6.0.3 \
    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -107,7 +115,7 @@ pyyaml==6.0.3 \
    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
    # via pre-commit
-virtualenv==20.36.1 \
-    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
-    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
+virtualenv==21.2.4 \
+    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
+    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
    # via pre-commit
@@ -3,6 +3,31 @@ name: PR Deployment via Comment
 on:
  issue_comment:
    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to deploy"
+        required: true
+      enable_prototypes:
+        description: "Build with prototypes frontend"
+        required: false
+        type: boolean
+        default: false
+      enable_pro:
+        description: "Enable pro features"
+        required: false
+        type: boolean
+        default: false
+      enable_enterprise:
+        description: "Enable enterprise features"
+        required: false
+        type: boolean
+        default: false
+      disable_security:
+        description: "Disable security/login"
+        required: false
+        type: boolean
+        default: true

 permissions:
  contents: read
@@ -14,23 +39,27 @@ jobs:
    permissions:
      issues: write
    if: |
-      vars.CI_PROFILE != 'lite' &&
-      github.event.issue.pull_request &&
-      (
-        contains(github.event.comment.body, 'prdeploy') ||
-        contains(github.event.comment.body, 'deploypr')
-      )
-      &&
-      (
-        github.event.comment.user.login == 'frooodle' ||
-        github.event.comment.user.login == 'sf298' ||
-        github.event.comment.user.login == 'Ludy87' ||
-        github.event.comment.user.login == 'balazs-szucs' ||
-        github.event.comment.user.login == 'reecebrowne' ||
-        github.event.comment.user.login == 'DarioGii' ||
-        github.event.comment.user.login == 'EthanHealy01' ||
-        github.event.comment.user.login == 'jbrunton96' ||
-        github.event.comment.user.login == 'ConnorYoh'
+      vars.CI_PROFILE != 'lite' && (
+        github.event_name == 'workflow_dispatch' ||
+        (
+          github.event.issue.pull_request &&
+          (
+            contains(github.event.comment.body, 'prdeploy') ||
+            contains(github.event.comment.body, 'deploypr')
+          )
+          &&
+          (
+            github.event.comment.user.login == 'frooodle' ||
+            github.event.comment.user.login == 'sf298' ||
+            github.event.comment.user.login == 'Ludy87' ||
+            github.event.comment.user.login == 'balazs-szucs' ||
+            github.event.comment.user.login == 'reecebrowne' ||
+            github.event.comment.user.login == 'DarioGii' ||
+            github.event.comment.user.login == 'EthanHealy01' ||
+            github.event.comment.user.login == 'jbrunton96' ||
+            github.event.comment.user.login == 'ConnorYoh'
+          )
+        )
      )
    outputs:
      pr_number: ${{ steps.get-pr.outputs.pr_number }}
@@ -38,6 +67,7 @@ jobs:
      disable_security: ${{ steps.check-security-flag.outputs.disable_security }}
      enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }}
      enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }}
+      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -61,7 +91,9 @@ jobs:
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
-            const prNumber = context.payload.issue.number;
+            const prNumber = context.eventName === 'workflow_dispatch'
+              ? context.payload.inputs.pr_number
+              : context.payload.issue.number;
            console.log(`PR Number: ${prNumber}`);
            core.setOutput('pr_number', prNumber);

@@ -69,12 +101,14 @@ jobs:
        id: check-security-flag
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+          DISPATCH_DISABLE_SECURITY: ${{ inputs.disable_security }}
        run: |
-          if [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
-            echo "Security flags detected in comment"
+          if [[ "$IS_DISPATCH" == "true" ]]; then
+            echo "disable_security=$DISPATCH_DISABLE_SECURITY" >> $GITHUB_OUTPUT
+          elif [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then
            echo "disable_security=false" >> $GITHUB_OUTPUT
          else
-            echo "No security flags detected in comment"
            echo "disable_security=true" >> $GITHUB_OUTPUT
          fi

@@ -82,22 +116,43 @@ jobs:
        id: check-pro-flag
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+          DISPATCH_PRO: ${{ inputs.enable_pro }}
+          DISPATCH_ENTERPRISE: ${{ inputs.enable_enterprise }}
        run: |
-          if [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
-            echo "pro flags detected in comment"
+          if [[ "$IS_DISPATCH" == "true" ]]; then
+            echo "enable_pro=$DISPATCH_PRO" >> $GITHUB_OUTPUT
+            echo "enable_enterprise=$DISPATCH_ENTERPRISE" >> $GITHUB_OUTPUT
+          elif [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then
            echo "enable_pro=true" >> $GITHUB_OUTPUT
            echo "enable_enterprise=false" >> $GITHUB_OUTPUT
          elif [[ "$COMMENT_BODY" == *"enterprise"* ]]; then
-            echo "enterprise flags detected in comment"
            echo "enable_enterprise=true" >> $GITHUB_OUTPUT
            echo "enable_pro=true" >> $GITHUB_OUTPUT
          else
-            echo "No pro or enterprise flags detected in comment"
            echo "enable_pro=false" >> $GITHUB_OUTPUT
            echo "enable_enterprise=false" >> $GITHUB_OUTPUT
          fi

+      - name: Check for prototypes flag
+        id: check-prototypes-flag
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+          DISPATCH_PROTOTYPES: ${{ inputs.enable_prototypes }}
+        run: |
+          if [[ "$IS_DISPATCH" == "true" ]]; then
+            echo "enable_prototypes=$DISPATCH_PROTOTYPES" >> $GITHUB_OUTPUT
+          elif [[ "$COMMENT_BODY" == *"prototypes"* ]]; then
+            echo "Prototypes flag detected in comment"
+            echo "enable_prototypes=true" >> $GITHUB_OUTPUT
+          else
+            echo "No prototypes flag detected in comment"
+            echo "enable_prototypes=false" >> $GITHUB_OUTPUT
+          fi
+
      - name: Add 'in_progress' reaction to comment
+        if: github.event_name == 'issue_comment'
        id: add-eyes-reaction
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
@@ -161,6 +216,8 @@ jobs:
        with:
          gradle-version: 9.3.1

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -168,7 +225,7 @@ jobs:
          else
            export DISABLE_ADDITIONAL_FEATURES=false
          fi
-          ./gradlew build
+          task backend:build
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -193,7 +250,21 @@ jobs:
          cache-from: type=gha,scope=stirling-pdf-latest
          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: VERSION_TAG=alpha
+          build-args: |
+            VERSION_TAG=alpha
+            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
+          platforms: linux/amd64
+
+      - name: Build and push engine image
+        if: needs.check-comment.outputs.enable_prototypes == 'true'
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: ./engine
+          file: ./engine/Dockerfile
+          push: true
+          cache-from: type=gha,scope=stirling-pdf-engine
+          cache-to: type=gha,mode=max,scope=stirling-pdf-engine
+          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
          platforms: linux/amd64

      - name: Set up SSH
@@ -231,33 +302,64 @@ jobs:
            PREMIUM_PROFEATURES_AUDIT_ENABLED="false"
          fi

+          ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
+          PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
+          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
+
+          # Build engine env vars for backend (only set when prototypes enabled)
+          if [ "$ENABLE_PROTOTYPES" == "true" ]; then
+            AI_ENGINE_VARS="
+                SYSTEM_AIENGINE_ENABLED: \"true\"
+                SYSTEM_AIENGINE_URL: \"http://stirling-pdf-engine-pr-${PR_NUMBER}:5001\""
+            ENGINE_SERVICE="
+            stirling-pdf-engine:
+              container_name: stirling-pdf-engine-pr-${PR_NUMBER}
+              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
+              environment:
+                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
+              networks:
+                - pr-network
+              restart: on-failure:5"
+            NETWORK_SECTION="
+          networks:
+            pr-network:"
+            BACKEND_NETWORK="
+              networks:
+                - pr-network"
+          else
+            AI_ENGINE_VARS=""
+            ENGINE_SERVICE=""
+            NETWORK_SECTION=""
+            BACKEND_NETWORK=""
+          fi
+
          # First create the docker-compose content locally
          cat > docker-compose.yml << EOF
          version: '3.3'
          services:
            stirling-pdf:
-              container_name: stirling-pdf-pr-${{ needs.check-comment.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
+              container_name: stirling-pdf-pr-${PR_NUMBER}
+              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
              ports:
-                - "${{ needs.check-comment.outputs.pr_number }}:8080"
+                - "${PR_NUMBER}:8080"
              volumes:
-                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/data:/usr/share/tessdata:rw
-                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/config:/configs:rw
-                - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/logs:/logs:rw
+                - /stirling/PR-${PR_NUMBER}/data:/usr/share/tessdata:rw
+                - /stirling/PR-${PR_NUMBER}/config:/configs:rw
+                - /stirling/PR-${PR_NUMBER}/logs:/logs:rw
              environment:
                DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
                SYSTEM_DEFAULTLOCALE: en-GB
-                UI_APPNAME: "Stirling-PDF PR#${{ needs.check-comment.outputs.pr_number }}"
-                UI_HOMEDESCRIPTION: "PR#${{ needs.check-comment.outputs.pr_number }} for Stirling-PDF Latest"
-                UI_APPNAMENAVBAR: "PR#${{ needs.check-comment.outputs.pr_number }}"
+                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
+                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
+                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
                SYSTEM_MAXFILESIZE: "100"
                METRICS_ENABLED: "true"
                SYSTEM_GOOGLEVISIBILITY: "false"
                PREMIUM_KEY:                         "${PREMIUM_KEY}"
                PREMIUM_ENABLED:                     "${PREMIUM_ENABLED}"
-                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"
-              restart: on-failure:5
+                PREMIUM_PROFEATURES_AUDIT_ENABLED:   "${PREMIUM_PROFEATURES_AUDIT_ENABLED}"${AI_ENGINE_VARS}
+              restart: on-failure:5${BACKEND_NETWORK}${ENGINE_SERVICE}${NETWORK_SECTION}
          EOF

          # Then copy the file and execute commands
@@ -265,13 +367,13 @@ jobs:

          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create PR-specific directories
-            mkdir -p /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/{data,config,logs}
+            mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}

            # Move docker-compose file to correct location
-            mv /tmp/docker-compose.yml /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/docker-compose.yml
+            mv /tmp/docker-compose.yml /stirling/PR-${PR_NUMBER}/docker-compose.yml

            # Start or restart the container
-            cd /stirling/PR-${{ needs.check-comment.outputs.pr_number }}
+            cd /stirling/PR-${PR_NUMBER}
            docker-compose pull
            docker-compose up -d
          ENDSSH
@@ -280,7 +382,7 @@ jobs:
          echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV

      - name: Add success reaction to comment
-        if: success()
+        if: success() && github.event_name == 'issue_comment'
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
@@ -315,7 +417,7 @@ jobs:
            }

      - name: Add failure reaction to comment
-        if: failure()
+        if: failure() && github.event_name == 'issue_comment'
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ steps.setup-bot.outputs.token }}
@@ -121,8 +121,9 @@ jobs:
              # Remove PR-specific directories
              rm -rf /stirling/PR-${{ github.event.pull_request.number }}

-              # Remove the Docker image
+              # Remove the Docker images
              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true

              echo "PERFORMED_CLEANUP"
            else
@@ -5,79 +5,108 @@ on:
    branches: [main]
  pull_request:

+permissions:
+  contents: read
+
 jobs:
  engine:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
-    defaults:
-      run:
-        working-directory: engine
-
    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
        with:
          enable-cache: true

-      - name: Install dependencies
-        run: make install
-
-      - name: Run fixers
-        # Ignore errors here because we're going to add comments for them in the following steps before actually failing
-        run: make fix || true
-
-      - name: Check for fixer changes
-        id: fixer_changes
-        run: |
-          if git diff --quiet; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Post fixer suggestions
-        if: steps.fixer_changes.outputs.changed == 'true' && github.event_name == 'pull_request'
-        uses: reviewdog/action-suggester@v1
-        continue-on-error: true
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
-          tool_name: engine-make-fix
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          filter_mode: file
-          fail_level: any
-          level: info
+          java-version: "25"
+          distribution: "temurin"

-      - name: Comment on fixer suggestions
-        if: steps.fixer_changes.outputs.changed == 'true' && github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
        with:
-          script: |
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: "The Python code in your PR has formatting/linting issues. Consider running `make fix` locally or setting up your editor's Ruff integration to auto-format and lint your files as you go, or commit the suggested changes on this PR.",
-            });
+          gradle-version: 9.3.1

-      - name: Verify fixer changes are committed
-        if: steps.fixer_changes.outputs.changed == 'true'
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+
+      - name: Regenerate tool models
+        run: task engine:tool-models
+
+      - name: Verify tool models are up to date
        run: |
-          if ! git diff --exit-code; then
-            echo "Fixes are out of date."
-            echo "Apply the reviewdog suggestions or run 'make fix' from engine/ and commit the updated files."
-            git --no-pager diff --stat
+          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
+            echo "tool_models.py is out of date."
+            echo "Run 'task engine:tool-models' locally and commit the updated file."
            exit 1
          fi

+      - name: Run fixers
+        run: task engine:fix
+
+      - name: Verify fixes are committed
+        id: fixer_changes
+        run: |
+          if ! git diff --quiet; then
+            git --no-pager diff --stat
+            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
+            exit 1
+          fi
+
+      - name: Comment on fixer failures
+        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const marker = '<!-- engine-check -->';
+            const body = [
+              marker,
+              '### Engine Check Failed',
+              '',
+              'There are issues with your Python code that will need to be fixed before they can be merged in.',
+              '',
+              'Run `task engine:fix` to auto-fix what can be fixed automatically, then run `task engine:check` to see what still needs fixing manually.',
+            ].join('\n');
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
      - name: Run linting
-        run: make lint
+        run: task engine:lint

      - name: Run type checking
-        run: make typecheck
+        run: task engine:typecheck

      - name: Run tests
-        run: make test
+        run: task engine:test
@@ -0,0 +1,128 @@
+name: Publish to AUR
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (e.g. 2.9.2 — no v prefix)"
+        required: true
+        type: string
+      dry_run:
+        description: "Skip the AUR push (safe test)"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  get-release-info:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.info.outputs.version }}
+      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
+      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - name: Extract version from tag or manual input
+        id: info
+        env:
+          DISPATCH_VERSION: ${{ inputs.version }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$DISPATCH_VERSION"
+          else
+            VERSION="$RELEASE_TAG"
+          fi
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Download release assets and compute SHA256
+        id: hashes
+        env:
+          VERSION: ${{ steps.info.outputs.version }}
+        run: |
+          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
+
+          download_sha256() {
+            local url="$1"
+            local file
+            file=$(basename "$url")
+            curl -fsSL --retry 3 -o "$file" "$url"
+            sha256sum "$file" | awk '{print $1}'
+          }
+
+          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
+          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
+
+          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
+          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
+
+  publish-aur:
+    needs: get-release-info
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository (for PKGBUILD templates)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Update stirling-pdf-desktop PKGBUILD
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          DEB_SHA: ${{ needs.get-release-info.outputs.deb_sha256 }}
+        run: |
+          PKGBUILD=".github/aur/stirling-pdf-desktop/PKGBUILD"
+          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
+          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
+          sed -i "s/'PLACEHOLDER_DEB_SHA256'/'${DEB_SHA}'/" "$PKGBUILD"
+
+      # Disabled until we sort out the server packaging story.
+      # The third-party stirling-pdf-bin on AUR currently covers a similar use case.
+      # - name: Update stirling-pdf-server-bin PKGBUILD
+      #   env:
+      #     VERSION: ${{ needs.get-release-info.outputs.version }}
+      #     JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
+      #   run: |
+      #     PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
+      #     sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
+      #     sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
+      #     sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
+
+      - name: Show updated PKGBUILD (for dry-run visibility)
+        run: |
+          echo "--- stirling-pdf-desktop PKGBUILD ---"
+          cat .github/aur/stirling-pdf-desktop/PKGBUILD
+
+      - name: Publish stirling-pdf-desktop to AUR
+        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
+        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
+        with:
+          pkgname: stirling-pdf-desktop
+          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
+          commit_username: Stirling PDF Inc
+          commit_email: contact@stirlingpdf.com
+          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
+
+      # Disabled until we sort out the server packaging story.
+      # - name: Publish stirling-pdf-server-bin to AUR
+      #   if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
+      #   uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
+      #   with:
+      #     pkgname: stirling-pdf-server-bin
+      #     pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
+      #     commit_username: Stirling PDF Inc
+      #     commit_email: contact@stirlingpdf.com
+      #     ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+      #     commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
@@ -50,6 +50,7 @@ jobs:
    permissions:
      actions: read
      security-events: write
+      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
@@ -84,8 +85,77 @@ jobs:
          gradle-version: 9.3.1
          cache-disabled: true

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Check Java formatting (Spotless)
+        if: matrix.jdk-version == 25 && matrix.spring-security == false
+        id: spotless-check
+        run: task backend:format:check
+        continue-on-error: true
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: Comment on Java formatting failure
+        if: steps.spotless-check.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const marker = '<!-- java-formatting-check -->';
+            const body = [
+              marker,
+              '### Java Formatting Check Failed',
+              '',
+              'Your code has formatting issues. Run the following command to fix them:',
+              '',
+              '```bash',
+              'task backend:format',
+              '```',
+              '',
+              'Then commit and push the changes.',
+            ].join('\n');
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if Java formatting issues found
+        if: steps.spotless-check.outcome == 'failure'
+        run: |
+          echo "============================================"
+          echo "  Java Formatting Check Failed"
+          echo "============================================"
+          echo ""
+          echo "Your code has formatting issues."
+          echo "Run the following command to fix them:"
+          echo ""
+          echo "  task backend:format"
+          echo ""
+          echo "Then commit and push the changes."
+          echo "============================================"
+          exit 1
+
      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
-        run: ./gradlew build -PnoSpotless
+        run: task backend:build:ci
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -169,8 +239,10 @@ jobs:
          gradle-version: 9.3.1
          cache-disabled: true

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate OpenAPI documentation
-        run: ./gradlew :stirling-pdf:generateOpenApiDocs
+        run: task backend:swagger
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -187,6 +259,9 @@ jobs:
    if: needs.files-changed.outputs.frontend == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -200,16 +275,63 @@ jobs:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
-      - name: Install frontend dependencies
-        run: cd frontend && npm ci
-      - name: Type-check frontend
-        run: cd frontend && npm run prep && npm run typecheck:all
-      - name: Lint frontend
-        run: cd frontend && npm run lint
-      - name: Build frontend
-        run: cd frontend && npm run build
-      - name: Run frontend tests
-        run: cd frontend && npm run test -- --run
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Quality-check frontend
+        id: frontend-check
+        run: task frontend:check:all
+        continue-on-error: true
+      - name: Comment on frontend check failure
+        if: steps.frontend-check.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const marker = '<!-- frontend-check -->';
+            const body = [
+              marker,
+              '### Frontend Check Failed',
+              '',
+              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
+              '',
+              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
+            ].join('\n');
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+      - name: Fail if frontend check failed
+        if: steps.frontend-check.outcome == 'failure'
+        run: |
+          echo "============================================"
+          echo "  Frontend Check Failed"
+          echo "============================================"
+          echo ""
+          echo "There are issues with your frontend code that"
+          echo "will need to be fixed before they can be merged in."
+          echo ""
+          echo "Run 'task frontend:fix' to auto-fix what can be"
+          echo "fixed automatically, then run 'task frontend:check:all'"
+          echo "to see what still needs fixing manually."
+          echo "============================================"
+          exit 1
      - name: Upload frontend build artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
@@ -234,14 +356,12 @@ jobs:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
-      - name: Install frontend dependencies
-        run: cd frontend && npm ci
-      - name: Generate icons
-        run: cd frontend && node scripts/generate-icons.js
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
-        run: cd frontend && npx playwright install chromium --with-deps
+        run: task frontend:test:e2e:install -- chromium
      - name: Run E2E tests (chromium)
-        run: cd frontend && npx playwright test --project=chromium
+        run: task frontend:test:e2e -- --project=chromium
      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -284,13 +404,10 @@ jobs:
          gradle-version: 9.3.1
          cache-disabled: true

-      - name: check the licenses for compatibility
-        # NOTE: --no-parallel is intentional here. Running the checkLicense task in parallel with other
-        # Gradle tasks has been observed to cause intermittent failures with the dependency license
-        # checking plugin on this Gradle version. Disabling parallel execution trades some build speed
-        # for more reliable, deterministic license checks. If upgrading Gradle or the plugin, consider
-        # re-evaluating whether this flag is still required before removing it.
-        run: ./gradlew checkLicense --no-parallel
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Check licenses for compatibility
+        run: task backend:licenses:check
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -378,8 +495,7 @@ jobs:

      - name: Pip requirements
        run: |
-          pip install --require-hashes -r ./testing/cucumber/requirements.txt
-          pip install behave-html-formatter
+          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt

      - name: Run Docker Compose Tests
        run: |
@@ -485,8 +601,10 @@ jobs:
          gradle-version: 9.3.1
          cache-disabled: true

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Build application
-        run: ./gradlew build
+        run: task backend:build
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -201,7 +201,8 @@ jobs:
          python-version: "3.12"

      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt

      - name: Run Python script to check files
        id: run-check
@@ -89,12 +89,13 @@ jobs:
          NPM_CONFIG_IGNORE_SCRIPTS: "true"
        run: npm ci --ignore-scripts --audit=false --fund=false

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate frontend license report (internal PR)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
-        working-directory: frontend
        env:
          PR_IS_FORK: "false"
-        run: npm run generate-licenses
+        run: task frontend:licenses:generate

      - name: Generate frontend license report (fork PRs, pinned)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
@@ -341,15 +342,11 @@ jobs:
        with:
          gradle-version: 9.3.1

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check licenses and generate report
        id: license-check
-        run: |
-          # NOTE: --no-parallel is intentional here. Running the license-checking tasks in parallel has
-          # previously caused intermittent concurrency issues in CI (e.g. flaky failures in the license
-          # plugin/Gradle when multiple projects are evaluated concurrently). Disabling parallelism trades
-          # some build speed for more reliable license reports. If the underlying issues are resolved in
-          # future Gradle or plugin versions, this flag can be reconsidered.
-          ./gradlew checkLicense generateLicenseReport --no-parallel || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
+        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
@@ -21,6 +21,14 @@ on:
          - windows
          - macos
          - linux
+      sign:
+        description: "Code sign the binaries (requires signing secrets)"
+        required: false
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
  release:
    types: [created]

@@ -63,11 +71,11 @@ jobs:
        with:
          gradle-version: 9.3.1

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: |
-          echo "Running gradlew printVersion..."
-          ./gradlew printVersion --quiet
          VERSION=$(./gradlew printVersion --quiet | tail -1)
          echo "Extracted version: $VERSION"
          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
@@ -144,6 +152,9 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+
      - name: Build JAR
        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
        env:
@@ -219,89 +230,21 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+      - name: Prepare desktop build
+        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm ci
-
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -311,7 +254,7 @@ jobs:
          SM_HOST: ${{ secrets.SM_HOST }}

      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
          Write-Host "Setting up DigiCert KeyLocker environment..."
@@ -346,7 +289,7 @@ jobs:

      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -377,7 +320,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -398,7 +341,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -409,6 +352,82 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

+      # Pre-flight: verify smctl can talk to DigiCert and sync cert before we sign.
+      # Mirrors the setup from working public Tauri+KeyLocker repos (Labric, Meetily).
+      # Without this, signCommand failures are opaque (Tauri captures but drops
+      # smctl's stderr) - running these loudly surfaces auth/env/keypair issues.
+      - name: Preflight smctl
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        shell: pwsh
+        env:
+          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+        run: |
+          & smctl healthcheck
+          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
+          & smctl keypair ls
+          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
+          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
+          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
+          Write-Host "[SUCCESS] smctl preflight passed"
+
+      # Write platform-specific Tauri config that adds signCommand for Windows.
+      # Tauri auto-merges tauri.windows.conf.json with tauri.conf.json (RFC 7396).
+      # Tauri calls this command on every binary BEFORE bundling into the MSI,
+      # substituting %1 with the file path.
+      #
+      # Why OBJECT form (cmd + args) instead of string:
+      # Tauri's string-form parser does a naive split(' ') with no shell/quote handling.
+      # Args with spaces or quote characters get mangled. The object form passes each
+      # arg directly to Rust's Command::arg which handles Windows CreateProcess quoting.
+      #
+      # Why --keypair-alias instead of --fingerprint:
+      # --fingerprint requires smctl windows certsync to have synced the cert to the
+      # Windows cert store first. --keypair-alias goes direct through PKCS11 and works
+      # without certsync. All real-world working Tauri+smctl examples use this flag.
+      #
+      # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
+      # from env (set by prior DigiCert setup step). No --config-file needed.
+      - name: Configure Windows code signing
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        shell: bash
+        env:
+          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+        run: |
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
+          {
+            "bundle": {
+              "windows": {
+                "signCommand": {
+                  "cmd": "smctl",
+                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
+                }
+              }
+            }
+          }
+          EOF
+          echo "Generated tauri.windows.conf.json (alias masked):"
+          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json
+
+      - name: Import release GPG signing key (Linux)
+        if: matrix.platform == 'ubuntu-22.04'
+        env:
+          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
+        run: |
+          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
+          gpg --list-secret-keys --keyid-format=long
+
+      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
+          if [ -f "$JAVA_LIBJVM" ]; then
+            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
+            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
+          else
+            echo "libjvm not found at $JAVA_LIBJVM"
+            exit 1
+          fi
+
      - name: Build Tauri app
        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
        env:
@@ -419,114 +438,115 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          # AppImage signing — three env vars work together:
+          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
+          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
+          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
+          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
+          SIGN: "1"
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          # Only enable Windows signing in Tauri when on release or V2-master
-          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          # DigiCert KeyLocker env vars consumed by smctl during signCommand
+          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
+      - name: Clear release GPG key from runner keyring (Linux)
+        if: always() && matrix.platform == 'ubuntu-22.04'
+        env:
+          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
+        run: |
+          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
+            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
+            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
+          fi
+
+      # Verify the MSI (outer wrapper users download) AND the inner exe extracted
+      # from it (what actually gets installed and what AV scans). We don't check
+      # target/.../release/stirling-pdf.exe - that's Tauri's intermediate build
+      # artifact. Tauri signs a COPY when bundling into the MSI and leaves the raw
+      # cargo output unsigned, so checking it produces false negatives.
+      - name: Verify Windows Code Signature
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
        shell: pwsh
        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
+          $allSigned = $true

-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
+          # Check MSI installer (outer wrapper - what users download)
          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
+          if ($msiFiles.Count -eq 0) {
+            Write-Host "[ERROR] No MSI found under target/"
            exit 1
          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              exit 1
+          foreach ($msi in $msiFiles) {
+            $sig = Get-AuthenticodeSignature -FilePath $msi.FullName
+            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
+            if ($sig.Status -ne "Valid") {
+              Write-Host "[ERROR] MSI is not signed"
+              $allSigned = $false
            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
          }

-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+          # Extract MSI and verify the inner exe (the file that actually gets installed).
+          # This is the critical check - AV flags the installed exe at runtime.
+          $msi = $msiFiles[0].FullName
+          $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
+          if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
+          $proc = Start-Process msiexec.exe -ArgumentList '/a', $msi, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
+          if ($proc.ExitCode -eq 0) {
+            $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
+            if ($innerExe) {
+              $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
+              Write-Host "Inner EXE (from MSI): Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
+              if ($sig.Status -ne "Valid") {
+                Write-Host "[ERROR] Inner exe extracted from MSI is NOT signed - AV will flag this at runtime"
+                $allSigned = $false
+              }
+            } else {
+              Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
+              $allSigned = $false
+            }
+          } else {
+            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
+            $allSigned = $false
+          }

+          if (-not $allSigned) {
+            Write-Host "[ERROR] Signature verification failed"
+            exit 1
+          }
+          Write-Host "[SUCCESS] MSI and installed exe are properly signed"
+
+      # Dump smctl log files on failure. Tauri's signCommand captures smctl output
+      # but drops stderr when the command exits non-zero, making failures opaque.
+      # The real errors live in smctl's log files - surface them here for debugging.
+      - name: Dump smctl logs on failure
+        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        shell: pwsh
+        run: |
+          $logDir = "$env:USERPROFILE\.signingmanager\logs"
+          if (Test-Path $logDir) {
+            Get-ChildItem $logDir | ForEach-Object {
+              Write-Host "=== $($_.FullName) ==="
+              Get-Content $_.FullName -Tail 200
+              Write-Host ""
+            }
+          } else {
+            Write-Host "smctl log directory not found at $logDir"
+          }
+
+      # Rename + Upload: use always() so artifacts are still collected when verify
+      # fails - we need them to manually inspect what actually came out of the build.
      - name: Rename artifacts
+        if: always() && steps.digicert-setup.conclusion != 'failure'
        shell: bash
        run: |
          mkdir -p ./dist
@@ -534,17 +554,20 @@ jobs:

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
+            # are not the user-facing installer - the MSI contains the signed inner exe.
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
+        if: always() && steps.digicert-setup.conclusion != 'failure'
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: Stirling-PDF-${{ matrix.name }}
@@ -600,6 +623,7 @@ jobs:
            ./artifacts/**/*.msi
            ./artifacts/**/*.dmg
            ./artifacts/**/*.deb
+            ./artifacts/**/*.rpm
            ./artifacts/**/*.AppImage
          draft: false
          prerelease: false
@@ -32,17 +32,13 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

-      - name: Install frontend dependencies
-        run: cd frontend && npm ci
-
-      - name: Generate icons
-        run: cd frontend && node scripts/generate-icons.js
-
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install all Playwright browsers
-        run: cd frontend && npx playwright install --with-deps
+        run: task frontend:test:e2e:install

      - name: Run E2E tests (all browsers)
-        run: cd frontend && npx playwright test
+        run: task frontend:test:e2e

      - name: Upload Playwright report
        if: always()
@@ -0,0 +1,159 @@
+name: Update Package Manager Manifests
+
+on:
+  release:
+    types: [ released ]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to test (e.g. 2.9.2 — no v prefix)"
+        required: true
+        type: string
+      dry_run:
+        description: "Skip the git push at the end (safe test)"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  get-release-info:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.info.outputs.version }}
+      dmg_arm64_sha256: ${{ steps.hashes.outputs.dmg_arm64_sha256 }}
+      dmg_x86_64_sha256: ${{ steps.hashes.outputs.dmg_x86_64_sha256 }}
+      msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
+      deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
+      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - name: Extract version from tag or manual input
+        id: info
+        env:
+          DISPATCH_VERSION: ${{ inputs.version }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$DISPATCH_VERSION"
+          else
+            VERSION="$RELEASE_TAG"
+          fi
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Download release assets and compute SHA256
+        id: hashes
+        env:
+          VERSION: ${{ steps.info.outputs.version }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          BASE="https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${VERSION}"
+
+          download_sha256() {
+            local url="$1"
+            local file
+            file=$(basename "$url")
+            curl -fsSL --retry 3 -o "$file" "$url"
+            sha256sum "$file" | awk '{print $1}'
+          }
+
+          DMG_ARM64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-aarch64.dmg")
+          DMG_X64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-x86_64.dmg")
+          MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
+          DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
+          JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
+
+          echo "dmg_arm64_sha256=$DMG_ARM64_SHA" >> "$GITHUB_OUTPUT"
+          echo "dmg_x86_64_sha256=$DMG_X64_SHA"  >> "$GITHUB_OUTPUT"
+          echo "msi_sha256=$MSI_SHA"              >> "$GITHUB_OUTPUT"
+          echo "deb_sha256=$DEB_SHA"              >> "$GITHUB_OUTPUT"
+          echo "jar_sha256=$JAR_SHA"              >> "$GITHUB_OUTPUT"
+
+  update-homebrew-and-scoop:
+    needs: get-release-info
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          repository: Stirling-Tools/homebrew-stirling-pdf
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: tap
+
+      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          ARM64_SHA: ${{ needs.get-release-info.outputs.dmg_arm64_sha256 }}
+          X64_SHA: ${{ needs.get-release-info.outputs.dmg_x86_64_sha256 }}
+        run: |
+          CASK="tap/Casks/stirling-pdf.rb"
+          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$CASK"
+          awk -v arm="$ARM64_SHA" -v x64="$X64_SHA" '
+            /on_arm/     { in_arm=1 }
+            /on_intel/   { in_arm=0; in_intel=1 }
+            /end/        { in_arm=0; in_intel=0 }
+            in_arm  && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" arm "\"") }
+            in_intel && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" x64 "\"") }
+            { print }
+          ' "$CASK" > tmp && mv tmp "$CASK"
+
+      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
+        run: |
+          FORMULA="tap/Formula/stirling-pdf-server.rb"
+          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$FORMULA"
+          sed -i "s/sha256 \".*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
+
+      - name: Update Scoop stirling-pdf.json
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
+        run: |
+          MANIFEST="tap/scoop/stirling-pdf.json"
+          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
+            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
+            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
+
+      - name: Update Scoop stirling-pdf-server.json
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
+        run: |
+          MANIFEST="tap/scoop/stirling-pdf-server.json"
+          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
+            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
+            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
+
+      - name: Show tap diff (for dry-run visibility)
+        working-directory: tap
+        run: |
+          echo "--- diff --stat ---"
+          git diff --stat
+          echo "--- full diff ---"
+          git diff
+
+      - name: Commit and push all tap updates
+        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
+        working-directory: tap
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb scoop/stirling-pdf.json scoop/stirling-pdf-server.json
+          git diff --cached --quiet && echo "No changes" && exit 0
+          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
+          git push
@@ -2,7 +2,7 @@ name: Pre-commit

 on:
  workflow_dispatch:
-  push:
+  pull_request:
    branches:
      - main

@@ -16,9 +16,6 @@ jobs:
      # Prevents sdist builds → no tar extraction
      PIP_ONLY_BINARY: ":all:"
      PIP_DISABLE_PIP_VERSION_CHECK: "1"
-    permissions:
-      contents: write
-      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
@@ -31,13 +28,6 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
@@ -57,47 +47,4 @@ jobs:
          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
-        continue-on-error: true
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-        with:
-          gradle-version: 9.3.1
-
-      - name: Build with Gradle
-        run: ./gradlew build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: git add
-        run: |
-          git add .
-          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV
-
-      - name: Create Pull Request
-        if: env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
-        with:
-          token: ${{ steps.setup-bot.outputs.token }}
-          commit-message: ":file_folder: pre-commit"
-          committer: ${{ steps.setup-bot.outputs.committer }}
-          author: ${{ steps.setup-bot.outputs.committer }}
-          signoff: true
-          branch: pre-commit
-          title: "🤖 format everything with pre-commit by ${{ steps.setup-bot.outputs.app-slug }}"
-          body: |
-            Auto-generated by [create-pull-request][1] with **${{ steps.setup-bot.outputs.app-slug }}**
-
-            [1]: https://github.com/peter-evans/create-pull-request
-          draft: false
-          delete-branch: true
-          labels: github-actions
-          sign-commits: true
+          git diff --exit-code
@@ -64,6 +64,8 @@ jobs:
        id: buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -56,6 +56,8 @@ jobs:
          SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }}
          SWAGGERHUB_USER: "Frooodle"

+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -57,7 +57,8 @@ jobs:
          cache: "pip" # caching pip dependencies

      - name: Install Python dependencies
-        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt

      - name: Sync translation TOML files
        run: |
@@ -128,86 +128,16 @@ jobs:
        with:
          gradle-version: 9.3.1

-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          # STIRLING_PDF_DESKTOP_UI=false ./gradlew bootJar --no-daemon
-          ./gradlew build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink (always rebuild)
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
+      - name: Setup Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Prepare desktop build
+        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm ci
-
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
@@ -330,6 +260,58 @@ jobs:
          echo "Available tools:"
          ls -la /usr/bin/hd* || echo "No hd* tools found"

+      - name: Preflight smctl
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: pwsh
+        env:
+          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+        run: |
+          & smctl healthcheck
+          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl healthcheck failed"; exit 1 }
+          & smctl keypair ls
+          if ($LASTEXITCODE -ne 0) { Write-Host "[ERROR] smctl keypair ls failed"; exit 1 }
+          & smctl windows certsync --keypair-alias "$env:KEYPAIR_ALIAS"
+          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }
+
+      - name: Configure Windows code signing
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        shell: bash
+        env:
+          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
+        run: |
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
+          {
+            "bundle": {
+              "windows": {
+                "signCommand": {
+                  "cmd": "smctl",
+                  "args": ["sign", "--keypair-alias", "${KEYPAIR_ALIAS}", "--input", "%1", "--verbose"]
+                }
+              }
+            }
+          }
+          EOF
+
+      - name: Import release GPG signing key (Linux)
+        if: matrix.platform == 'ubuntu-22.04'
+        env:
+          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
+        run: |
+          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
+          gpg --list-secret-keys --keyid-format=long
+
+      - name: Make libjvm discoverable for linuxdeploy (Linux AppImage)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          JAVA_LIBJVM="$JAVA_HOME/lib/server/libjvm.so"
+          if [ -f "$JAVA_LIBJVM" ]; then
+            sudo ln -sf "$JAVA_LIBJVM" /usr/lib/libjvm.so
+            echo "Linked libjvm from $JAVA_LIBJVM -> /usr/lib/libjvm.so"
+          else
+            echo "libjvm not found at $JAVA_LIBJVM"
+            exit 1
+          fi
+
      - name: Build Tauri app
        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
        env:
@@ -340,178 +322,35 @@ jobs:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
+          # AppImage signing — three env vars work together:
+          #   SIGN=1                        tells linuxdeploy-plugin-appimage to forward --sign to appimagetool
+          #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
+          #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
+          # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
+          SIGN: "1"
+          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}

-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
+      - name: Clear release GPG key from runner keyring (Linux)
+        if: always() && matrix.platform == 'ubuntu-22.04'
+        env:
+          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # List available certificates and check if they have certificates attached
-          Write-Host "Checking for available certificates..."
-          $certList = & smctl keypair ls 2>&1
-          Write-Host "Keypair list output:"
-          Write-Host $certList
-          Write-Host ""
-
-          # Parse the output to check certificate status
-          $lines = $certList -split "`n"
-          $foundKeypair = $false
-          $hasCertificate = $false
-
-          foreach ($line in $lines) {
-            if ($line -match "${{ secrets.SM_KEYPAIR_ALIAS }}") {
-              $foundKeypair = $true
-              Write-Host "[SUCCESS] Found keypair in list"
-
-              # Check if this line has certificate info (not just empty spaces after alias)
-              $parts = $line -split "\s+"
-              if ($parts.Count -gt 2 -and $parts[1] -ne "" -and $parts[1] -ne "CERTIFICATE") {
-                $hasCertificate = $true
-                Write-Host "[SUCCESS] Certificate is associated with keypair"
-              }
-            }
-          }
-
-          if (-not $foundKeypair) {
-            Write-Host "[ERROR] Keypair not found: ${{ secrets.SM_KEYPAIR_ALIAS }}"
-            Write-Host "Available keypairs are listed above"
-            Write-Host ""
-            Write-Host "Please verify:"
-            Write-Host "  1. Keypair alias is correct in GitHub secret"
-            Write-Host "  2. API key has access to this keypair"
-            exit 1
-          }
-
-          if (-not $hasCertificate) {
-            Write-Host "[ERROR] No certificate associated with keypair"
-            Write-Host "This usually means:"
-            Write-Host "  1. Certificate not yet synced to KeyLocker (run sync manually)"
-            Write-Host "  2. Certificate is pending approval"
-            Write-Host "  3. Certificate needs to be attached to the keypair"
-            Write-Host ""
-            Write-Host "Try running in DigiCert ONE portal:"
-            Write-Host "  smctl keypair sync"
-            exit 1
-          }
-
-          Write-Host "[SUCCESS] Certificate check passed"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              Write-Host ""
-              Write-Host "Possible issues:"
-              Write-Host "  1. Certificate not fully synced to KeyLocker (wait a few minutes)"
-              Write-Host "  2. Incorrect keypair alias"
-              Write-Host "  3. API key lacks signing permissions"
-              Write-Host ""
-              Write-Host "Please verify in DigiCert ONE portal:"
-              Write-Host "  - Certificate status is 'Issued' (not Pending)"
-              Write-Host "  - Keypair status is 'Online'"
-              Write-Host "  - 'Can sign' is set to 'Yes'"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
+          if [ -n "$RELEASE_GPG_FINGERPRINT" ]; then
+            gpg --batch --yes --delete-secret-keys "$RELEASE_GPG_FINGERPRINT" || true
+            gpg --batch --yes --delete-keys "$RELEASE_GPG_FINGERPRINT" || true
+          fi

      - name: Verify notarization (macOS only)
        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
@@ -536,73 +375,80 @@ jobs:

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
+            # Only ship the MSI installer. The loose exe and WiX toolset exes
+            # are not the user-facing installer - the MSI contains the signed inner exe.
            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
          else
            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

+      # Verify the MSI AND the inner exe extracted from it are signed.
+      # The inner exe is what gets installed on users' machines and what AV scans.
      - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
        shell: pwsh
        run: |
-          Write-Host "Verifying Windows code signatures..."
-
-          $exePath = "./dist/Stirling-PDF-${{ matrix.name }}.exe"
+          $allSigned = $true
          $msiPath = "./dist/Stirling-PDF-${{ matrix.name }}.msi"

-          $allSigned = $true
-          $usingKeyLocker = "${{ env.SM_API_KEY }}" -ne ""
-          $usingPfx = "${{ env.WINDOWS_CERTIFICATE }}" -ne ""
-
-          # Check EXE signature
-          if (Test-Path $exePath) {
-            $exeSig = Get-AuthenticodeSignature -FilePath $exePath
-            Write-Host "EXE Signature Status: $($exeSig.Status)"
-            Write-Host "EXE Signer: $($exeSig.SignerCertificate.Subject)"
-            Write-Host "EXE Timestamp: $($exeSig.TimeStamperCertificate.NotAfter)"
-
-            if ($exeSig.Status -ne "Valid") {
-              Write-Host "[WARNING] EXE is not properly signed (Status: $($exeSig.Status))"
-              if ($usingKeyLocker -or $usingPfx) {
-                Write-Host "[ERROR] Certificate was provided but signing failed"
-                $allSigned = $false
-              } else {
-                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
-              }
-            } else {
-              Write-Host "[SUCCESS] EXE is properly signed"
-            }
-          }
-
-          # Check MSI signature
+          # Check MSI (outer wrapper)
          if (Test-Path $msiPath) {
-            $msiSig = Get-AuthenticodeSignature -FilePath $msiPath
-            Write-Host "MSI Signature Status: $($msiSig.Status)"
-            Write-Host "MSI Signer: $($msiSig.SignerCertificate.Subject)"
-            Write-Host "MSI Timestamp: $($msiSig.TimeStamperCertificate.NotAfter)"
+            $sig = Get-AuthenticodeSignature -FilePath $msiPath
+            Write-Host "MSI: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
+            if ($sig.Status -ne "Valid") {
+              Write-Host "[ERROR] MSI is not signed"
+              $allSigned = $false
+            }

-            if ($msiSig.Status -ne "Valid") {
-              Write-Host "[WARNING] MSI is not properly signed (Status: $($msiSig.Status))"
-              if ($usingKeyLocker -or $usingPfx) {
-                Write-Host "[ERROR] Certificate was provided but signing failed"
-                $allSigned = $false
+            # Extract MSI and verify inner exe
+            $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
+            if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
+            $proc = Start-Process msiexec.exe -ArgumentList '/a', $msiPath, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
+            if ($proc.ExitCode -eq 0) {
+              $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
+              if ($innerExe) {
+                $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
+                Write-Host "Inner EXE: Status=$($sig.Status), Signer=$($sig.SignerCertificate.Subject)"
+                if ($sig.Status -ne "Valid") {
+                  Write-Host "[ERROR] Inner exe is NOT signed - AV will flag this at runtime"
+                  $allSigned = $false
+                }
              } else {
-                Write-Host "[INFO] Building unsigned binary (no certificate provided)"
+                Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
+                $allSigned = $false
              }
            } else {
-              Write-Host "[SUCCESS] MSI is properly signed"
+              Write-Host "[ERROR] MSI extraction failed (exit code: $($proc.ExitCode))"
+              $allSigned = $false
            }
+          } else {
+            Write-Host "[ERROR] MSI not found at $msiPath"
+            $allSigned = $false
          }

-          if (($usingKeyLocker -or $usingPfx) -and -not $allSigned) {
-            Write-Host "[ERROR] Code signing verification failed"
+          if (-not $allSigned) {
+            Write-Host "[ERROR] Signature verification failed"
            exit 1
+          }
+          Write-Host "[SUCCESS] MSI and inner exe are properly signed"
+
+      - name: Dump smctl logs on failure
+        if: ${{ failure() && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
+        shell: pwsh
+        run: |
+          $logDir = "$env:USERPROFILE\.signingmanager\logs"
+          if (Test-Path $logDir) {
+            Get-ChildItem $logDir | ForEach-Object {
+              Write-Host "=== $($_.FullName) ==="
+              Get-Content $_.FullName -Tail 200
+              Write-Host ""
+            }
          } else {
-            Write-Host "[SUCCESS] Code signature verification completed"
+            Write-Host "smctl log directory not found at $logDir"
          }

      - name: Upload artifacts
@@ -634,8 +480,8 @@ jobs:
            fi
          else
            echo "Checking for Linux artifacts..."
-            find . -name "*.deb" -o -name "*.AppImage" | head -5
-            if [ $(find . -name "*.deb" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
+            find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | head -5
+            if [ $(find . -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" | wc -l) -eq 0 ]; then
              echo "❌ No Linux artifacts found"
              exit 1
            fi
@@ -648,7 +494,7 @@ jobs:
        run: |
          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
-          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
+          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
              size=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo "unknown")
              echo "$file: $size bytes"
@@ -692,7 +538,7 @@ jobs:
              'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
-              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .AppImage' }
+              'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
            };

            let commentBody = `## 📦 Tauri Desktop Builds Ready!\n\n`;
@@ -167,9 +167,9 @@ jobs:
        with:
          key: ${{secrets.TESTDRIVER_API_KEY}}
          prerun: |
+            choco install go-task -y
+            task frontend:build
            cd frontend
-            npm install
-            npm run build
            npm install dashcam-chrome --save
            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
            Start-Sleep -Seconds 20
@@ -165,6 +165,7 @@ __pycache__/
 # Virtual environments
 .env*
 !.env*.example
+!engine/.env
 .venv*
 env*/
 venv*/
@@ -181,6 +182,7 @@ venv.bak/
 .idea/
 *.iml
 out/
+.junie/

 # Ignore Mac DS_Store files
 .DS_Store
@@ -216,8 +218,14 @@ id_ecdsa.pub
 id_ed25519
 id_ed25519.pub
 .ssh/
+
+# Allow the published GPG release signing public key (safe to share)
+!docs/security/signing-key.pub
 *ssh

+# Taskfile checksum cache
+.task/
+
 # cache
 .cache
 .ruff_cache
@@ -254,3 +262,6 @@ docs/type3/signatures/

 # Type3 sample PDFs (development only)
 **/type3/samples/
+
+# Claude
+.claude/
@@ -1,6 +1,6 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.14
+    rev: v0.15.11
    hooks:
      - id: ruff
        args:
@@ -12,11 +12,11 @@ repos:
        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
        exclude: (split_photos.py)
  - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.1
+    rev: v2.4.2
    hooks:
      - id: codespell
        args:
-          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment
          - --skip="./.*,*.csv,*.json,*.ambr"
          - --quiet-level=2
        files: \.(html|css|js|py|md)$
@@ -35,7 +35,7 @@ repos:
        files: ^.*(\.js|\.java|\.py|\.yml)$
        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
  - repo: https://github.com/pappasam/toml-sort
-    rev: v0.24.3
+    rev: v0.24.4
    hooks:
      - id: toml-sort-fix
        files: frontend/public/locales/.*\.toml$
@@ -0,0 +1,117 @@
+version: '3'
+
+tasks:
+  dev:
+    desc: "Start backend dev server"
+    ignore_error: true
+    cmds:
+      - cmd: cmd /c gradlew.bat :stirling-pdf:bootRun
+        platforms: [windows]
+      - cmd: ./gradlew :stirling-pdf:bootRun
+        platforms: [linux, darwin]
+
+  build:
+    desc: "Full backend build"
+    cmds:
+      - cmd: cmd /c gradlew.bat clean build
+        platforms: [windows]
+      - cmd: ./gradlew clean build
+        platforms: [linux, darwin]
+
+  build:fast:
+    desc: "Build without tests"
+    cmds:
+      - cmd: cmd /c gradlew.bat clean build -x test
+        platforms: [windows]
+      - cmd: ./gradlew clean build -x test
+        platforms: [linux, darwin]
+
+  build:ci:
+    desc: "Build for CI (formatting checked separately)"
+    cmds:
+      - cmd: cmd /c gradlew.bat build -PnoSpotless
+        platforms: [windows]
+      - cmd: ./gradlew build -PnoSpotless
+        platforms: [linux, darwin]
+
+  test:
+    desc: "Run backend tests"
+    cmds:
+      - cmd: cmd /c gradlew.bat test
+        platforms: [windows]
+      - cmd: ./gradlew test
+        platforms: [linux, darwin]
+
+  format:
+    desc: "Auto-fix code formatting"
+    cmds:
+      - cmd: cmd /c gradlew.bat spotlessApply
+        platforms: [windows]
+      - cmd: ./gradlew spotlessApply
+        platforms: [linux, darwin]
+
+  format:check:
+    desc: "Check code formatting"
+    cmds:
+      - cmd: cmd /c gradlew.bat spotlessCheck
+        platforms: [windows]
+      - cmd: ./gradlew spotlessCheck
+        platforms: [linux, darwin]
+
+  fix:
+    desc: "Auto-fix backend"
+    cmds:
+      - task: format
+
+  swagger:
+    desc: "Generate OpenAPI docs"
+    cmds:
+      - cmd: cmd /c gradlew.bat :stirling-pdf:copySwaggerDoc
+        platforms: [windows]
+      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
+        platforms: [linux, darwin]
+    sources:
+      - app/core/src/main/java/**/*.java
+      - app/proprietary/src/main/java/**/*.java
+      - app/common/src/main/java/**/*.java
+    generates:
+      - SwaggerDoc.json
+
+  check:
+    desc: "Backend quality gate"
+    cmds:
+      - task: format:check
+      - task: test
+
+  version:
+    desc: "Print project version"
+    silent: true
+    cmds:
+      - cmd: cmd /c gradlew.bat printVersion --quiet | tail -1
+        platforms: [windows]
+      - cmd: ./gradlew printVersion --quiet | tail -1
+        platforms: [linux, darwin]
+
+  licenses:check:
+    desc: "Check dependency licenses"
+    cmds:
+      - cmd: cmd /c gradlew.bat checkLicense --no-parallel
+        platforms: [windows]
+      - cmd: ./gradlew checkLicense --no-parallel
+        platforms: [linux, darwin]
+
+  licenses:generate:
+    desc: "Check and generate dependency license report"
+    cmds:
+      - cmd: cmd /c gradlew.bat checkLicense generateLicenseReport --no-parallel
+        platforms: [windows]
+      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
+        platforms: [linux, darwin]
+
+  clean:
+    desc: "Clean build artifacts"
+    cmds:
+      - cmd: cmd /c gradlew.bat clean
+        platforms: [windows]
+      - cmd: ./gradlew clean
+        platforms: [linux, darwin]
@@ -0,0 +1,105 @@
+version: '3'
+
+vars:
+  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
+
+tasks:
+  prepare:
+    desc: "Prepare desktop build dependencies"
+    deps: [jlink, ":frontend:prepare:desktop", provisioner]
+
+  provisioner:
+    desc: "Build installer provisioner"
+    platforms: [windows]
+    cmds:
+      - node scripts/build-provisioner.mjs
+
+  dev:
+    desc: "Start Tauri desktop dev mode"
+    deps: [prepare]
+    ignore_error: true
+    cmds:
+      - npx tauri dev --no-watch
+
+  build:
+    desc: "Build Tauri desktop app (production)"
+    deps: [prepare]
+    cmds:
+      - npx tauri build
+
+  build:dev:
+    desc: "Build Tauri desktop app (dev, no bundling)"
+    deps: [prepare]
+    cmds:
+      - npx tauri build --no-bundle
+
+  build:dev:mac:
+    desc: "Build Tauri desktop .app bundle (macOS)"
+    deps: [prepare]
+    cmds:
+      - npx tauri build --bundles app
+
+  build:dev:windows:
+    desc: "Build Tauri desktop NSIS installer (Windows)"
+    deps: [prepare]
+    cmds:
+      - npx tauri build --bundles nsis
+
+  build:dev:linux:
+    desc: "Build Tauri desktop AppImage (Linux)"
+    deps: [prepare]
+    cmds:
+      - npx tauri build --bundles appimage
+
+  clean:
+    desc: "Clean Tauri/Cargo build artifacts"
+    cmds:
+      - task: jlink:clean
+      - cd src-tauri && cargo clean
+      - rm -rf dist build
+
+  # ============================================================
+  # JLink — Build bundled Java runtime for Tauri
+  # ============================================================
+
+  jlink:
+    desc: "Build backend JAR and create JLink runtime for Tauri"
+    deps: [jlink:jar, jlink:runtime]
+
+  jlink:jar:
+    desc: "Build backend JAR for Tauri bundling"
+    run: once
+    dir: ..
+    env:
+      DISABLE_ADDITIONAL_FEATURES: "true"
+    cmds:
+      - cmd: cmd /c gradlew.bat bootJar --no-daemon
+        platforms: [windows]
+      - cmd: ./gradlew bootJar --no-daemon
+        platforms: [linux, darwin]
+      - mkdir -p frontend/src-tauri/libs
+      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
+    status:
+      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar
+
+  jlink:runtime:
+    desc: "Create custom JRE with jlink"
+    deps: [jlink:jar]
+    cmds:
+      - rm -rf src-tauri/runtime/jre
+      - mkdir -p src-tauri/runtime
+      - >-
+        jlink
+        --add-modules {{.JLINK_MODULES}}
+        --strip-debug
+        --compress=2
+        --no-header-files
+        --no-man-pages
+        --output src-tauri/runtime/jre
+    status:
+      - test -d src-tauri/runtime/jre
+
+  jlink:clean:
+    desc: "Remove JLink runtime and bundled JARs"
+    cmds:
+      - rm -rf src-tauri/libs src-tauri/runtime
@@ -0,0 +1,57 @@
+version: '3'
+
+vars:
+  COMPOSE_DIR: docker/compose
+  EMBEDDED_DIR: docker/embedded
+
+tasks:
+  build:
+    desc: "Build standard Docker image"
+    cmds:
+      - docker build -t stirling-pdf -f {{.EMBEDDED_DIR}}/Dockerfile .
+
+  build:fat:
+    desc: "Build fat Docker image (all features)"
+    cmds:
+      - docker build -t stirling-pdf-fat -f {{.EMBEDDED_DIR}}/Dockerfile.fat .
+
+  build:ultra-lite:
+    desc: "Build ultra-lite Docker image"
+    cmds:
+      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
+
+  build:frontend:
+    desc: "Build frontend-only Docker image"
+    cmds:
+      - docker build -t stirling-pdf-frontend -f docker/frontend/Dockerfile .
+
+  build:engine:
+    desc: "Build engine Docker image"
+    dir: engine
+    cmds:
+      - docker build -t stirling-pdf-engine .
+
+  up:
+    desc: "Start standard docker compose stack"
+    cmds:
+      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml up -d
+
+  up:fat:
+    desc: "Start fat docker compose stack"
+    cmds:
+      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.fat.yml up -d
+
+  up:ultra-lite:
+    desc: "Start ultra-lite docker compose stack"
+    cmds:
+      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.ultra-lite.yml up -d
+
+  down:
+    desc: "Stop all running docker compose stacks"
+    cmds:
+      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml down
+
+  logs:
+    desc: "Tail docker compose logs"
+    cmds:
+      - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
@@ -0,0 +1,127 @@
+version: '3'
+
+tasks:
+  install:
+    desc: "Install engine dependencies"
+    run: once
+    cmds:
+      - uv python install 3.13.8
+      - uv sync
+    sources:
+      - uv.lock
+      - pyproject.toml
+    status:
+      - test -d .venv
+
+  prepare:
+    desc: "Set up engine .env from template"
+    deps: [install]
+    cmds:
+      - uv run scripts/setup_env.py
+    sources:
+      - scripts/setup_env.py
+    generates:
+      - .env.local
+
+  run:
+    desc: "Run engine server"
+    deps: [prepare]
+    ignore_error: true
+    dir: src
+    env:
+      PYTHONUNBUFFERED: "1"
+    cmds:
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port 5001
+
+  dev:
+    desc: "Start engine dev server with hot reload"
+    deps: [prepare]
+    ignore_error: true
+    dir: src
+    env:
+      PYTHONUNBUFFERED: "1"
+    cmds:
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port 5001 --reload
+
+  lint:
+    desc: "Run linting"
+    deps: [install]
+    cmds:
+      - uv run ruff check .
+
+  lint:fix:
+    desc: "Auto-fix lint issues"
+    deps: [install]
+    cmds:
+      - uv run ruff check . --fix
+
+  format:
+    desc: "Auto-fix code formatting"
+    deps: [install]
+    cmds:
+      - uv run ruff format .
+
+  format:check:
+    desc: "Check code formatting"
+    deps: [install]
+    cmds:
+      - uv run ruff format . --diff
+
+  typecheck:
+    desc: "Run type checking"
+    deps: [install]
+    cmds:
+      - uv run pyright . --warnings
+
+  test:
+    desc: "Run tests"
+    deps: [prepare]
+    cmds:
+      - uv run pytest tests
+
+  fix:
+    desc: "Auto-fix lint + format"
+    cmds:
+      - task: lint:fix
+      - task: format
+
+  check:
+    desc: "Full engine quality gate"
+    cmds:
+      - task: typecheck
+      - task: lint
+      - task: format:check
+      - task: test
+
+  tool-models:
+    desc: "Generate tool_models.py from Java OpenAPI spec (SwaggerDoc.json)"
+    deps: [install, ":backend:swagger"]
+    cmds:
+      - uv run python scripts/generate_tool_models.py --spec ../SwaggerDoc.json --output src/stirling/models/tool_models.py
+    sources:
+      - ../SwaggerDoc.json
+      - scripts/generate_tool_models.py
+    generates:
+      - src/stirling/models/tool_models.py
+
+  clean:
+    desc: "Clean build artifacts"
+    cmds:
+      - task: '{{if eq .OS "Windows_NT"}}clean-windows{{else}}clean-unix{{end}}'
+
+  clean-unix:
+    internal: true
+    desc: "Clean build artifacts"
+    cmds:
+      - rm -rf .venv data logs output
+
+  # On Windows, use PowerShell as bash failed to delete some dependencies
+  clean-windows:
+    internal: true
+    desc: "Clean build artifacts"
+    ignore_error: true
+    cmds:
+      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue .venv
+      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue data
+      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue logs
+      - powershell rm -Recurse -Force -ErrorAction SilentlyContinue output
@@ -0,0 +1,313 @@
+version: '3'
+
+tasks:
+  install:
+    desc: "Install dependencies"
+    run: once
+    cmds:
+      - '{{ if eq .CI "true" }}npm ci{{ else }}npm install{{ end }}'
+    sources:
+      - package-lock.json
+      - package.json
+    status:
+      - test -d node_modules
+    env:
+      CI: '{{ .CI | default "false" }}'
+
+  prepare:env:
+    desc: "Generate .env from example if missing"
+    run: once
+    deps: [install]
+    cmds:
+      - npx tsx scripts/setup-env.ts
+    sources:
+      - scripts/setup-env.ts
+      - config/.env.example
+    generates:
+      - .env
+
+  prepare:env:saas:
+    desc: "Generate .env and .env.saas from examples if missing"
+    run: once
+    deps: [install]
+    cmds:
+      - npx tsx scripts/setup-env.ts --saas
+    sources:
+      - scripts/setup-env.ts
+      - config/.env.example
+      - config/.env.saas.example
+    generates:
+      - .env
+      - .env.saas
+
+  prepare:env:desktop:
+    desc: "Generate .env and .env.desktop from examples if missing"
+    run: once
+    deps: [install]
+    cmds:
+      - npx tsx scripts/setup-env.ts --desktop
+    sources:
+      - scripts/setup-env.ts
+      - config/.env.example
+      - config/.env.desktop.example
+    generates:
+      - .env
+      - .env.desktop
+
+  prepare:icons:
+    desc: "Generate icon bundle from source references"
+    run: once
+    deps: [install]
+    cmds:
+      - node scripts/generate-icons.js
+
+  prepare:
+    desc: "Set up dev environment"
+    run: once
+    deps: [prepare:env, prepare:icons]
+
+  prepare:saas:
+    desc: "Prepare for SaaS mode"
+    run: once
+    deps: [prepare:env:saas, prepare:icons]
+
+  prepare:desktop:
+    desc: "Prepare for desktop mode"
+    run: once
+    deps: [prepare:env:desktop, prepare:icons]
+
+  # ============================================================
+  # Development
+  # ============================================================
+
+  dev:
+    desc: "Start frontend dev server"
+    deps: [prepare]
+    ignore_error: true
+    cmds:
+      - npx vite
+
+  dev:core:
+    desc: "Start frontend dev server in core mode"
+    deps: [prepare]
+    ignore_error: true
+    cmds:
+      - npx vite --mode core
+
+  dev:proprietary:
+    desc: "Start frontend dev server in proprietary mode"
+    deps: [prepare]
+    ignore_error: true
+    cmds:
+      - npx vite --mode proprietary
+
+  dev:saas:
+    desc: "Start frontend dev server in SaaS mode"
+    deps: [prepare:saas]
+    ignore_error: true
+    cmds:
+      - npx vite --mode saas
+
+  dev:desktop:
+    desc: "Start frontend dev server in desktop mode"
+    deps: [prepare:desktop]
+    ignore_error: true
+    cmds:
+      - npx vite --mode desktop
+
+  dev:prototypes:
+    desc: "Start frontend dev server in prototypes mode"
+    deps: [prepare]
+    ignore_error: true
+    cmds:
+      - npx vite --mode prototypes
+
+  # ============================================================
+  # Build
+  # ============================================================
+
+  build:
+    desc: "Production build (default mode)"
+    deps: [prepare]
+    cmds:
+      - npx vite build
+
+  build:core:
+    desc: "Build for core mode"
+    deps: [prepare]
+    cmds:
+      - npx vite build --mode core
+
+  build:proprietary:
+    desc: "Build for proprietary mode"
+    deps: [prepare]
+    cmds:
+      - npx vite build --mode proprietary
+
+  build:saas:
+    desc: "Build for SaaS mode"
+    deps: [prepare:saas]
+    cmds:
+      - npx vite build --mode saas
+
+  build:desktop:
+    desc: "Build for desktop mode"
+    deps: [prepare:desktop]
+    cmds:
+      - npx vite build --mode desktop
+
+  build:prototypes:
+    desc: "Build for prototypes mode"
+    deps: [prepare]
+    cmds:
+      - npx vite build --mode prototypes
+
+  # ============================================================
+  # Code quality
+  # ============================================================
+
+  lint:
+    desc: "Run linting"
+    deps: [install]
+    cmds:
+      - npx eslint --max-warnings=0
+      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1
+
+  lint:fix:
+    desc: "Auto-fix lint issues"
+    deps: [install]
+    cmds:
+      - npx eslint --fix
+
+  format:
+    desc: "Auto-fix code formatting"
+    deps: [install]
+    cmds:
+      - npx prettier --write .
+
+  format:check:
+    desc: "Check code formatting"
+    deps: [install]
+    cmds:
+      - npx prettier --check .
+
+  fix:
+    desc: "Auto-fix lint and format"
+    cmds:
+      - task: format
+      - task: lint:fix
+
+  typecheck:
+    desc: "Typecheck default build of the app"
+    cmds:
+      - task: typecheck:proprietary
+
+  typecheck:core:
+    desc: "Typecheck core build variant"
+    deps: [prepare]
+    cmds:
+      - npx tsc --noEmit --project src/core/tsconfig.json
+
+  typecheck:proprietary:
+    desc: "Typecheck proprietary build variant"
+    deps: [prepare]
+    cmds:
+      - npx tsc --noEmit --project src/proprietary/tsconfig.json
+
+  typecheck:saas:
+    desc: "Typecheck SaaS build variant"
+    deps: [prepare:saas]
+    cmds:
+      - npx tsc --noEmit --project src/saas/tsconfig.json
+
+  typecheck:desktop:
+    desc: "Typecheck desktop build variant"
+    deps: [prepare:desktop]
+    cmds:
+      - npx tsc --noEmit --project src/desktop/tsconfig.json
+
+  typecheck:scripts:
+    desc: "Typecheck scripts"
+    deps: [prepare]
+    cmds:
+      - npx tsc --noEmit --project scripts/tsconfig.json
+
+  typecheck:prototypes:
+    desc: "Typecheck prototypes build variant"
+    deps: [prepare]
+    cmds:
+      - npx tsc --noEmit --project src/prototypes/tsconfig.json
+
+  typecheck:all:
+    desc: "Typecheck all build variants"
+    cmds:
+      - task: typecheck:core
+      - task: typecheck:proprietary
+      - task: typecheck:saas
+      - task: typecheck:desktop
+      - task: typecheck:scripts
+
+  # ============================================================
+  # Quality Gate
+  # ============================================================
+
+  check:
+    desc: "Quick quality gate for local development"
+    cmds:
+      - task: typecheck
+      - task: lint
+      - task: format:check
+      - task: test
+
+  check:all:
+    desc: "Full CI quality gate"
+    cmds:
+      - task: typecheck:all
+      - task: lint
+      - task: format:check
+      - task: build
+      - task: test
+
+  # ============================================================
+  # Test
+  # ============================================================
+
+  test:
+    desc: "Run tests"
+    deps: [install]
+    cmds:
+      - npx vitest run
+
+  test:watch:
+    desc: "Run tests in watch mode"
+    deps: [install]
+    cmds:
+      - npx vitest --watch
+
+  test:coverage:
+    desc: "Run tests with coverage"
+    deps: [install]
+    cmds:
+      - npx vitest --coverage
+
+  test:e2e:
+    desc: "Run E2E tests"
+    deps: [prepare]
+    cmds:
+      - npx playwright test {{.CLI_ARGS}}
+
+  test:e2e:install:
+    desc: "Install E2E test browsers"
+    deps: [install]
+    cmds:
+      - npx playwright install {{.CLI_ARGS}} --with-deps
+
+  # ============================================================
+  # Code Generation
+  # ============================================================
+
+  licenses:generate:
+    desc: "Generate frontend license report"
+    deps: [install]
+    cmds:
+      - node scripts/generate-licenses.js
@@ -2,41 +2,138 @@

 This file provides guidance to AI Agents when working with code in this repository.

+## Taskfile (Recommended)
+
+This project uses [Task](https://taskfile.dev/) as a unified command runner. All build, dev, test, lint, and docker commands can be run from the repo root via `task <command>`. Run `task --list` to see all available commands.
+
+### Quick Reference
+- `task install` — install all dependencies
+- `task dev` — start backend + frontend concurrently
+- `task dev:all` — start backend + frontend + engine concurrently
+- `task build` — build all components
+- `task test` — run all tests (backend + frontend + engine)
+- `task lint` — run all linters
+- `task format` — auto-fix formatting across all components
+- `task check` — full quality gate (lint + typecheck + test)
+- `task clean` — clean all build artifacts
+- `task docker:build` — build standard Docker image
+- `task docker:up` — start Docker compose stack
+
 ## Common Development Commands

 ### Build and Test
- **Build project**: `./gradlew clean build`
- **Run locally**: `./gradlew bootRun`
- **Full test suite**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
- **Code formatting**: `./gradlew spotlessApply` (runs automatically before compilation)
+- **Build project**: `task build`
+- **Run backend locally**: `task backend:dev`
+- **Run all tests**: `task test` (or individually: `task backend:test`, `task frontend:test`, `task engine:test`)
+- **Docker integration tests**: `./test.sh` (builds all Docker variants and runs comprehensive tests)
+- **Code formatting**: `task format` (or `task backend:format` for Java only)
+- **Full quality gate**: `task check` (runs lint + typecheck + test across all components)
+
+After modifying any files in the project, you must run the relevant `task check` command that covers that area of the code. For example, when editing frontend files run `task frontend:check`; for Python engine files run `task engine:check`; for Java backend files run `task backend:check`.

 ### Docker Development
- **Build ultra-lite**: `docker build -t stirlingtools/stirling-pdf:latest-ultra-lite -f ./Dockerfile.ultra-lite .`
- **Build standard**: `docker build -t stirlingtools/stirling-pdf:latest -f ./Dockerfile .`
- **Build fat version**: `docker build -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat .`
+- **Build standard**: `task docker:build` (or `docker build -t stirling-pdf -f docker/embedded/Dockerfile .`)
+- **Build fat version**: `task docker:build:fat`
+- **Build ultra-lite**: `task docker:build:ultra-lite`
+- **Start compose stack**: `task docker:up` (or `task docker:up:fat`, `task docker:up:ultra-lite`)
+- **Stop compose stack**: `task docker:down`
+- **View logs**: `task docker:logs`
 - **Example compose files**: Located in `exampleYmlFiles/` directory

 ### Security Mode Development
 Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.

-### Python Development
-Development for the AI engine happens in the `engine/` folder. The frontend calls the Python via Java as a proxy.
+### Python Development (AI Engine)

- Follow the engine-specific guidance in [engine/AGENTS.md](engine/AGENTS.md) for Python architecture, code style, and AI usage.
- Use Makefile commands for Python work:
-  - From `engine/`: `make check` to lint, type-check, test, etc. and `make fix` to fix easily fixable linting and formatting issues.
- The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `make install`.
+The engine is a Python reasoning service for Stirling: it plans and interprets work, but it does not own durable state, and it does not execute Stirling PDF operations directly. Keep the service narrow: typed contracts in, typed contracts out, with AI only where it adds reasoning value. The frontend calls the Python engine via Java as a proxy.
+
+#### Python Commands
+All engine commands run from the repo root using Task:
+- `task engine:check` — run all checks (typecheck + lint + format-check + test)
+- `task engine:fix` — auto-fix lint + formatting
+- `task engine:install` — install Python dependencies via uv
+- `task engine:dev` — start FastAPI with hot reload (localhost:5001)
+- `task engine:test` — run pytest
+- `task engine:lint` — run ruff linting
+- `task engine:typecheck` — run pyright
+- `task engine:format` — format code with ruff
+- `task engine:tool-models` — generate `tool_models.py` from the Java OpenAPI spec
+
+The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
+
+#### Python Code Style
+- Keep `task engine:check` passing.
+- Use modern Python when it improves clarity.
+- Prefer explicit names to cleverness.
+- Avoid nested functions and nested classes unless the language construct requires them.
+- Prefer composition to inheritance when combining concepts.
+- Avoid speculative abstractions. Add a layer only when it removes real duplication or clarifies lifecycle.
+- Add comments sparingly and only when they explain non-obvious intent.
+
+#### Python Typing and Models
+- Deserialize into Pydantic models as early as possible.
+- Serialize from Pydantic models as late as possible.
+- Do not pass raw `dict[str, Any]` or `dict[str, object]` across important boundaries when a typed model can exist instead.
+- Avoid `Any` wherever possible.
+- Avoid `cast()` wherever possible (reconsider the structure first).
+- All shared models should subclass `stirling.models.ApiModel` so the service behaves consistently.
+- Do not use string literals for any type annotations, including `cast()`.
+
+#### Python Configuration
+- Keep application-owned configuration in `stirling.config`.
+- Only add `STIRLING_*` environment variables that the engine itself truly owns.
+- Do not mirror third-party provider environment variables unless the engine is actually interpreting them.
+- Let `pydantic-ai` own provider authentication configuration when possible.
+
+#### Python Architecture
+
+**Package roles:**
+- `stirling.contracts`: request/response models and shared typed workflow contracts. If a shape crosses a module or service boundary, it probably belongs here.
+- `stirling.models`: shared model primitives and generated tool models.
+- `stirling.agents`: reasoning modules for individual capabilities.
+- `stirling.api`: HTTP layer, dependency access, and app startup wiring.
+- `stirling.services`: shared runtime and non-AI infrastructure.
+- `stirling.config`: application-owned settings.
+
+**Source of truth:**
+- `stirling.models.tool_models` is the source of truth for operation IDs and parameter models.
+- Do not duplicate operation lists if they can be derived from `tool_models.OPERATIONS`.
+- Do not hand-maintain parallel parameter schemas when the generated tool models already define them.
+- If a tool ID must match a parameter model, validate that relationship explicitly in code.
+
+**Boundaries:**
+- Keep the API layer thin. Route modules should bind requests, resolve dependencies, and call agents or services. They should not contain business logic.
+- Keep agents focused on one reasoning domain. They should not own FastAPI routing, persistence, or execution of Stirling operations.
+- Build long-lived runtime objects centrally at startup when possible rather than reconstructing heavy AI objects per request.
+- If an agent delegates to another agent, the delegated agent should remain the source of truth for its own domain output.
+
+#### Python AI Usage
+- The system must work with any AI, including self-hosted models. We require that the models support structured outputs, but should minimise model-specific code beyond that.
+- Use AI for reasoning-heavy outputs, not deterministic glue.
+- Do not ask the model to invent data that Python can derive safely.
+- Do not fabricate fallback user-facing copy in code to hide incomplete model output.
+- AI output schemas should be impossible to instantiate incorrectly.
+  - Do not require the model to keep separate structures in sync. For example, instead of generating two lists which must be the same length, generate one list of a model containing the same data.
+  - Prefer Python to derive deterministic follow-up structure from a valid AI result.
+- Use `NativeOutput(...)` for structured model outputs.
+- Use `ToolOutput(...)` when the model should select and call delegate functions.
+
+#### Python Testing
+- Test contracts directly.
+- Test agents directly where behaviour matters.
+- Test API routes as thin integration points.
+- Prefer dependency overrides or startup-state seams to monkeypatching random globals.

 ### Frontend Development
- **Frontend dev server**: `cd frontend && npm run dev` (requires backend on localhost:8080)
+- **Frontend dev server**: `task frontend:dev` — requires backend on localhost:8080
 - **Tech Stack**: Vite + React + TypeScript + Mantine UI + TailwindCSS
 - **Proxy Configuration**: Vite proxies `/api/*` calls to backend (localhost:8080)
 - **Build Process**: DO NOT run build scripts manually - builds are handled by CI/CD pipelines
- **Package Installation**: DO NOT run npm install commands - package management handled separately
+- **Package Installation**: `task frontend:install`
 - **Deployment Options**:
-  - **Desktop App**: `npm run tauri-build` (native desktop application)
-  - **Web Server**: `npm run build` then serve dist/ folder
-  - **Development**: `npm run tauri-dev` for desktop dev mode
+  - **Desktop App**: `task desktop:build`
+  - **Web Server**: `task frontend:build` then serve dist/ folder
+  - **Development**: `task desktop:dev` for desktop dev mode

 #### Environment Variables
 - All `VITE_*` variables must be declared in the appropriate example file:
@@ -44,8 +141,8 @@ Development for the AI engine happens in the `engine/` folder. The frontend call
  - `frontend/config/.env.saas.example` — SaaS-only vars
  - `frontend/config/.env.desktop.example` — desktop (Tauri)-only vars
 - Never use `|| 'hardcoded-fallback'` inline — put defaults in the example files
- `npm run prep` / `prep:saas` / `prep:desktop` auto-create the env files from examples on first run, and error if any required keys are missing
- These prep scripts run automatically at the start of all `dev*`, `build*`, and `tauri*` commands
+- `task frontend:prepare` / `prepare:saas` / `prepare:desktop` auto-create the env files from examples on first run, and error if any required keys are missing
+- Prepare runs automatically as a dependency of all `dev*`, `build*`, and `desktop*` tasks
 - See `frontend/README.md#environment-variables` for full documentation

 #### Import Paths - CRITICAL
@@ -299,15 +396,17 @@ The frontend is organized with a clear separation of concerns:

 ## Development Workflow

-1. **Local Development**:
-   - Backend: `./gradlew bootRun` (runs on localhost:8080)
-   - Frontend: `cd frontend && npm run dev` (runs on localhost:5173, proxies to backend)
-2. **Docker Testing**: Use `./test.sh` before submitting PRs
-3. **Code Style**: Spotless enforces Google Java Format automatically
-4. **Translations**:
+1. **Local Development** (using Taskfile):
+   - Backend + frontend: `task dev`
+   - All services (including AI engine): `task dev:all`
+   - Or individually: `task backend:dev` (localhost:8080), `task frontend:dev` (localhost:5173), `task engine:dev` (localhost:5001)
+2. **Quality Gate**: Run `task check` before submitting PRs
+3. **Docker Testing**: Use `./test.sh` for full Docker integration tests
+4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
+5. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
-5. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`
+6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status

@@ -15,6 +15,19 @@ Before you start working on an issue, please comment on (or create) the issue an
 Once you have been assigned an issue, you can start working on it. When you are ready to submit your changes, open a pull request.
 For a detailed pull request tutorial, see [this guide](https://www.digitalocean.com/community/tutorials/how-to-create-a-pull-request-on-github).

+## Development Quick Start
+
+This project uses [Task](https://taskfile.dev/) as a unified command runner. After cloning:
+
+1. Install the `task` CLI: https://taskfile.dev/installation/
+2. Run `task install` to install all dependencies
+3. Run `task dev` to start backend + frontend
+4. Run `task check` before submitting a PR
+
+Run `task --list` to see all available commands.
+
+## Pull Request Guidelines
+
 Please make sure your Pull Request adheres to the following guidelines:

 - Use the PR template provided.
@@ -39,9 +52,10 @@ If, at any point in time, you have a question, please feel free to ask in the sa

 ## Developer Documentation

-For technical guides, setup instructions, and development resources, please see our [Developer Documentation](devGuide/) which includes:
+For technical guides, setup instructions, and development resources:

- [Developer Guide](devGuide/DeveloperGuide.md) - Main setup and architecture guide
+- [Developer Guide](DeveloperGuide.md) - Main setup and architecture guide
+- [Taskfile.yml](Taskfile.yml) - Unified task runner for all build/dev/test/lint commands
 - [Exception Handling Guide](devGuide/EXCEPTION_HANDLING_GUIDE.md) - Error handling patterns and i18n
 - [Translation Guide](devGuide/HowToAddNewLanguage.md) - Adding new languages
 - And more in the [devGuide folder](devGuide/)
@@ -42,11 +42,13 @@ This guide focuses on developing for Stirling 2.0, including both the React fron

 ### Prerequisites

+- [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
 - Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
+- [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)

@@ -82,13 +84,29 @@ For local testing, you should generally be testing the full 'Security' version o
 5. **Frontend Setup (Required for Stirling 2.0)**
   Navigate to the frontend directory and install dependencies using npm.

+### Verify Setup
+
+Run `task install` to install all project dependencies (frontend npm packages, engine Python packages). Gradle manages its own dependencies automatically. Then run `task check` to verify everything builds and passes.
+
 ## 4. Stirling 2.0 Development Workflow

+### Using Taskfile (Recommended)
+
+The fastest way to start developing:
+
+1. **Start developing**: `task dev` (runs backend + frontend concurrently — Ctrl+C to stop)
+2. **Or start services individually** in separate terminals:
+   - `task backend:dev` — Spring Boot on localhost:8080
+   - `task frontend:dev` — Vite on localhost:5173
+   - `task engine:dev` — FastAPI on localhost:5001
+
+Run `task --list` to see all available commands.
+
 ### Frontend Development (React)
 The frontend is a React SPA that runs independently during development:

-1. **Start the backend**: Run the Spring Boot application (serves API endpoints on localhost:8080)
-2. **Start the frontend dev server**: Navigate to the frontend directory and run the development server (serves UI on localhost:5173)
+1. **Start the backend**: `task backend:dev` (serves API endpoints on localhost:8080)
+2. **Start the frontend dev server**: `task frontend:dev` (serves UI on localhost:5173)
 3. **Development flow**: The Vite dev server automatically proxies API calls to the backend

 ### File Storage Architecture
@@ -99,7 +117,10 @@ Stirling 2.0 uses client-side file storage:

 ### Tauri Desktop App Development
 Stirling-PDF can be packaged as a cross-platform desktop application using Tauri with PDF file association support and bundled JRE.
-See [the frontend README](frontend/README.md#tauri) for build instructions.
+
+Using Taskfile: `task desktop:dev` (development) or `task desktop:build` (production build).
+
+See [the frontend README](frontend/README.md#tauri) for detailed build instructions.

 ## 5. Project Structure

@@ -187,7 +208,7 @@ services:
        limits:
          memory: 4G
    healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:8080/api/v1/info/status | grep -q 'UP' && curl -fL http://localhost:8080/ | grep -q 'Please sign in'"]
+      test: ["CMD-SHELL", "curl -f http://localhost:8080$${SYSTEM_ROOTURIPATH:-''}/api/v1/info/status | grep -q 'UP' && curl -fL http://localhost:8080/ | grep -q 'Please sign in'"]
      interval: 5s
      timeout: 10s
      retries: 16
@@ -222,6 +243,20 @@ docker-compose -f exampleYmlFiles/docker-compose-latest-security.yml up

 ### Building Docker Images

+#### Using Taskfile (Recommended)
+
+```bash
+task docker:build            # standard image
+task docker:build:fat        # fat image (all features)
+task docker:build:ultra-lite # ultra-lite image
+task docker:up               # start standard compose stack
+task docker:up:fat           # start fat compose stack
+task docker:down             # stop all stacks
+task docker:logs             # tail logs
+```
+
+#### Manual Docker Builds
+
 Stirling-PDF uses different Docker images for various configurations. The build process is controlled by environment variables and uses specific Dockerfile variants. Here's how to build the Docker images:

 1. Set the security environment variable:
@@ -230,10 +265,10 @@ Stirling-PDF uses different Docker images for various configurations. The build
   export DISABLE_ADDITIONAL_FEATURES=true  # or false for to enable login and security features for builds
   ```

-2. Build the project with Gradle:
+2. Build the project:

   ```bash
-   ./gradlew clean build
+   task backend:build
   ```

 3. Build the Docker images:
@@ -261,9 +296,18 @@ Note: The `--no-cache` and `--pull` flags ensure that the build process uses the

 ## 7. Testing

+### Quick Testing with Taskfile
+
+Run all unit/integration tests across all components:
+
+```bash
+task test    # run all tests (backend + frontend + engine)
+task check   # full quality gate: lint + typecheck + test
+```
+
 ### Comprehensive Testing Script

-Stirling-PDF provides a `test.sh` script in the root directory. This script builds all versions of Stirling-PDF, checks that each version works, and runs Cucumber tests. It's recommended to run this script before submitting a final pull request.
+Stirling-PDF also provides a `test.sh` script in the root directory for Docker integration tests. This script builds all versions of Stirling-PDF, checks that each version works, and runs Cucumber tests. It's recommended to run this script before submitting a final pull request.

 To run the test script:

@@ -289,10 +333,11 @@ Note: The `test.sh` script will run automatically when you raise a PR. However,

 For React frontend development:

-1. Start the backend: Run the Spring Boot application to serve API endpoints on localhost:8080
-2. Start the frontend dev server: Navigate to the frontend directory and run the development server on localhost:5173
+1. Start the backend: `task backend:dev` (serves API endpoints on localhost:8080)
+2. Start the frontend dev server: `task frontend:dev` (serves UI on localhost:5173)
 3. The Vite dev server automatically proxies API calls to the backend
-4. Test React components, UI interactions, and IndexedDB file operations using browser developer tools
+4. Run frontend tests: `task frontend:test` (or `task frontend:test:watch` for watch mode)
+5. Test React components, UI interactions, and IndexedDB file operations using browser developer tools

 ### Local Testing (Java and UI Components)

@@ -308,7 +353,7 @@ To run Stirling-PDF locally:
 1. Compile and run the project using built-in IDE methods or by running:

   ```bash
-   ./gradlew bootRun
+   task backend:dev
   ```

 2. Access the application at `http://localhost:8080` in your web browser.
@@ -329,10 +374,11 @@ Important notes:
 2. Create a new branch for your feature or bug fix.
 3. Make your changes and commit them with clear, descriptive messages and ensure any documentation is updated related to your changes.
 4. Test your changes thoroughly in the Docker environment.
-5. Run the `test.sh` script to ensure all versions build correctly and pass the Cucumber tests:
+5. Run the quality gate and integration tests:

   ```bash
-   ./test.sh
+   task check   # lint + typecheck + test across all components
+   ./test.sh    # Docker integration tests (builds all variants + Cucumber)
   ```

 6. Push your changes to your fork.
@@ -14,6 +14,8 @@ if that directory exists, is licensed under the license defined in "frontend/src
 if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * All content that resides under the "frontend/src/saas/" directory of this repository,
 if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
+* All content that resides under the "frontend/src/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.

@@ -60,7 +60,7 @@ For full installation options (including desktop and Kubernetes), see our [Docum

 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

-For development setup, see the [Developer Guide](DeveloperGuide.md).
+This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task install` to get started, or see the [Developer Guide](DeveloperGuide.md) for full details.

 For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).

@@ -0,0 +1,128 @@
+version: '3'
+
+output: prefixed
+
+includes:
+  backend:
+    taskfile: .taskfiles/backend.yml
+    dir: .
+  frontend:
+    taskfile: .taskfiles/frontend.yml
+    dir: frontend
+  engine:
+    taskfile: .taskfiles/engine.yml
+    dir: engine
+  docker:
+    taskfile: .taskfiles/docker.yml
+    dir: .
+  desktop:
+    taskfile: .taskfiles/desktop.yml
+    dir: frontend
+
+tasks:
+  # ============================================================
+  # Setup & Prerequisites
+  # ============================================================
+
+  install:
+    desc: "Install all project dependencies"
+    cmds:
+      - task: frontend:install
+      - task: engine:install
+
+  # ============================================================
+  # Development
+  # ============================================================
+
+  dev:
+    desc: "Start backend + frontend concurrently"
+    deps:
+      - backend:dev
+      - frontend:dev
+
+  dev:all:
+    desc: "Start backend + frontend + engine concurrently"
+    deps:
+      - backend:dev
+      - frontend:dev:prototypes
+      - engine:dev
+
+  # ============================================================
+  # Build
+  # ============================================================
+
+  build:
+    desc: "Build all components"
+    cmds:
+      - task: backend:build
+      - task: frontend:build
+
+  # ============================================================
+  # Test
+  # ============================================================
+
+  test:
+    desc: "Run ALL tests (backend + frontend + engine)"
+    cmds:
+      - task: backend:test
+      - task: frontend:test
+      - task: engine:test
+
+  # ============================================================
+  # Lint & Format
+  # ============================================================
+
+  lint:
+    desc: "Run all linters"
+    cmds:
+      - task: frontend:lint
+      - task: engine:lint
+
+  fix:
+    desc: "Auto-fix all components"
+    cmds:
+      - task: backend:fix
+      - task: frontend:fix
+      - task: engine:fix
+
+  format:
+    desc: "Auto-fix formatting across all components"
+    cmds:
+      - task: backend:format
+      - task: frontend:format
+      - task: engine:format
+
+  format:check:
+    desc: "Check formatting across all components"
+    cmds:
+      - task: backend:format:check
+      - task: frontend:format:check
+      - task: engine:format:check
+
+  # ============================================================
+  # Quality Gate
+  # ============================================================
+
+  check:
+    desc: "Quick quality gate for local development"
+    cmds:
+      - task: backend:check
+      - task: frontend:check
+      - task: engine:check
+
+  check:all:
+    desc: "Full CI quality gate"
+    cmds:
+      - task: backend:check
+      - task: frontend:check:all
+      - task: engine:check
+
+  # ============================================================
+  # Clean
+  # ============================================================
+
+  clean:
+    desc: "Clean all build artifacts"
+    cmds:
+      - task: backend:clean
+      - task: engine:clean
@@ -7,6 +7,8 @@ spotless {
        target 'src/**/java/**/*.java'
        targetExclude 'src/main/java/org/apache/**'
        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
+        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
+        suppressLintsFor { setStep('google-java-format') }

        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
        trimTrailingWhitespace()
@@ -75,6 +75,7 @@ public class ApplicationProperties {
    private AutoPipeline autoPipeline = new AutoPipeline();
    private ProcessExecutor processExecutor = new ProcessExecutor();
    private PdfEditor pdfEditor = new PdfEditor();
+    private AiEngine aiEngine = new AiEngine();

    @Bean
    public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -231,6 +232,13 @@ public class ApplicationProperties {
        }
    }

+    @Data
+    public static class AiEngine {
+        private boolean enabled = false;
+        private String url = "http://localhost:5001";
+        private int timeoutSeconds = 120;
+    }
+
    @Data
    public static class Legal {
        private String termsAndConditions;
@@ -1,15 +1,19 @@
 package stirling.software.common.service;

 import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;

 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -143,6 +147,59 @@ public class FileStorage {
        return new StoredFile(fileId, size);
    }

+    public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
+            throws IOException {
+        String fileId = generateFileId();
+        Path filePath = getFilePath(fileId);
+        Files.createDirectories(filePath.getParent());
+        boolean success = false;
+        try (OutputStream os = new BufferedOutputStream(Files.newOutputStream(filePath))) {
+            body.writeTo(os);
+            success = true;
+        } finally {
+            if (!success) {
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
+            }
+        }
+        log.debug("Stored StreamingResponseBody with ID: {}", fileId);
+        return fileId;
+    }
+
+    /**
+     * Persist a {@link Resource} body to disk, returning the generated file ID. Used by the async
+     * job pipeline to capture {@code ResponseEntity<Resource>} results produced by controllers.
+     */
+    public String storeFromResource(Resource resource, String originalName) throws IOException {
+        String fileId = generateFileId();
+        Path filePath = getFilePath(fileId);
+        Files.createDirectories(filePath.getParent());
+        boolean success = false;
+        try (InputStream in = resource.getInputStream()) {
+            Files.copy(in, filePath);
+            success = true;
+        } finally {
+            if (!success) {
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
+            }
+        }
+        log.debug("Stored Resource with ID: {}", fileId);
+        return fileId;
+    }
+
    /**
     * Delete a file by its ID
     *
@@ -0,0 +1,184 @@
+package stirling.software.common.service;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.regex.Pattern;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.env.Environment;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.*;
+import org.springframework.stereotype.Service;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RequestCallback;
+import org.springframework.web.client.RestTemplate;
+
+import jakarta.servlet.ServletContext;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+
+/**
+ * Dispatches HTTP POST requests to internal Stirling API endpoints via loopback. Used by
+ * PipelineProcessor and AiWorkflowService to execute tool operations programmatically without
+ * leaving the JVM network stack.
+ */
+@Service
+@Slf4j
+public class InternalApiClient {
+
+    // Allowlist for internal dispatch. Matches a fixed namespace prefix,
+    // but rejects traversal (..), URL-encoding (%), query/fragment, backslashes, and any other
+    // character that could alter the resolved endpoint on the local Spring server.
+    private static final Pattern ALLOWED_ENDPOINT_PATH =
+            Pattern.compile("^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$");
+
+    private final ServletContext servletContext;
+    private final UserServiceInterface userService;
+    private final TempFileManager tempFileManager;
+    private final Environment environment;
+
+    public InternalApiClient(
+            ServletContext servletContext,
+            @Autowired(required = false) UserServiceInterface userService,
+            TempFileManager tempFileManager,
+            Environment environment) {
+        this.servletContext = servletContext;
+        this.userService = userService;
+        this.tempFileManager = tempFileManager;
+        this.environment = environment;
+    }
+
+    /**
+     * POST to an internal API endpoint. The endpointPath must start with one of the allowed
+     * prefixes (e.g. {@code /api/v1/misc/compress-pdf}).
+     *
+     * @param endpointPath API path (e.g. {@code /api/v1/general/rotate-pdf})
+     * @param body multipart form body (fileInput + parameters)
+     * @return response with the result file as a {@link TempFileResource} body
+     */
+    public ResponseEntity<Resource> post(String endpointPath, MultiValueMap<String, Object> body) {
+        validateUrl(endpointPath);
+        String url = getBaseUrl() + endpointPath;
+
+        RestTemplate restTemplate = new RestTemplate();
+        HttpHeaders headers = new HttpHeaders();
+        String apiKey = getApiKeyForUser();
+        if (apiKey != null && !apiKey.isEmpty()) {
+            headers.add("X-API-KEY", apiKey);
+        }
+
+        HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
+        RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);
+
+        return restTemplate.execute(
+                url,
+                HttpMethod.POST,
+                requestCallback,
+                response -> {
+                    try {
+                        TempFile tempFile = tempFileManager.createManagedTempFile("internal-api");
+                        Files.copy(
+                                response.getBody(),
+                                tempFile.getPath(),
+                                java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                        String filename = extractFilename(response.getHeaders());
+                        TempFileResource resource = new TempFileResource(tempFile, filename);
+                        return ResponseEntity.status(response.getStatusCode())
+                                .headers(response.getHeaders())
+                                .body(resource);
+                    } catch (IOException e) {
+                        throw new UncheckedIOException(e);
+                    }
+                });
+    }
+
+    /**
+     * Extract the filename from a response's {@code Content-Disposition} header. Returns {@code
+     * null} if the header is missing or has no filename.
+     */
+    private static String extractFilename(HttpHeaders headers) {
+        String contentDisposition = headers.getFirst(HttpHeaders.CONTENT_DISPOSITION);
+        if (contentDisposition == null || contentDisposition.isBlank()) {
+            return null;
+        }
+        for (String part : contentDisposition.split(";")) {
+            String trimmed = part.trim();
+            if (trimmed.startsWith("filename")) {
+                String[] kv = trimmed.split("=", 2);
+                if (kv.length != 2) {
+                    continue;
+                }
+                String value = kv[1].trim().replace("\"", "");
+                return URLDecoder.decode(value, StandardCharsets.UTF_8);
+            }
+        }
+        return null;
+    }
+
+    private String getBaseUrl() {
+        // Resolve the port lazily so desktop mode (server.port=0, OS-assigned) dispatches to the
+        // actual bound port. Spring publishes local.server.port once the web server is up; fall
+        // back to the configured server.port for early calls (tests, non-web contexts).
+        String port = environment.getProperty("local.server.port");
+        if (port == null) {
+            port = environment.getProperty("server.port", "8080");
+        }
+        return "http://localhost:" + port + servletContext.getContextPath();
+    }
+
+    private String getApiKeyForUser() {
+        if (userService == null) return "";
+        String username = userService.getCurrentUsername();
+        if (username != null && !username.equals("anonymousUser")) {
+            return userService.getApiKeyForUser(username);
+        }
+        return userService.getApiKeyForUser(Role.INTERNAL_API_USER.getRoleId());
+    }
+
+    private void validateUrl(String endpointPath) {
+        if (endpointPath == null || !ALLOWED_ENDPOINT_PATH.matcher(endpointPath).matches()) {
+            log.warn("Blocked internal API request to disallowed path: {}", endpointPath);
+            throw new SecurityException(
+                    "Internal API dispatch not permitted for endpoint: " + endpointPath);
+        }
+    }
+
+    /**
+     * A {@link FileSystemResource} that holds a reference to its backing {@link TempFile}.
+     *
+     * <p>If a display filename is supplied (typically parsed from the upstream response's {@code
+     * Content-Disposition} header), it is returned from {@link #getFilename()} instead of the
+     * underlying temp file's path-based name.
+     */
+    public static class TempFileResource extends FileSystemResource {
+        private final TempFile tempFile;
+        private final String displayFilename;
+
+        public TempFileResource(TempFile tempFile) {
+            this(tempFile, null);
+        }
+
+        public TempFileResource(TempFile tempFile, String displayFilename) {
+            super(tempFile.getFile());
+            this.tempFile = tempFile;
+            this.displayFilename = displayFilename;
+        }
+
+        public TempFile getTempFile() {
+            return tempFile;
+        }
+
+        @Override
+        public String getFilename() {
+            return displayFilename != null ? displayFilename : super.getFilename();
+        }
+    }
+}
@@ -11,11 +11,13 @@ import java.util.function.Supplier;

 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import jakarta.servlet.http.HttpServletRequest;

@@ -305,33 +307,28 @@ public class JobExecutorService {
                Object body = response.getBody();

                if (body instanceof byte[]) {
-                    // Extract filename from content-disposition header if available
-                    String filename = "result.pdf";
-                    String contentType = MediaType.APPLICATION_PDF_VALUE;
+                    String filename = extractResponseFilename(response);
+                    String contentType = extractResponseContentType(response);

-                    if (response.getHeaders().getContentDisposition() != null) {
-                        String disposition =
-                                response.getHeaders().getContentDisposition().toString();
-                        if (disposition.contains("filename=")) {
-                            filename =
-                                    disposition.substring(
-                                            disposition.indexOf("filename=") + 9,
-                                            disposition.lastIndexOf('"'));
-                        }
-                    }
-
-                    MediaType mediaType = response.getHeaders().getContentType();
-
-                    if (mediaType != null) {
-                        contentType = mediaType.toString();
-                    }
-
-                    // Store byte array directly to disk
                    String fileId = fileStorage.storeBytes((byte[]) body, filename);
                    taskManager.setFileResult(jobId, fileId, filename, contentType);
                    log.debug("Stored ResponseEntity<byte[]> result with fileId: {}", fileId);
+                } else if (body instanceof StreamingResponseBody streamingBody) {
+                    String filename = extractResponseFilename(response);
+                    String contentType = extractResponseContentType(response);

-                    // Let the GC handle the memory naturally
+                    String fileId = fileStorage.storeFromStreamingBody(streamingBody, filename);
+                    taskManager.setFileResult(jobId, fileId, filename, contentType);
+                    log.debug(
+                            "Stored ResponseEntity<StreamingResponseBody> result with fileId: {}",
+                            fileId);
+                } else if (body instanceof Resource resource) {
+                    String filename = extractResponseFilename(response);
+                    String contentType = extractResponseContentType(response);
+
+                    String fileId = fileStorage.storeFromResource(resource, filename);
+                    taskManager.setFileResult(jobId, fileId, filename, contentType);
+                    log.debug("Stored ResponseEntity<Resource> result with fileId: {}", fileId);
                } else {
                    // Check if the response body contains a fileId
                    if (body != null && body.toString().contains("fileId")) {
@@ -481,6 +478,21 @@ public class JobExecutorService {
        }
    }

+    private static String extractResponseFilename(ResponseEntity<?> response) {
+        if (response.getHeaders().getContentDisposition() != null) {
+            String filename = response.getHeaders().getContentDisposition().getFilename();
+            if (filename != null && !filename.isEmpty()) {
+                return filename;
+            }
+        }
+        return "result.pdf";
+    }
+
+    private static String extractResponseContentType(ResponseEntity<?> response) {
+        MediaType mediaType = response.getHeaders().getContentType();
+        return mediaType != null ? mediaType.toString() : MediaType.APPLICATION_PDF_VALUE;
+    }
+
    /**
     * Parse session timeout string (e.g., "30m", "1h") to milliseconds
     *
@@ -401,7 +401,7 @@ public class JobQueue implements SmartLifecycle {
     * @throws Exception If there is an execution error
     */
    private <T> T executeWithTimeout(Supplier<T> supplier, long timeoutMs) throws Exception {
-        CompletableFuture<T> future = CompletableFuture.supplyAsync(supplier);
+        CompletableFuture<T> future = CompletableFuture.supplyAsync(supplier, jobExecutor);

        try {
            if (timeoutMs <= 0) {
@@ -7,11 +7,8 @@ import java.lang.management.MemoryMXBean;
 import java.lang.management.OperatingSystemMXBean;
 import java.lang.management.RuntimeMXBean;
 import java.lang.management.ThreadMXBean;
-import java.net.InetAddress;
-import java.net.NetworkInterface;
 import java.nio.file.Files;
 import java.nio.file.Paths;
-import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
@@ -94,21 +91,12 @@ public class PostHogService {
            metrics.put("os_name", System.getProperty("os.name"));
            metrics.put("os_version", System.getProperty("os.version"));
            metrics.put("java_version", System.getProperty("java.version"));
-            metrics.put("user_name", System.getProperty("user.name"));
-            metrics.put("user_home", System.getProperty("user.home"));
-            metrics.put("user_dir", System.getProperty("user.dir"));

            // CPU and Memory
            metrics.put("cpu_cores", Runtime.getRuntime().availableProcessors());
            metrics.put("total_memory", Runtime.getRuntime().totalMemory());
            metrics.put("free_memory", Runtime.getRuntime().freeMemory());

-            // Network and Server Identity
-            InetAddress localHost = InetAddress.getLocalHost();
-            metrics.put("ip_address", localHost.getHostAddress());
-            metrics.put("hostname", localHost.getHostName());
-            metrics.put("mac_address", getMacAddress());
-
            // JVM info
            metrics.put("jvm_vendor", System.getProperty("java.vendor"));
            metrics.put("jvm_version", System.getProperty("java.vm.version"));
@@ -153,9 +141,6 @@ public class PostHogService {
                metrics.put("gc_" + gcBean.getName() + "_time", gcBean.getCollectionTime());
            }

-            // Network interfaces
-            metrics.put("network_interfaces", getNetworkInterfacesInfo());
-
            // Docker detection and stats
            boolean isDocker = isRunningInDocker();
            if (isDocker) {
@@ -353,30 +338,6 @@ public class PostHogService {
                            .getProFeatures()
                            .getCustomMetadata()
                            .isAutoUpdateMetadata());
-            addIfNotEmpty(
-                    properties,
-                    "enterpriseEdition_customMetadata_author",
-                    applicationProperties
-                            .getPremium()
-                            .getProFeatures()
-                            .getCustomMetadata()
-                            .getAuthor());
-            addIfNotEmpty(
-                    properties,
-                    "enterpriseEdition_customMetadata_creator",
-                    applicationProperties
-                            .getPremium()
-                            .getProFeatures()
-                            .getCustomMetadata()
-                            .getCreator());
-            addIfNotEmpty(
-                    properties,
-                    "enterpriseEdition_customMetadata_producer",
-                    applicationProperties
-                            .getPremium()
-                            .getProFeatures()
-                            .getCustomMetadata()
-                            .getProducer());
        }
        // Capture AutoPipeline properties
        addIfNotEmpty(
@@ -386,39 +347,4 @@ public class PostHogService {

        return properties;
    }
-
-    private String getMacAddress() {
-        try {
-            Enumeration<NetworkInterface> networkInterfaces =
-                    NetworkInterface.getNetworkInterfaces();
-            while (networkInterfaces.hasMoreElements()) {
-                NetworkInterface ni = networkInterfaces.nextElement();
-                byte[] hardwareAddress = ni.getHardwareAddress();
-                if (hardwareAddress != null) {
-                    String[] hexadecimal = new String[hardwareAddress.length];
-                    for (int i = 0; i < hardwareAddress.length; i++) {
-                        hexadecimal[i] = String.format("%02X", hardwareAddress[i]);
-                    }
-                    return String.join("-", hexadecimal);
-                }
-            }
-        } catch (Exception e) {
-            // Handle exception
-        }
-        return "Unknown";
-    }
-
-    private Map<String, String> getNetworkInterfacesInfo() {
-        Map<String, String> interfacesInfo = new HashMap<>();
-        try {
-            Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
-            while (nets.hasMoreElements()) {
-                NetworkInterface netint = nets.nextElement();
-                interfacesInfo.put(netint.getName(), netint.getDisplayName());
-            }
-        } catch (Exception e) {
-            interfacesInfo.put("error", e.getMessage());
-        }
-        return interfacesInfo;
-    }
 }
@@ -0,0 +1,18 @@
+package stirling.software.common.service;
+
+/** Provides metadata about tool endpoints for internal dispatch. */
+public interface ToolMetadataService {
+
+    /** Returns true if the given operation path accepts multiple input files. */
+    boolean isMultiInput(String operationPath);
+
+    /**
+     * Returns true when the endpoint's ZIP response is a transport for multiple typed results and
+     * should be unpacked: multi-output endpoints (Type:SIMO / Type:MIMO) and wrapper declarations
+     * such as {@code Output:ZIP-PDF} or {@code Output:IMAGE/ZIP}.
+     *
+     * <p>Returns false for a bare {@code Output:ZIP} (e.g. {@code get-attachments}), where the
+     * archive itself is the deliverable and should be kept packed.
+     */
+    boolean shouldUnpackZipResponse(String operationPath);
+}
@@ -1,6 +1,5 @@
 package stirling.software.common.util;

-import java.io.ByteArrayInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -66,16 +65,7 @@ public class FileToPdf {
                        ProcessExecutor.getInstance(ProcessExecutor.Processes.WEASYPRINT)
                                .runCommandWithOutputHandling(command);

-                byte[] pdfBytes = Files.readAllBytes(tempOutputFile.getPath());
-                try {
-                    return pdfBytes;
-                } catch (Exception e) {
-                    pdfBytes = Files.readAllBytes(tempOutputFile.getPath());
-                    if (pdfBytes.length < 1) {
-                        throw e;
-                    }
-                    return pdfBytes;
-                }
+                return Files.readAllBytes(tempOutputFile.getPath());
            } // tempInputFile auto-closed
        } // tempOutputFile auto-closed
    }
@@ -92,8 +82,7 @@ public class FileToPdf {
            throws IOException {
        try (TempDirectory tempUnzippedDir = new TempDirectory(tempFileManager)) {
            try (ZipInputStream zipIn =
-                    ZipSecurity.createHardenedInputStream(
-                            new ByteArrayInputStream(Files.readAllBytes(zipFilePath)))) {
+                    ZipSecurity.createHardenedInputStream(Files.newInputStream(zipFilePath))) {
                ZipEntry entry = zipIn.getNextEntry();
                while (entry != null) {
                    Path filePath =
@@ -629,11 +629,13 @@ public class FormUtils {
            }
            log.debug("Skipping form fill because document has no AcroForm");
            if (flatten) {
-                flattenEntireDocument(document, null);
+                flattenEntireDocument(document, null, false, false);
            }
            return;
        }

+        boolean valuesProvided = values != null && !values.isEmpty();
+        boolean valuesApplied = false;
        if (values != null && !values.isEmpty()) {
            acroForm.setCacheFields(true);

@@ -667,18 +669,26 @@ public class FormUtils {
                Object rawValue = entry.getValue();
                String value = rawValue == null ? null : Objects.toString(rawValue, null);
                applyValueToField(field, value, strict);
+                valuesApplied = true;
            }

-            ensureAppearances(acroForm);
+            if (valuesApplied) {
+                ensureAppearances(acroForm);
+            }
        }

        repairWidgetGeometry(document, acroForm);

        if (flatten) {
-            flattenEntireDocument(document, acroForm);
+            flattenEntireDocument(document, acroForm, valuesApplied, valuesProvided);
        }
    }

+    // Cap the fallback rendering DPI. This path only runs when acroForm.flatten()
+    // throws, and the goal is a readable flattened document — not print quality —
+    // so clamping avoids runaway memory/CPU on pathological inputs.
+    private static final int FLATTEN_FALLBACK_MAX_DPI = 200;
+
    private void flattenViaRendering(PDDocument document, PDAcroForm acroForm) throws IOException {
        if (document == null) {
            return;
@@ -704,28 +714,35 @@ public class FormUtils {
                properties != null && properties.getSystem() != null
                        ? properties.getSystem().getMaxDPI()
                        : 300;
+        int effectiveDpi = Math.min(requestedDpi, FLATTEN_FALLBACK_MAX_DPI);

-        rebuildDocumentFromImages(document, renderer, requestedDpi);
+        rebuildDocumentFromImages(document, renderer, effectiveDpi);
    }

-    // note: this implementation suffers from:
-    // https://issues.apache.org/jira/browse/PDFBOX-5962
-    private void flattenEntireDocument(PDDocument document, PDAcroForm acroForm)
+    // Use PDFBox's built-in field flattening which bakes form field values
+    // into the page content stream as static text/graphics, removing the
+    // interactive form structure but preserving all other document content
+    // (images, text, annotations, etc.) at full quality.
+    //
+    // Forcing appearance regeneration via setNeedAppearances(true) drives
+    // PDFBox into refreshAppearances inside flatten(), where it can hang on
+    // certain documents (PDFBOX-5962). We therefore only regenerate when we
+    // actually wrote new values, or when the request included values and the
+    // document has widgets without appearance streams.
+    private void flattenEntireDocument(
+            PDDocument document, PDAcroForm acroForm, boolean valuesWritten, boolean valuesProvided)
            throws IOException {
-        if (document == null) {
+        if (document == null || acroForm == null) {
            return;
        }

-        if (acroForm == null) {
-            return;
-        }
-
-        // Use PDFBox's built-in field flattening which bakes form field values
-        // into the page content stream as static text/graphics, removing the
-        // interactive form structure but preserving all other document content
-        // (images, text, annotations, etc.) at full quality.
-        try {
+        if (valuesWritten || (valuesProvided && hasWidgetWithoutAppearance(acroForm))) {
            ensureAppearances(acroForm);
+        } else {
+            acroForm.setNeedAppearances(false);
+        }
+
+        try {
            acroForm.flatten();
        } catch (Exception e) {
            log.warn(
@@ -736,6 +753,28 @@ public class FormUtils {
        }
    }

+    private boolean hasWidgetWithoutAppearance(PDAcroForm acroForm) {
+        for (PDField field : acroForm.getFieldTree()) {
+            if (!(field instanceof PDTerminalField terminalField)) {
+                continue;
+            }
+            List<PDAnnotationWidget> widgets = terminalField.getWidgets();
+            if (widgets == null) {
+                continue;
+            }
+            for (PDAnnotationWidget widget : widgets) {
+                if (widget == null) {
+                    continue;
+                }
+                PDAppearanceDictionary appearance = widget.getAppearance();
+                if (appearance == null || appearance.getNormalAppearance() == null) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
    private void rebuildDocumentFromImages(PDDocument document, PDFRenderer renderer, int dpi)
            throws IOException {
        int pageCount = document.getNumberOfPages();
@@ -1183,4 +1183,25 @@ public class GeneralUtils {
            }
        }
    }
+
+    public String getLocalNetworkIp() {
+        try {
+            Enumeration<NetworkInterface> interfaces = NetworkInterface.getNetworkInterfaces();
+            if (interfaces == null) return null;
+            while (interfaces.hasMoreElements()) {
+                NetworkInterface iface = interfaces.nextElement();
+                if (!iface.isUp() || iface.isLoopback() || iface.isVirtual()) continue;
+                Enumeration<InetAddress> addresses = iface.getInetAddresses();
+                while (addresses.hasMoreElements()) {
+                    InetAddress addr = addresses.nextElement();
+                    if (addr instanceof Inet4Address && addr.isSiteLocalAddress()) {
+                        return addr.getHostAddress();
+                    }
+                }
+            }
+        } catch (Exception e) {
+            log.warn("Failed to detect local network IP", e);
+        }
+        return null;
+    }
 }
@@ -1,9 +1,9 @@
 package stirling.software.common.util;

-import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.io.OutputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
@@ -16,6 +16,7 @@ import java.util.zip.ZipOutputStream;

 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -48,7 +49,7 @@ public class PDFToFile {
        this.runtimePathConfig = runtimePathConfig;
    }

-    public ResponseEntity<byte[]> processPdfToMarkdown(MultipartFile inputFile)
+    public ResponseEntity<Resource> processPdfToMarkdown(MultipartFile inputFile)
            throws IOException, InterruptedException {
        if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -85,78 +86,77 @@ public class PDFToFile {
            pdfBaseName = originalPdfFileName.substring(0, originalPdfFileName.lastIndexOf('.'));
        }

-        byte[] fileBytes;
-        String fileName;
+        String fileName = pdfBaseName + "ToMarkdown.zip";
+        TempFile finalOut = tempFileManager.createManagedTempFile(".zip");
+        try {
+            try (TempFile tempInputFile = new TempFile(tempFileManager, ".pdf");
+                    TempDirectory tempOutputDir = new TempDirectory(tempFileManager)) {
+                inputFile.transferTo(tempInputFile.getFile());

-        try (TempFile tempInputFile = new TempFile(tempFileManager, ".pdf");
-                TempDirectory tempOutputDir = new TempDirectory(tempFileManager)) {
-            inputFile.transferTo(tempInputFile.getFile());
+                List<String> command =
+                        new ArrayList<>(
+                                Arrays.asList(
+                                        "pdftohtml",
+                                        "-s",
+                                        "-noframes",
+                                        "-c",
+                                        tempInputFile.getAbsolutePath(),
+                                        pdfBaseName));

-            List<String> command =
-                    new ArrayList<>(
-                            Arrays.asList(
-                                    "pdftohtml",
-                                    "-s",
-                                    "-noframes",
-                                    "-c",
-                                    tempInputFile.getAbsolutePath(),
-                                    pdfBaseName));
+                ProcessExecutorResult returnCode =
+                        ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
+                                .runCommandWithOutputHandling(
+                                        command, tempOutputDir.getPath().toFile());
+                // Process HTML files to Markdown
+                File[] outputFiles =
+                        Objects.requireNonNull(tempOutputDir.getPath().toFile().listFiles());
+                List<File> markdownFiles = new ArrayList<>();
+                List<File> imageFiles = new ArrayList<>();

-            ProcessExecutorResult returnCode =
-                    ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
-                            .runCommandWithOutputHandling(
-                                    command, tempOutputDir.getPath().toFile());
-            // Process HTML files to Markdown
-            File[] outputFiles =
-                    Objects.requireNonNull(tempOutputDir.getPath().toFile().listFiles());
-            List<File> markdownFiles = new ArrayList<>();
-            List<File> imageFiles = new ArrayList<>();
+                // Convert HTML files to Markdown and collect image files
+                for (File outputFile : outputFiles) {
+                    if (outputFile.getName().endsWith(".html")) {
+                        String html = Files.readString(outputFile.toPath());
+                        String markdown = htmlToMarkdownConverter.convert(html);

-            // Convert HTML files to Markdown and collect image files
-            for (File outputFile : outputFiles) {
-                if (outputFile.getName().endsWith(".html")) {
-                    String html = Files.readString(outputFile.toPath());
-                    String markdown = htmlToMarkdownConverter.convert(html);
+                        // Update image references to point to images/ folder
+                        markdown = updateImageReferences(markdown);

-                    // Update image references to point to images/ folder
-                    markdown = updateImageReferences(markdown);
+                        String mdFileName = outputFile.getName().replace(".html", ".md");
+                        File mdFile = new File(tempOutputDir.getPath().toFile(), mdFileName);
+                        Files.writeString(mdFile.toPath(), markdown);
+                        markdownFiles.add(mdFile);
+                    } else if (!outputFile.getName().endsWith(".md")) {
+                        // Collect non-HTML, non-MD files as images/assets
+                        imageFiles.add(outputFile);
+                    }
+                }

-                    String mdFileName = outputFile.getName().replace(".html", ".md");
-                    File mdFile = new File(tempOutputDir.getPath().toFile(), mdFileName);
-                    Files.writeString(mdFile.toPath(), markdown);
-                    markdownFiles.add(mdFile);
-                } else if (!outputFile.getName().endsWith(".md")) {
-                    // Collect non-HTML, non-MD files as images/assets
-                    imageFiles.add(outputFile);
+                try (OutputStream fos = Files.newOutputStream(finalOut.getPath());
+                        ZipOutputStream zipOutputStream = new ZipOutputStream(fos)) {
+                    // Add markdown files to root of ZIP
+                    for (File mdFile : markdownFiles) {
+                        ZipEntry mdEntry = new ZipEntry(mdFile.getName());
+                        zipOutputStream.putNextEntry(mdEntry);
+                        Files.copy(mdFile.toPath(), zipOutputStream);
+                        zipOutputStream.closeEntry();
+                    }
+
+                    // Add images and other assets to images/ folder
+                    for (File imageFile : imageFiles) {
+                        ZipEntry assetEntry = new ZipEntry("images/" + imageFile.getName());
+                        zipOutputStream.putNextEntry(assetEntry);
+                        Files.copy(imageFile.toPath(), zipOutputStream);
+                        zipOutputStream.closeEntry();
+                    }
                }
            }
-
-            // Always create a ZIP file
-            fileName = pdfBaseName + "ToMarkdown.zip";
-            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
-
-            try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
-                // Add markdown files to root of ZIP
-                for (File mdFile : markdownFiles) {
-                    ZipEntry mdEntry = new ZipEntry(mdFile.getName());
-                    zipOutputStream.putNextEntry(mdEntry);
-                    Files.copy(mdFile.toPath(), zipOutputStream);
-                    zipOutputStream.closeEntry();
-                }
-
-                // Add images and other assets to images/ folder
-                for (File imageFile : imageFiles) {
-                    ZipEntry assetEntry = new ZipEntry("images/" + imageFile.getName());
-                    zipOutputStream.putNextEntry(assetEntry);
-                    Files.copy(imageFile.toPath(), zipOutputStream);
-                    zipOutputStream.closeEntry();
-                }
-            }
-
-            fileBytes = byteArrayOutputStream.toByteArray();
+        } catch (Exception e) {
+            finalOut.close();
+            throw e;
        }
-        return WebResponseUtils.bytesToWebResponse(
-                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.fileToWebResponse(
+                finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

    /**
@@ -169,7 +169,7 @@ public class PDFToFile {
        return PATTERN.matcher(markdown).replaceAll("$1(images/$2)");
    }

-    public ResponseEntity<byte[]> processPdfToHtml(MultipartFile inputFile)
+    public ResponseEntity<Resource> processPdfToHtml(MultipartFile inputFile)
            throws IOException, InterruptedException {
        if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -182,56 +182,57 @@ public class PDFToFile {
            pdfBaseName = originalPdfFileName.substring(0, originalPdfFileName.lastIndexOf('.'));
        }

-        byte[] fileBytes;
-        String fileName;
+        String fileName = pdfBaseName + "ToHtml.zip";
+        TempFile finalOut = tempFileManager.createManagedTempFile(".zip");
+        try {
+            try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
+                    TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {

-        try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
-                TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {
+                Path tempInputFile = inputFileTemp.getPath();
+                Path tempOutputDir = outputDirTemp.getPath();

-            Path tempInputFile = inputFileTemp.getPath();
-            Path tempOutputDir = outputDirTemp.getPath();
+                // Save the uploaded file to a temporary location
+                inputFile.transferTo(tempInputFile);

-            // Save the uploaded file to a temporary location
-            inputFile.transferTo(tempInputFile);
+                // Run the pdftohtml command with complex output
+                List<String> command =
+                        new ArrayList<>(
+                                Arrays.asList(
+                                        "pdftohtml", "-c", tempInputFile.toString(), pdfBaseName));

-            // Run the pdftohtml command with complex output
-            List<String> command =
-                    new ArrayList<>(
-                            Arrays.asList(
-                                    "pdftohtml", "-c", tempInputFile.toString(), pdfBaseName));
+                ProcessExecutorResult returnCode =
+                        ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
+                                .runCommandWithOutputHandling(command, tempOutputDir.toFile());

-            ProcessExecutorResult returnCode =
-                    ProcessExecutor.getInstance(ProcessExecutor.Processes.PDFTOHTML)
-                            .runCommandWithOutputHandling(command, tempOutputDir.toFile());
+                // Get output files
+                File[] outputFiles = Objects.requireNonNull(tempOutputDir.toFile().listFiles());

-            // Get output files
-            File[] outputFiles = Objects.requireNonNull(tempOutputDir.toFile().listFiles());
-
-            // Return output files in a ZIP archive
-            fileName = pdfBaseName + "ToHtml.zip";
-            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
-            try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
-                for (File outputFile : outputFiles) {
-                    ZipEntry entry = new ZipEntry(outputFile.getName());
-                    zipOutputStream.putNextEntry(entry);
-                    try (FileInputStream fis = new FileInputStream(outputFile)) {
-                        IOUtils.copy(fis, zipOutputStream);
-                    } catch (IOException e) {
-                        log.error("Exception writing zip entry", e);
+                try (OutputStream fos = Files.newOutputStream(finalOut.getPath());
+                        ZipOutputStream zipOutputStream = new ZipOutputStream(fos)) {
+                    for (File outputFile : outputFiles) {
+                        ZipEntry entry = new ZipEntry(outputFile.getName());
+                        zipOutputStream.putNextEntry(entry);
+                        try (FileInputStream fis = new FileInputStream(outputFile)) {
+                            IOUtils.copy(fis, zipOutputStream);
+                        } catch (IOException e) {
+                            log.error("Exception writing zip entry", e);
+                        }
+                        zipOutputStream.closeEntry();
                    }
-                    zipOutputStream.closeEntry();
+                } catch (IOException e) {
+                    log.error("Exception writing zip", e);
                }
-            } catch (IOException e) {
-                log.error("Exception writing zip", e);
            }
-            fileBytes = byteArrayOutputStream.toByteArray();
+        } catch (Exception e) {
+            finalOut.close();
+            throw e;
        }

-        return WebResponseUtils.bytesToWebResponse(
-                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.fileToWebResponse(
+                finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

-    public ResponseEntity<byte[]> processPdfToOfficeFormat(
+    public ResponseEntity<Resource> processPdfToOfficeFormat(
            MultipartFile inputFile, String outputFormat, String libreOfficeFilter)
            throws IOException, InterruptedException {

@@ -257,109 +258,115 @@ public class PDFToFile {
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
        }

-        byte[] fileBytes;
        String fileName;
-
+        TempFile finalOut =
+                tempFileManager.createManagedTempFile("." + resolvePrimaryExtension(outputFormat));
        Path libreOfficeProfile = null;
-        try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
-                TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {
+        try {
+            try (TempFile inputFileTemp = new TempFile(tempFileManager, ".pdf");
+                    TempDirectory outputDirTemp = new TempDirectory(tempFileManager)) {

-            Path tempInputFile = inputFileTemp.getPath();
-            Path tempOutputDir = outputDirTemp.getPath();
-            Path unoOutputFile =
-                    tempOutputDir.resolve(
-                            pdfBaseName + "." + resolvePrimaryExtension(outputFormat));
+                Path tempInputFile = inputFileTemp.getPath();
+                Path tempOutputDir = outputDirTemp.getPath();
+                Path unoOutputFile =
+                        tempOutputDir.resolve(
+                                pdfBaseName + "." + resolvePrimaryExtension(outputFormat));

-            // Save the uploaded file to a temporary location
-            inputFile.transferTo(tempInputFile);
+                // Save the uploaded file to a temporary location
+                inputFile.transferTo(tempInputFile);

-            // Run the LibreOffice command
-            ProcessExecutorResult returnCode = null;
-            IOException unoconvertException = null;
+                // Run the LibreOffice command
+                ProcessExecutorResult returnCode = null;
+                IOException unoconvertException = null;

-            if (isUnoConvertEnabled()) {
-                try {
-                    List<String> unoCommand =
-                            buildUnoConvertCommand(
-                                    tempInputFile, unoOutputFile, outputFormat, libreOfficeFilter);
-                    returnCode =
-                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                    .runCommandWithOutputHandling(unoCommand);
-                } catch (IOException e) {
-                    unoconvertException = e;
-                    log.warn(
-                            "Unoconvert command failed ({}). Falling back to soffice command.",
-                            e.getMessage());
-                }
-            }
-
-            if (returnCode == null) {
-                // Run the LibreOffice command as a fallback
-                libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
-                List<String> command = new ArrayList<>();
-                command.add(runtimePathConfig.getSOfficePath());
-                command.add("-env:UserInstallation=" + libreOfficeProfile.toUri().toString());
-                command.add("--headless");
-                command.add("--nologo");
-                command.add("--infilter=" + libreOfficeFilter);
-                command.add("--convert-to");
-                command.add(outputFormat);
-                command.add("--outdir");
-                command.add(tempOutputDir.toString());
-                command.add(tempInputFile.toString());
-
-                try {
-                    returnCode =
-                            ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
-                                    .runCommandWithOutputHandling(command);
-                } catch (IOException e) {
-                    if (unoconvertException != null) {
-                        e.addSuppressed(unoconvertException);
+                if (isUnoConvertEnabled()) {
+                    try {
+                        List<String> unoCommand =
+                                buildUnoConvertCommand(
+                                        tempInputFile,
+                                        unoOutputFile,
+                                        outputFormat,
+                                        libreOfficeFilter);
+                        returnCode =
+                                ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                        .runCommandWithOutputHandling(unoCommand);
+                    } catch (IOException e) {
+                        unoconvertException = e;
+                        log.warn(
+                                "Unoconvert command failed ({}). Falling back to soffice command.",
+                                e.getMessage());
                    }
-                    throw e;
                }
-            }

-            // Get output files
-            List<File> outputFiles = Arrays.asList(tempOutputDir.toFile().listFiles());
+                if (returnCode == null) {
+                    // Run the LibreOffice command as a fallback
+                    libreOfficeProfile = Files.createTempDirectory("libreoffice_profile_");
+                    List<String> command = new ArrayList<>();
+                    command.add(runtimePathConfig.getSOfficePath());
+                    command.add("-env:UserInstallation=" + libreOfficeProfile.toUri().toString());
+                    command.add("--headless");
+                    command.add("--nologo");
+                    command.add("--infilter=" + libreOfficeFilter);
+                    command.add("--convert-to");
+                    command.add(outputFormat);
+                    command.add("--outdir");
+                    command.add(tempOutputDir.toString());
+                    command.add(tempInputFile.toString());

-            if (outputFiles.size() == 1) {
-                // Return single output file
-                File outputFile = outputFiles.get(0);
-                if ("txt:Text".equals(outputFormat)) {
-                    outputFormat = "txt";
-                }
-                fileName = pdfBaseName + "." + outputFormat;
-                fileBytes = FileUtils.readFileToByteArray(outputFile);
-            } else {
-                // Return output files in a ZIP archive
-                fileName = pdfBaseName + "To" + outputFormat + ".zip";
-                ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
-                try (ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream)) {
-                    for (File outputFile : outputFiles) {
-                        ZipEntry entry = new ZipEntry(outputFile.getName());
-                        zipOutputStream.putNextEntry(entry);
-                        try (FileInputStream fis = new FileInputStream(outputFile)) {
-                            IOUtils.copy(fis, zipOutputStream);
-                        } catch (IOException e) {
-                            log.error("Exception writing zip entry", e);
+                    try {
+                        returnCode =
+                                ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
+                                        .runCommandWithOutputHandling(command);
+                    } catch (IOException e) {
+                        if (unoconvertException != null) {
+                            e.addSuppressed(unoconvertException);
                        }
-
-                        zipOutputStream.closeEntry();
+                        throw e;
                    }
-                } catch (IOException e) {
-                    log.error("Exception writing zip", e);
                }

-                fileBytes = byteArrayOutputStream.toByteArray();
+                // Get output files
+                List<File> outputFiles = Arrays.asList(tempOutputDir.toFile().listFiles());
+
+                if (outputFiles.size() == 1) {
+                    // Return single output file
+                    File outputFile = outputFiles.get(0);
+                    if ("txt:Text".equals(outputFormat)) {
+                        outputFormat = "txt";
+                    }
+                    fileName = pdfBaseName + "." + outputFormat;
+                    FileUtils.copyFile(outputFile, finalOut.getFile());
+                } else {
+                    // Return output files in a ZIP archive
+                    fileName = pdfBaseName + "To" + outputFormat + ".zip";
+                    try (OutputStream fos = Files.newOutputStream(finalOut.getPath());
+                            ZipOutputStream zipOutputStream = new ZipOutputStream(fos)) {
+                        for (File outputFile : outputFiles) {
+                            ZipEntry entry = new ZipEntry(outputFile.getName());
+                            zipOutputStream.putNextEntry(entry);
+                            try (FileInputStream fis = new FileInputStream(outputFile)) {
+                                IOUtils.copy(fis, zipOutputStream);
+                            } catch (IOException e) {
+                                log.error("Exception writing zip entry", e);
+                            }
+
+                            zipOutputStream.closeEntry();
+                        }
+                    } catch (IOException e) {
+                        log.error("Exception writing zip", e);
+                    }
+                }
            }
+        } catch (Exception e) {
+            finalOut.close();
+            throw e;
        } finally {
            if (libreOfficeProfile != null) {
                FileUtils.deleteQuietly(libreOfficeProfile.toFile());
            }
        }
-        return WebResponseUtils.bytesToWebResponse(
-                fileBytes, fileName, MediaType.APPLICATION_OCTET_STREAM);
+        return WebResponseUtils.fileToWebResponse(
+                finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
    }

    private boolean isUnoConvertEnabled() {
@@ -282,8 +282,9 @@ public class ProcessExecutor {
            boolean finished = process.waitFor(timeoutDuration, TimeUnit.MINUTES);

            if (!finished) {
-                // Terminate the process
-                process.destroy();
+                // Kill the entire process tree (descendants first, then the process itself)
+                process.descendants().forEach(ProcessHandle::destroyForcibly);
+                process.destroyForcibly();
                // Interrupt the reader threads
                errorReaderThread.interrupt();
                outputReaderThread.interrupt();
@@ -538,9 +538,9 @@ public final class RegexPatternUtils {
        getPattern("[^a-zA-Z0-9 ]"); // Input sanitization
        getPattern("[^a-zA-Z0-9]"); // Filename sanitization
        // API doc patterns
-        getPattern("Output:(\\w+)"); // precompiled single-escaped for runtime regex \w
-        getPattern("Input:(\\w+)");
-        getPattern("Type:(\\w+)");
+        getPattern("Output:\\s*(\\w+)");
+        getPattern("Input:\\s*(\\w+)");
+        getPattern("Type:\\s*(\\w+)");
        log.debug("Pre-compiled {} common regex patterns", patternCache.size());
    }

@@ -552,19 +552,19 @@ public final class RegexPatternUtils {

    /* Pattern for matching Output:<TYPE> in API descriptions */
    public Pattern getApiDocOutputTypePattern() {
-        return getPattern("Output:(\\w+)");
+        return getPattern("Output:\\s*(\\w+)");
    }

    /* Pattern for matching Input:<TYPE> in API descriptions */
    public Pattern getApiDocInputTypePattern() {
-        return getPattern("Input:(\\w+)");
+        return getPattern("Input:\\s*(\\w+)");
    }

    /**
     * Pattern for matching Type:<CODE> in API descriptions
     */
    public Pattern getApiDocTypePattern() {
-        return getPattern("Type:(\\w+)");
+        return getPattern("Type:\\s*(\\w+)");
    }

    /* Pattern for validating file extensions (2-4 alphanumeric, case-insensitive) */
@@ -182,7 +182,9 @@ public class RequestUriUtils {
                        "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
                || trimmedUri.startsWith("/v1/api-docs")
                // Workflow participant endpoints — access controlled by share tokens, not login
-                || trimmedUri.startsWith("/api/v1/workflow/participant/");
+                || trimmedUri.startsWith("/api/v1/workflow/participant/")
+                // Share-link SPA bootstrap; data APIs remain protected
+                || trimmedUri.matches("^/share/[^/]+/?$");
    }

    private static String stripContextPath(String contextPath, String requestURI) {
@@ -1,19 +1,22 @@
 package stirling.software.common.util;

 import java.io.ByteArrayOutputStream;
+import java.io.FilterInputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;

 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.github.pixee.security.Filenames;

@@ -49,12 +52,7 @@ public class WebResponseUtils {
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(mediaType);
        headers.setContentLength(bytes.length);
-        String encodedDocName =
-                RegexPatternUtils.getInstance()
-                        .getPlusSignPattern()
-                        .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
-                        .replaceAll("%20");
-        headers.setContentDispositionFormData("attachment", encodedDocName);
+        headers.setContentDispositionFormData("attachment", encodeAttachmentName(docName));
        return new ResponseEntity<>(bytes, headers, HttpStatus.OK);
    }

@@ -74,57 +72,202 @@ public class WebResponseUtils {
    }

    /**
-     * Convert a File to a web response (PDF default).
+     * Save a {@link PDDocument} to a managed temp file and return it as a file-backed {@code
+     * ResponseEntity<Resource>}.
+     *
+     * <p>The returned {@link Resource} owns the supplied {@link TempFile} — the file is deleted
+     * when Spring closes the response {@link InputStream} after writing the body. This is a
+     * synchronous equivalent of the previous {@code StreamingResponseBody} pattern and avoids the
+     * async-dispatch hazards (response-committed races, filter incompatibility, silent write
+     * failures) that {@code StreamingResponseBody} introduced.
+     */
+    public static ResponseEntity<Resource> pdfDocToWebResponse(
+            PDDocument document, String docName, TempFileManager tempFileManager)
+            throws IOException {
+        TempFile tempFile = tempFileManager.createManagedTempFile(".pdf");
+        try {
+            document.save(tempFile.getFile());
+        } catch (IOException e) {
+            tempFile.close();
+            throw e;
+        }
+        return pdfFileToWebResponse(tempFile, docName);
+    }
+
+    /**
+     * Convert a {@link TempFile} holding a PDF into a web response.
+     *
+     * <p>The temp file is deleted when Spring closes the response body stream.
     *
     * @param outputTempFile The temporary file to be sent as a response.
     * @param docName The name of the document.
-     * @return A ResponseEntity containing the file as a resource.
+     * @return A ResponseEntity whose body streams the file, deleting it on close.
     */
-    public static ResponseEntity<StreamingResponseBody> pdfFileToWebResponse(
+    public static ResponseEntity<Resource> pdfFileToWebResponse(
            TempFile outputTempFile, String docName) throws IOException {
        return fileToWebResponse(outputTempFile, docName, MediaType.APPLICATION_PDF);
    }

    /**
-     * Convert a File to a web response (ZIP default).
+     * Convert a {@link TempFile} holding a ZIP archive into a web response.
+     *
+     * <p>The temp file is deleted when Spring closes the response body stream.
     *
     * @param outputTempFile The temporary file to be sent as a response.
     * @param docName The name of the document.
-     * @return A ResponseEntity containing the file as a resource.
+     * @return A ResponseEntity whose body streams the file, deleting it on close.
     */
-    public static ResponseEntity<StreamingResponseBody> zipFileToWebResponse(
+    public static ResponseEntity<Resource> zipFileToWebResponse(
            TempFile outputTempFile, String docName) throws IOException {
        return fileToWebResponse(outputTempFile, docName, MediaType.APPLICATION_OCTET_STREAM);
    }

    /**
-     * Convert a File to a web response with explicit media type (e.g., ZIP).
+     * Convert a {@link TempFile} into a web response with an explicit media type.
+     *
+     * <p>The returned {@link ResponseEntity} carries a {@link ManagedTempFileResource} as its body.
+     * Spring's {@code ResourceHttpMessageConverter} calls {@link Resource#getInputStream()} once
+     * and closes the returned stream after writing — at which point the underlying {@link TempFile}
+     * is deleted. Everything runs synchronously on the request thread, so write failures propagate
+     * through normal Spring error handling and are logged, rather than silently truncating the
+     * response.
     *
     * @param outputTempFile The temporary file to be sent as a response.
     * @param docName The name of the document.
     * @param mediaType The content type to set on the response.
-     * @return A ResponseEntity containing the file as a resource.
+     * @return A ResponseEntity whose body streams the file, deleting it on close.
     */
-    public static ResponseEntity<StreamingResponseBody> fileToWebResponse(
+    public static ResponseEntity<Resource> fileToWebResponse(
            TempFile outputTempFile, String docName, MediaType mediaType) throws IOException {

-        Path path = outputTempFile.getFile().toPath().normalize();
-        long len = Files.size(path);
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(mediaType);
-        headers.setContentLength(len);
-        headers.add(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + docName + "\"");
+        try {
+            Path path = outputTempFile.getFile().toPath().normalize();
+            long len = Files.size(path);
+            HttpHeaders headers = new HttpHeaders();
+            headers.setContentType(mediaType);
+            headers.setContentLength(len);
+            headers.setContentDispositionFormData("attachment", encodeAttachmentName(docName));

-        StreamingResponseBody body =
-                os -> {
-                    try (os) {
-                        Files.copy(path, os);
-                        os.flush();
-                    } finally {
-                        outputTempFile.close();
-                    }
-                };
+            Resource body = new ManagedTempFileResource(outputTempFile);
+            return new ResponseEntity<>(body, headers, HttpStatus.OK);
+        } catch (IOException | RuntimeException e) {
+            try {
+                outputTempFile.close();
+            } catch (Exception closeEx) {
+                e.addSuppressed(closeEx);
+            }
+            throw e;
+        }
+    }

-        return new ResponseEntity<>(body, headers, HttpStatus.OK);
+    private static String encodeAttachmentName(String docName) {
+        return RegexPatternUtils.getInstance()
+                .getPlusSignPattern()
+                .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
+                .replaceAll("%20");
+    }
+
+    /**
+     * {@link Resource} backed by a {@link TempFile}. The underlying temp file is deleted when the
+     * response {@code InputStream} is closed — i.e. after Spring has finished writing the body. Any
+     * {@link IOException} during the copy is logged via {@link ClosingInputStream} and propagates
+     * through Spring's normal error path. Since response headers are committed before the body
+     * transfer begins, a mid-body failure manifests as a server-side log entry plus an aborted
+     * connection rather than a silently-truncated success — which is the behaviour this class was
+     * added to restore.
+     *
+     * <p><b>Single-use contract:</b> {@link #getInputStream()} is intended to be called once by
+     * Spring's {@code ResourceHttpMessageConverter} on the normal write path. After the returned
+     * stream is closed the backing temp file is deleted, so subsequent {@code getInputStream()}
+     * calls will either see a deleted file (tests that mock {@link TempFile#close()} are an
+     * exception) or fail at read time. Callers that need to re-read the body must copy it first.
+     */
+    public static final class ManagedTempFileResource extends FileSystemResource {
+
+        private final TempFile tempFile;
+
+        public ManagedTempFileResource(TempFile tempFile) {
+            super(tempFile.getFile());
+            this.tempFile = tempFile;
+        }
+
+        @Override
+        public InputStream getInputStream() throws IOException {
+            InputStream source;
+            try {
+                source = super.getInputStream();
+            } catch (IOException e) {
+                // Opening the input stream already failed; make sure we don't leak the temp file.
+                try {
+                    tempFile.close();
+                } catch (Exception closeEx) {
+                    e.addSuppressed(closeEx);
+                }
+                throw e;
+            }
+            return new ClosingInputStream(source, tempFile);
+        }
+    }
+
+    /**
+     * Stream wrapper that deletes its backing {@link TempFile} on close. Logs — but does not
+     * swallow — any IOException that happens while reading the body, so upstream handlers can
+     * surface the failure to the client.
+     */
+    private static final class ClosingInputStream extends FilterInputStream {
+
+        private final TempFile tempFile;
+        private boolean closed;
+
+        ClosingInputStream(InputStream delegate, TempFile tempFile) {
+            super(delegate);
+            this.tempFile = tempFile;
+        }
+
+        @Override
+        public int read() throws IOException {
+            try {
+                return super.read();
+            } catch (IOException e) {
+                log.error(
+                        "Failed to read temp response body {} while streaming to client",
+                        tempFile.getAbsolutePath(),
+                        e);
+                throw e;
+            }
+        }
+
+        @Override
+        public int read(byte[] b, int off, int len) throws IOException {
+            try {
+                return super.read(b, off, len);
+            } catch (IOException e) {
+                log.error(
+                        "Failed to read temp response body {} while streaming to client",
+                        tempFile.getAbsolutePath(),
+                        e);
+                throw e;
+            }
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (closed) {
+                return;
+            }
+            closed = true;
+            try {
+                super.close();
+            } finally {
+                try {
+                    tempFile.close();
+                } catch (Exception closeEx) {
+                    log.warn(
+                            "Failed to clean up temp file {} after streaming response",
+                            tempFile.getAbsolutePath(),
+                            closeEx);
+                }
+            }
+        }
    }
 }
@@ -0,0 +1,142 @@
+package stirling.software.common.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Consumer;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+
+import io.github.pixee.security.ZipSecurity;
+
+import lombok.experimental.UtilityClass;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Helpers for detecting and extracting ZIP-formatted responses returned from Stirling API
+ * endpoints. Shared between {@code PipelineProcessor} and {@code AiWorkflowService} so both callers
+ * unpack ZIPs consistently (hardened against zip-slip, depth-limited, backed by managed temp
+ * files).
+ */
+@Slf4j
+@UtilityClass
+public class ZipExtractionUtils {
+
+    private static final int MAX_UNZIP_DEPTH = 10;
+    private static final byte[] ZIP_MAGIC = {0x50, 0x4B, 0x03, 0x04};
+
+    /**
+     * Returns true if the resource starts with the standard ZIP magic bytes. CBZ files are
+     * explicitly treated as non-ZIP.
+     */
+    public static boolean isZip(Resource data) throws IOException {
+        return isZip(data, null);
+    }
+
+    /**
+     * Returns true if the resource starts with the standard ZIP magic bytes. Files named with the
+     * {@code .cbz} extension are excluded (handled separately by the comic viewer).
+     */
+    public static boolean isZip(Resource data, String filename) throws IOException {
+        if (data == null || data.contentLength() < ZIP_MAGIC.length) {
+            return false;
+        }
+        if (filename != null && filename.toLowerCase().endsWith(".cbz")) {
+            return false;
+        }
+        try (InputStream is = data.getInputStream()) {
+            byte[] header = new byte[ZIP_MAGIC.length];
+            if (is.read(header) < ZIP_MAGIC.length) {
+                return false;
+            }
+            for (int i = 0; i < ZIP_MAGIC.length; i++) {
+                if (header[i] != ZIP_MAGIC[i]) {
+                    return false;
+                }
+            }
+            return true;
+        }
+    }
+
+    /**
+     * Extract a ZIP resource into a flat list of resources, one per file entry. Nested ZIPs are
+     * recursively extracted up to {@link #MAX_UNZIP_DEPTH}. Each entry is materialized as a
+     * hardened-extracted managed temp file so downstream consumers can stream the bytes.
+     */
+    public static List<Resource> extractZip(Resource zip, TempFileManager tempFileManager)
+            throws IOException {
+        return extractZip(zip, tempFileManager, null);
+    }
+
+    /**
+     * Extract a ZIP resource into a flat list of resources. Each created {@link TempFile} is also
+     * passed to {@code tempFileConsumer} when non-null, giving callers the option to register the
+     * temp files with an auxiliary lifecycle (e.g. {@code PipelineResult}).
+     */
+    public static List<Resource> extractZip(
+            Resource zip, TempFileManager tempFileManager, Consumer<TempFile> tempFileConsumer)
+            throws IOException {
+        return extractZipInternal(zip, tempFileManager, tempFileConsumer, 0);
+    }
+
+    private static List<Resource> extractZipInternal(
+            Resource zip,
+            TempFileManager tempFileManager,
+            Consumer<TempFile> tempFileConsumer,
+            int depth)
+            throws IOException {
+        if (depth > MAX_UNZIP_DEPTH) {
+            log.warn(
+                    "ZIP nesting depth {} exceeds limit {}, treating as file",
+                    depth,
+                    MAX_UNZIP_DEPTH);
+            return List.of(zip);
+        }
+        log.debug("Unzipping data of length: {}", zip.contentLength());
+        List<Resource> extracted = new ArrayList<>();
+        try (InputStream bais = zip.getInputStream();
+                ZipInputStream zis = ZipSecurity.createHardenedInputStream(bais)) {
+            ZipEntry entry;
+            while ((entry = zis.getNextEntry()) != null) {
+                if (entry.isDirectory()) {
+                    continue;
+                }
+                TempFile tempFile = tempFileManager.createManagedTempFile("unzip");
+                if (tempFileConsumer != null) {
+                    tempFileConsumer.accept(tempFile);
+                }
+                try (OutputStream os = Files.newOutputStream(tempFile.getPath())) {
+                    byte[] buffer = new byte[4096];
+                    int count;
+                    while ((count = zis.read(buffer)) != -1) {
+                        os.write(buffer, 0, count);
+                    }
+                }
+                final String filename = entry.getName();
+                Resource fileResource =
+                        new FileSystemResource(tempFile.getFile()) {
+                            @Override
+                            public String getFilename() {
+                                return filename;
+                            }
+                        };
+                if (isZip(fileResource, filename)) {
+                    log.debug("Nested ZIP entry {} — recursing", filename);
+                    extracted.addAll(
+                            extractZipInternal(
+                                    fileResource, tempFileManager, tempFileConsumer, depth + 1));
+                } else {
+                    extracted.add(fileResource);
+                }
+            }
+        }
+        log.debug("Unzipping completed. {} files extracted.", extracted.size());
+        return extracted;
+    }
+}
@@ -4,8 +4,11 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;

 import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.stream.Stream;

 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -13,6 +16,8 @@ import org.junit.jupiter.api.io.TempDir;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.multipart.MultipartFile;
@@ -185,4 +190,76 @@ class FileStorageTest {
        // Assert
        assertFalse(result);
    }
+
+    @Test
+    void storeFromResource_happyPath_persistsContent() throws IOException {
+        // Arrange
+        byte[] payload = "resource-body-bytes".getBytes(StandardCharsets.UTF_8);
+        Resource resource = new ByteArrayResource(payload);
+
+        // Act
+        String fileId = fileStorage.storeFromResource(resource, "whatever.pdf");
+
+        // Assert
+        assertNotNull(fileId);
+        assertTrue(Files.exists(tempDir.resolve(fileId)));
+        assertArrayEquals(payload, fileStorage.retrieveBytes(fileId));
+    }
+
+    @Test
+    void storeFromResource_failureCleansUpPartialFile() throws IOException {
+        // Arrange: a Resource whose getInputStream returns a stream that throws after
+        // emitting a few bytes. The finally block in storeFromResource should remove
+        // the partial file on disk.
+        byte[] head = "partial".getBytes(StandardCharsets.UTF_8);
+        Resource flakyResource =
+                new ByteArrayResource(head) {
+                    @Override
+                    public InputStream getInputStream() {
+                        return new InputStream() {
+                            private int position = 0;
+
+                            @Override
+                            public int read() throws IOException {
+                                if (position < head.length) {
+                                    return head[position++] & 0xFF;
+                                }
+                                throw new IOException("simulated mid-copy read failure");
+                            }
+
+                            @Override
+                            public int read(byte[] b, int off, int len) throws IOException {
+                                if (position >= head.length) {
+                                    throw new IOException("simulated mid-copy read failure");
+                                }
+                                int toCopy = Math.min(len, head.length - position);
+                                System.arraycopy(head, position, b, off, toCopy);
+                                position += toCopy;
+                                return toCopy;
+                            }
+                        };
+                    }
+                };
+
+        // Snapshot dir contents before the call so we can detect any lingering file.
+        long filesBefore;
+        try (Stream<Path> s = Files.list(tempDir)) {
+            filesBefore = s.count();
+        }
+
+        // Act + Assert: IOException must propagate out — not be swallowed.
+        assertThrows(
+                IOException.class, () -> fileStorage.storeFromResource(flakyResource, "n.pdf"));
+
+        // Assert: no partial file lingers under the storage directory — the finally
+        // branch's deleteIfExists must have cleaned it up.
+        long filesAfter;
+        try (Stream<Path> s = Files.list(tempDir)) {
+            filesAfter = s.count();
+        }
+        assertEquals(
+                filesBefore,
+                filesAfter,
+                "partial file must be cleaned up by storeFromResource finally block");
+    }
 }
@@ -0,0 +1,159 @@
+package stirling.software.common.service;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.*;
+import org.springframework.http.client.ClientHttpResponse;
+import org.springframework.mock.env.MockEnvironment;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RequestCallback;
+import org.springframework.web.client.ResponseExtractor;
+import org.springframework.web.client.RestTemplate;
+
+import jakarta.servlet.ServletContext;
+
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+
+@ExtendWith(MockitoExtension.class)
+class InternalApiClientTest {
+
+    @Mock ServletContext servletContext;
+    @Mock UserServiceInterface userService;
+    @Mock TempFileManager tempFileManager;
+
+    InternalApiClient client;
+
+    @BeforeEach
+    void setUp() {
+        lenient().when(servletContext.getContextPath()).thenReturn("");
+        MockEnvironment environment = new MockEnvironment().withProperty("server.port", "8080");
+        client = new InternalApiClient(servletContext, userService, tempFileManager, environment);
+    }
+
+    @Test
+    void postDoesNotForceContentType() throws Exception {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        body.add("fileInput", namedResource("input.pdf", "data"));
+
+        Path tempPath = Files.createTempFile("internal-api-test", ".tmp");
+        TempFile tempFile = mock(TempFile.class);
+        when(tempFile.getPath()).thenReturn(tempPath);
+        when(tempFile.getFile()).thenReturn(tempPath.toFile());
+        when(tempFileManager.createManagedTempFile("internal-api")).thenReturn(tempFile);
+
+        HttpHeaders[] captured = {null};
+
+        try (var ignored =
+                mockConstruction(
+                        RestTemplate.class,
+                        (rt, ctx) -> {
+                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
+                                    .thenAnswer(
+                                            inv -> {
+                                                HttpEntity<?> entity = inv.getArgument(0);
+                                                captured[0] = entity.getHeaders();
+                                                return (RequestCallback) req -> {};
+                                            });
+
+                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
+                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
+                        })) {
+
+            ResponseEntity<Resource> response = client.post("/api/v1/general/merge-pdfs", body);
+
+            assertNotNull(response);
+            assertEquals(HttpStatus.OK, response.getStatusCode());
+            assertNotNull(response.getBody());
+            assertNull(captured[0].getContentType(), "Content-Type should not be forced");
+        } finally {
+            Files.deleteIfExists(tempPath);
+        }
+    }
+
+    @Test
+    void postRejectsDisallowedPath() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(SecurityException.class, () -> client.post("/api/v1/admin/settings", body));
+    }
+
+    @Test
+    void postRejectsPathTraversal() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(
+                SecurityException.class,
+                () -> client.post("/api/v1/misc/../../actuator/env", body));
+    }
+
+    @Test
+    void postRejectsUrlEncodedCharacters() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(
+                SecurityException.class, () -> client.post("/api/v1/misc/%2e%2e/actuator", body));
+    }
+
+    @Test
+    void postRejectsQueryString() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(
+                SecurityException.class,
+                () -> client.post("/api/v1/misc/compress-pdf?redirect=evil", body));
+    }
+
+    @Test
+    void postRejectsEmptySegment() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(SecurityException.class, () -> client.post("/api/v1/misc//foo", body));
+    }
+
+    @Test
+    void postRejectsTrailingSlash() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(SecurityException.class, () -> client.post("/api/v1/misc/foo/", body));
+    }
+
+    @Test
+    void postRejectsNullPath() {
+        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
+        assertThrows(SecurityException.class, () -> client.post(null, body));
+    }
+
+    /** Create a ByteArrayResource with a filename (required for multipart). */
+    private static Resource namedResource(String filename, String content) {
+        return new ByteArrayResource(content.getBytes(StandardCharsets.UTF_8)) {
+            @Override
+            public String getFilename() {
+                return filename;
+            }
+        };
+    }
+
+    /** Simulate a successful HTTP response through a RestTemplate ResponseExtractor. */
+    @SuppressWarnings("unchecked")
+    private static ResponseEntity<Resource> fakeOkResponse(Object extractorArg) throws Exception {
+        var extractor = (ResponseExtractor<ResponseEntity<Resource>>) extractorArg;
+        ClientHttpResponse response = mock(ClientHttpResponse.class);
+        when(response.getBody())
+                .thenReturn(new ByteArrayInputStream("ok".getBytes(StandardCharsets.UTF_8)));
+        HttpHeaders headers = new HttpHeaders();
+        headers.add(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"out.pdf\"");
+        when(response.getHeaders()).thenReturn(headers);
+        lenient().when(response.getStatusCode()).thenReturn(HttpStatus.OK);
+        return extractor.extractData(response);
+    }
+}
@@ -8,9 +8,11 @@ import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;

+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeoutException;
@@ -24,7 +26,12 @@ import org.mockito.Captor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.ContentDisposition;
+import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;

 import jakarta.servlet.http.HttpServletRequest;
@@ -180,6 +187,46 @@ class JobExecutorServiceTest {
        verify(spy).runJobGeneric(eq(false), any(Supplier.class), eq(customTimeout));
    }

+    @Test
+    void shouldPersistResponseEntityResourceBodyViaFileStorage() throws Exception {
+        // Given: an async job whose result is a ResponseEntity<Resource> — the new
+        // branch added by the stream-to-Resource migration. The executor must route
+        // the body through FileStorage.storeFromResource and then record the result
+        // via TaskManager.setFileResult with the filename/content-type extracted
+        // from the response headers.
+        byte[] payload = "resource-bytes".getBytes(StandardCharsets.UTF_8);
+        Resource resource = new ByteArrayResource(payload);
+
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_PDF);
+        headers.setContentDisposition(
+                ContentDisposition.formData().name("attachment").filename("result.pdf").build());
+
+        Supplier<Object> work = () -> new ResponseEntity<>(resource, headers, HttpStatus.OK);
+
+        when(fileStorage.storeFromResource(any(Resource.class), anyString()))
+                .thenReturn("stored-file-id");
+
+        // When: run the job asynchronously — processJobResult runs on the executor.
+        ResponseEntity<?> response = jobExecutorService.runJobGeneric(true, work);
+
+        // Then: the immediate return must be the JobResponse envelope.
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertInstanceOf(JobResponse.class, response.getBody());
+
+        // Wait for async processing and verify the Resource branch was taken —
+        // FileStorage.storeFromResource was invoked with the same Resource instance,
+        // and TaskManager.setFileResult recorded the extracted filename + content-type.
+        verify(fileStorage, timeout(5000)).storeFromResource(eq(resource), eq("result.pdf"));
+        verify(taskManager, timeout(5000))
+                .setFileResult(
+                        anyString(),
+                        eq("stored-file-id"),
+                        eq("result.pdf"),
+                        eq(MediaType.APPLICATION_PDF_VALUE));
+        verify(taskManager, timeout(5000)).setComplete(anyString());
+    }
+
    @Test
    void shouldHandleTimeout() throws Exception {
        // Given
@@ -3,6 +3,7 @@ package stirling.software.common.util;
 import static org.junit.jupiter.api.Assertions.*;

 import java.io.IOException;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -249,6 +250,60 @@ class FormUtilsAdditionalTest {
        }
    }

+    // Regression: PDFBOX-5962. Flattening with an empty values map used to force
+    // setNeedAppearances(true), triggering PDFBox's refreshAppearances loop which
+    // could hang indefinitely. The call must complete quickly and clear form fields.
+    @Test
+    void testApplyFieldValues_emptyValuesWithFlatten_completesAndFlattens() throws IOException {
+        try (PDDocument doc = new PDDocument()) {
+            SetupDocument setup = createBasicDocument(doc);
+            PDTextField textField = new PDTextField(setup.acroForm);
+            textField.setPartialName("company");
+            attachWidget(setup, textField, new PDRectangle(60, 720, 220, 20));
+
+            assertTrue(setup.acroForm.getNeedAppearances());
+
+            assertTimeoutPreemptively(
+                    Duration.ofSeconds(10),
+                    () -> FormUtils.applyFieldValues(doc, Map.of(), true, false));
+
+            PDAcroForm after = doc.getDocumentCatalog().getAcroForm();
+            assertTrue(after == null || after.getFields().isEmpty());
+        }
+    }
+
+    @Test
+    void testApplyFieldValues_nullValuesWithFlatten_completesAndFlattens() throws IOException {
+        try (PDDocument doc = new PDDocument()) {
+            SetupDocument setup = createBasicDocument(doc);
+            PDTextField textField = new PDTextField(setup.acroForm);
+            textField.setPartialName("company");
+            attachWidget(setup, textField, new PDRectangle(60, 720, 220, 20));
+
+            assertTimeoutPreemptively(
+                    Duration.ofSeconds(10),
+                    () -> FormUtils.applyFieldValues(doc, null, true, false));
+
+            PDAcroForm after = doc.getDocumentCatalog().getAcroForm();
+            assertTrue(after == null || after.getFields().isEmpty());
+        }
+    }
+
+    @Test
+    void testApplyFieldValues_valuesWithFlatten_appliesValueAndFlattens() throws IOException {
+        try (PDDocument doc = new PDDocument()) {
+            SetupDocument setup = createBasicDocument(doc);
+            PDTextField textField = new PDTextField(setup.acroForm);
+            textField.setPartialName("company");
+            attachWidget(setup, textField, new PDRectangle(60, 720, 220, 20));
+
+            FormUtils.applyFieldValues(doc, Map.of("company", "Stirling"), true, false);
+
+            PDAcroForm after = doc.getDocumentCatalog().getAcroForm();
+            assertTrue(after == null || after.getFields().isEmpty());
+        }
+    }
+
    // --- filterSingleChoiceSelection ---

    @Test
@@ -9,6 +9,7 @@ import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.mockStatic;
 import static org.mockito.Mockito.when;

+import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
@@ -24,6 +25,7 @@ import org.junit.jupiter.api.io.TempDir;
 import org.mockito.Mock;
 import org.mockito.MockedStatic;
 import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -59,6 +61,19 @@ class PDFToFileTest {
                .thenAnswer(
                        invocation ->
                                Files.createTempFile("test", invocation.getArgument(0)).toFile());
+        lenient()
+                .when(mockTempFileManager.createManagedTempFile(anyString()))
+                .thenAnswer(
+                        invocation -> {
+                            File f =
+                                    Files.createTempFile("test", invocation.<String>getArgument(0))
+                                            .toFile();
+                            TempFile tf = org.mockito.Mockito.mock(TempFile.class);
+                            lenient().when(tf.getFile()).thenReturn(f);
+                            lenient().when(tf.getPath()).thenReturn(f.toPath());
+                            lenient().when(tf.getAbsolutePath()).thenReturn(f.getAbsolutePath());
+                            return tf;
+                        });
        lenient()
                .when(mockTempFileManager.createTempDirectory())
                .thenAnswer(invocation -> Files.createTempDirectory("test"));
@@ -68,6 +83,14 @@ class PDFToFileTest {
        pdfToFile = new PDFToFile(mockTempFileManager, mockRuntimePathConfig);
    }

+    private static byte[] drain(ResponseEntity<Resource> response) throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        try (java.io.InputStream __in = response.getBody().getInputStream()) {
+            __in.transferTo(baos);
+        }
+        return baos.toByteArray();
+    }
+
    @Test
    void testProcessPdfToMarkdown_InvalidContentType() throws IOException, InterruptedException {
        // Prepare
@@ -79,7 +102,7 @@ class PDFToFileTest {
                        "This is not a PDF".getBytes());

        // Execute
-        ResponseEntity<byte[]> response = pdfToFile.processPdfToMarkdown(nonPdfFile);
+        ResponseEntity<Resource> response = pdfToFile.processPdfToMarkdown(nonPdfFile);

        // Verify
        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
@@ -96,7 +119,7 @@ class PDFToFileTest {
                        "This is not a PDF".getBytes());

        // Execute
-        ResponseEntity<byte[]> response = pdfToFile.processPdfToHtml(nonPdfFile);
+        ResponseEntity<Resource> response = pdfToFile.processPdfToHtml(nonPdfFile);

        // Verify
        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
@@ -114,7 +137,7 @@ class PDFToFileTest {
                        "This is not a PDF".getBytes());

        // Execute
-        ResponseEntity<byte[]> response =
+        ResponseEntity<Resource> response =
                pdfToFile.processPdfToOfficeFormat(nonPdfFile, "docx", "draw_pdf_import");

        // Verify
@@ -133,7 +156,7 @@ class PDFToFileTest {
                        "Fake PDF content".getBytes());

        // Execute with invalid format
-        ResponseEntity<byte[]> response =
+        ResponseEntity<Resource> response =
                pdfToFile.processPdfToOfficeFormat(pdfFile, "invalid_format", "draw_pdf_import");

        // Verify
@@ -184,12 +207,13 @@ class PDFToFileTest {
                            });

            // Execute the method
-            ResponseEntity<byte[]> response = pdfToFile.processPdfToMarkdown(pdfFile);
+            ResponseEntity<Resource> response = pdfToFile.processPdfToMarkdown(pdfFile);

            // Verify - should now return a ZIP file instead of plain markdown
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition indicates a ZIP file
            assertTrue(
@@ -201,7 +225,7 @@ class PDFToFileTest {
            // Verify the content by unzipping it
            try (ZipInputStream zipStream =
                    ZipSecurity.createHardenedInputStream(
-                            new java.io.ByteArrayInputStream(response.getBody()))) {
+                            new java.io.ByteArrayInputStream(bodyBytes))) {
                ZipEntry entry;
                boolean foundMdFile = false;
                boolean foundImageInFolder = false;
@@ -275,12 +299,13 @@ class PDFToFileTest {
                            });

            // Execute the method
-            ResponseEntity<byte[]> response = pdfToFile.processPdfToMarkdown(pdfFile);
+            ResponseEntity<Resource> response = pdfToFile.processPdfToMarkdown(pdfFile);

            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition indicates a zip file
            assertTrue(
@@ -292,7 +317,7 @@ class PDFToFileTest {
            // Verify the content by unzipping it
            try (ZipInputStream zipStream =
                    ZipSecurity.createHardenedInputStream(
-                            new java.io.ByteArrayInputStream(response.getBody()))) {
+                            new java.io.ByteArrayInputStream(bodyBytes))) {
                ZipEntry entry;
                boolean foundMdFiles = false;
                boolean foundImage = false;
@@ -352,12 +377,13 @@ class PDFToFileTest {
                            });

            // Execute the method
-            ResponseEntity<byte[]> response = pdfToFile.processPdfToHtml(pdfFile);
+            ResponseEntity<Resource> response = pdfToFile.processPdfToHtml(pdfFile);

            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition indicates a zip file
            assertTrue(
@@ -369,7 +395,7 @@ class PDFToFileTest {
            // Verify the content by unzipping it
            try (ZipInputStream zipStream =
                    ZipSecurity.createHardenedInputStream(
-                            new java.io.ByteArrayInputStream(response.getBody()))) {
+                            new java.io.ByteArrayInputStream(bodyBytes))) {
                ZipEntry entry;
                boolean foundMainHtml = false;
                boolean foundIndexHtml = false;
@@ -437,13 +463,14 @@ class PDFToFileTest {
                            });

            // Execute the method with docx format
-            ResponseEntity<byte[]> response =
+            ResponseEntity<Resource> response =
                    pdfToFile.processPdfToOfficeFormat(pdfFile, "docx", "draw_pdf_import");

            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition has correct filename
            assertTrue(
@@ -508,13 +535,14 @@ class PDFToFileTest {
                            });

            // Execute the method with ODP format
-            ResponseEntity<byte[]> response =
+            ResponseEntity<Resource> response =
                    pdfToFile.processPdfToOfficeFormat(pdfFile, "odp", "draw_pdf_import");

            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition for zip file
            assertTrue(
@@ -526,7 +554,7 @@ class PDFToFileTest {
            // Verify the content by unzipping it
            try (ZipInputStream zipStream =
                    ZipSecurity.createHardenedInputStream(
-                            new java.io.ByteArrayInputStream(response.getBody()))) {
+                            new java.io.ByteArrayInputStream(bodyBytes))) {
                ZipEntry entry;
                boolean foundMainFile = false;
                boolean foundMediaFiles = false;
@@ -592,13 +620,14 @@ class PDFToFileTest {
                            });

            // Execute the method with text format
-            ResponseEntity<byte[]> response =
+            ResponseEntity<Resource> response =
                    pdfToFile.processPdfToOfficeFormat(pdfFile, "txt:Text", "draw_pdf_import");

            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition has txt extension
            assertTrue(
@@ -650,13 +679,14 @@ class PDFToFileTest {
                            });

            // Execute the method
-            ResponseEntity<byte[]> response =
+            ResponseEntity<Resource> response =
                    pdfToFile.processPdfToOfficeFormat(pdfFile, "docx", "draw_pdf_import");

            // Verify
            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);

            // Verify content disposition contains output.docx
            assertTrue(
@@ -696,12 +726,13 @@ class PDFToFileTest {
                                return mockExecutorResult;
                            });

-            ResponseEntity<byte[]> response =
+            ResponseEntity<Resource> response =
                    pdfToFileWithUno.processPdfToOfficeFormat(pdfFile, "docx", "writer_pdf_import");

            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);
            assertTrue(
                    response.getHeaders()
                            .getContentDisposition()
@@ -759,12 +790,13 @@ class PDFToFileTest {
                                return mockExecutorResult;
                            });

-            ResponseEntity<byte[]> response =
+            ResponseEntity<Resource> response =
                    pdfToFileWithUno.processPdfToOfficeFormat(pdfFile, "docx", "writer_pdf_import");

            assertEquals(HttpStatus.OK, response.getStatusCode());
-            assertNotNull(response.getBody());
-            assertTrue(response.getBody().length > 0);
+            byte[] bodyBytes = drain(response);
+            assertNotNull(bodyBytes);
+            assertTrue(bodyBytes.length > 0);
            assertTrue(
                    response.getHeaders()
                            .getContentDisposition()
@@ -161,4 +161,46 @@ class RequestUriUtilsTest {
    void testIsPublicAuthEndpoint_withContextPath() {
        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/login", "/app"));
    }
+
+    // --- share-link SPA bootstrap ---
+
+    @Test
+    void testIsPublicAuthEndpoint_shareLinkToken() {
+        assertTrue(
+                RequestUriUtils.isPublicAuthEndpoint(
+                        "/share/00dcac3a-fc7a-4989-9c4f-97745484d62f", ""));
+    }
+
+    @Test
+    void testIsPublicAuthEndpoint_shareLinkTokenTrailingSlash() {
+        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/share/abc123/", ""));
+    }
+
+    @Test
+    void testIsPublicAuthEndpoint_shareLinkWithContextPath() {
+        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/share/abc123", "/app"));
+    }
+
+    @Test
+    void testIsPublicAuthEndpoint_shareRootNotPublic() {
+        // Avoid matching bare "/share" or "/share/" — must have a token segment
+        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/share", ""));
+        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/share/", ""));
+    }
+
+    @Test
+    void testIsPublicAuthEndpoint_shareNestedPathNotPublic() {
+        // Guard against future additions like /share/<token>/download becoming accidentally public
+        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/share/abc123/download", ""));
+        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/share/abc/admin", ""));
+    }
+
+    @Test
+    void testIsPublicAuthEndpoint_shareApiStillProtected() {
+        // Share-link data APIs must NOT be public — they enforce auth + access checks
+        assertFalse(RequestUriUtils.isPublicAuthEndpoint("/api/v1/storage/share-links/abc123", ""));
+        assertFalse(
+                RequestUriUtils.isPublicAuthEndpoint(
+                        "/api/v1/storage/share-links/abc123/metadata", ""));
+    }
 }
@@ -3,17 +3,39 @@ package stirling.software.common.util;
 import static org.junit.jupiter.api.Assertions.*;

 import java.io.ByteArrayOutputStream;
+import java.io.File;
 import java.io.IOException;
+import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.concurrent.atomic.AtomicBoolean;

+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;

+import stirling.software.common.model.ApplicationProperties;
+
 class WebResponseUtilsTest {

+    @TempDir Path tempDir;
+
+    private TempFileManager tempFileManager;
+
+    @BeforeEach
+    void setUpTempFileManager() {
+        TempFileRegistry registry = new TempFileRegistry();
+        ApplicationProperties applicationProperties = new ApplicationProperties();
+        applicationProperties.getSystem().getTempFileManagement().setBaseTmpDir(tempDir.toString());
+        applicationProperties.getSystem().getTempFileManagement().setPrefix("wru-test-");
+        tempFileManager = new TempFileManager(registry, applicationProperties);
+    }
+
    @Test
    void testBytesToWebResponse_defaultMediaType() throws IOException {
        byte[] data = "test content".getBytes(StandardCharsets.UTF_8);
@@ -91,4 +113,87 @@ class WebResponseUtilsTest {
        assertEquals(HttpStatus.OK, response.getStatusCode());
        assertEquals(0, response.getHeaders().getContentLength());
    }
+
+    @Test
+    void managedTempFileResource_happyPathDeletesBackingFile() throws IOException {
+        // Create a real managed temp file on disk and populate it.
+        TempFile tempFile = tempFileManager.createManagedTempFile(".pdf");
+        byte[] payload = "fully-readable-pdf-body".getBytes(StandardCharsets.UTF_8);
+        Files.write(tempFile.getPath(), payload);
+        File backing = tempFile.getFile();
+        assertTrue(backing.exists(), "precondition: backing file should exist");
+
+        WebResponseUtils.ManagedTempFileResource resource =
+                new WebResponseUtils.ManagedTempFileResource(tempFile);
+
+        byte[] readBack;
+        try (InputStream in = resource.getInputStream()) {
+            readBack = in.readAllBytes();
+        }
+
+        assertArrayEquals(payload, readBack, "stream should deliver the original bytes");
+        assertFalse(
+                backing.exists(),
+                "backing temp file must be deleted once the response stream is closed");
+    }
+
+    @Test
+    void closingInputStream_propagatesReadFailure() throws IOException {
+        // ManagedTempFileResource is final, so we can't swap in a mock underlying stream.
+        // Instead: open the resource's stream, close the inner FileInputStream early
+        // (by closing the outer stream once), then confirm reading the now-closed stream
+        // throws — exercising ClosingInputStream's read() catch/log/rethrow path. Finally
+        // confirm the temp file is still cleaned up on close().
+        TempFile tempFile = tempFileManager.createManagedTempFile(".pdf");
+        Files.write(tempFile.getPath(), "some-bytes".getBytes(StandardCharsets.UTF_8));
+        File backing = tempFile.getFile();
+        assertTrue(backing.exists());
+
+        WebResponseUtils.ManagedTempFileResource resource =
+                new WebResponseUtils.ManagedTempFileResource(tempFile);
+
+        InputStream in = resource.getInputStream();
+        // Pre-close the underlying stream to guarantee read() throws.
+        in.close();
+        // After close, the temp file has been deleted already.
+        assertFalse(
+                backing.exists(),
+                "backing file is deleted on first close — precondition for read assertion");
+
+        // Any attempt to read from the already-closed stream must throw IOException
+        // (not silently return -1). This exercises the ClosingInputStream.read() path
+        // that logs and rethrows.
+        IOException ioex = assertThrows(IOException.class, in::read);
+        assertNotNull(ioex);
+
+        // close() is idempotent — a second call must not throw.
+        assertDoesNotThrow(in::close);
+    }
+
+    @Test
+    void managedTempFileResource_openFailureCleansUp() throws IOException {
+        // Arrange: build a TempFile whose backing file is deleted out from under it so
+        // super.getInputStream() throws on open. Instrument close() with an AtomicBoolean
+        // hook to confirm the cleanup path ran.
+        AtomicBoolean closed = new AtomicBoolean(false);
+        TempFile spying =
+                new TempFile(tempFileManager, ".pdf") {
+                    @Override
+                    public void close() {
+                        closed.set(true);
+                        super.close();
+                    }
+                };
+        assertTrue(
+                spying.getFile().delete(),
+                "precondition: delete backing so super.getInputStream() fails");
+
+        WebResponseUtils.ManagedTempFileResource resource =
+                new WebResponseUtils.ManagedTempFileResource(spying);
+
+        assertThrows(IOException.class, resource::getInputStream);
+        assertTrue(
+                closed.get(),
+                "tempFile.close() must run when super.getInputStream() fails on open");
+    }
 }
@@ -14,6 +14,8 @@ spotless {
        target 'src/**/java/**/*.java'
        targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
+        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
+        suppressLintsFor { setStep('google-java-format') }

        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
        trimTrailingWhitespace()
@@ -176,6 +178,7 @@ springBoot {

 // Frontend build tasks - only enabled with -PbuildWithFrontend=true
 def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
+def buildPrototypes = project.hasProperty('prototypesMode') && project.property('prototypesMode') == 'true'
 def frontendDir = file('../../frontend')
 def frontendDistDir = file('../../frontend/dist')
 def resourcesStaticDir = file('src/main/resources/static')
@@ -243,9 +246,8 @@ tasks.register('npmBuild', Exec) {
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Build frontend application'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
-    dependsOn npmInstall
+    workingDir file('../..')
+    commandLine = buildPrototypes ? ['task', 'frontend:build:prototypes'] : ['task', 'frontend:build']
    inputs.dir(new File(frontendDir, 'src'))
    inputs.dir(new File(frontendDir, 'public'))
    inputs.file(new File(frontendDir, 'package.json'))
@@ -47,7 +47,7 @@ public class OpenApiConfig {
                        .version(version)
                        .license(
                                new License()
-                                        .name("MIT")
+                                        .name("Open-Core - MIT Licensed")
                                        .url(
                                                "https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/refs/heads/main/LICENSE"))
                        .termsOfService("https://www.stirlingpdf.com/terms")
@@ -28,7 +28,17 @@ public class SpringDocConfig {
                        "/api/v1/proprietary/ui-data/**",
                        "/api/v1/info/**",
                        "/api/v1/general/job/**",
-                        "/api/v1/general/files/**")
+                        "/api/v1/general/files/**",
+                        "/api/v1/general/signatures/**",
+                        "/api/v1/database/**",
+                        "/api/v1/storage/**",
+                        "/api/v1/proprietary/signatures/**",
+                        "/api/v1/workflow/participant/**",
+                        "/api/v1/security/cert-sign/sessions",
+                        "/api/v1/security/cert-sign/sessions/**",
+                        "/api/v1/security/cert-sign/sign-requests",
+                        "/api/v1/security/cert-sign/sign-requests/**",
+                        "/api/v1/security/cert-sign/validate-certificate")
                .addOpenApiCustomizer(pdfFileOneOfCustomizer)
                .addOpenApiCustomizer(
                        openApi -> {
@@ -53,7 +63,16 @@ public class SpringDocConfig {
                        "/api/v1/team/**",
                        "/api/v1/auth/**",
                        "/api/v1/invite/**",
-                        "/api/v1/audit/**")
+                        "/api/v1/audit/**",
+                        "/api/v1/database/**",
+                        "/api/v1/storage/**",
+                        "/api/v1/proprietary/signatures/**",
+                        "/api/v1/workflow/participant/**",
+                        "/api/v1/security/cert-sign/sessions",
+                        "/api/v1/security/cert-sign/sessions/**",
+                        "/api/v1/security/cert-sign/sign-requests",
+                        "/api/v1/security/cert-sign/sign-requests/**",
+                        "/api/v1/security/cert-sign/validate-certificate")
                .addOpenApiCustomizer(
                        openApi -> {
                            openApi.info(
@@ -75,7 +94,8 @@ public class SpringDocConfig {
                        "/api/v1/proprietary/ui-data/**",
                        "/api/v1/info/**",
                        "/api/v1/general/job/**",
-                        "/api/v1/general/files/**")
+                        "/api/v1/general/files/**",
+                        "/api/v1/general/signatures/**")
                .addOpenApiCustomizer(
                        openApi -> {
                            openApi.info(
@@ -1,7 +1,6 @@
 package stirling.software.SPDF.config;

 import java.lang.management.ManagementFactory;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -106,25 +105,27 @@ public class TauriProcessMonitor {
        logger.info("Orphaned Java backend detected. Shutting down gracefully...");

        // Shutdown asynchronously to avoid blocking the monitor thread
-        CompletableFuture.runAsync(
-                () -> {
-                    try {
-                        // Give a small delay to ensure logging completes
-                        Thread.sleep(1000);
+        Thread.ofVirtual()
+                .name("tauri-graceful-shutdown")
+                .start(
+                        () -> {
+                            try {
+                                // Give a small delay to ensure logging completes
+                                Thread.sleep(1000);

-                        if (applicationContext instanceof ConfigurableApplicationContext) {
-                            ((ConfigurableApplicationContext) applicationContext).close();
-                        } else {
-                            // Fallback to system exit
-                            logger.warn(
-                                    "Unable to shutdown Spring context gracefully, using System.exit");
-                            System.exit(0);
-                        }
-                    } catch (Exception e) {
-                        logger.error("Error during graceful shutdown", e);
-                        System.exit(1);
-                    }
-                });
+                                if (applicationContext instanceof ConfigurableApplicationContext) {
+                                    ((ConfigurableApplicationContext) applicationContext).close();
+                                } else {
+                                    // Fallback to system exit
+                                    logger.warn(
+                                            "Unable to shutdown Spring context gracefully, using System.exit");
+                                    System.exit(0);
+                                }
+                            } catch (Exception e) {
+                                logger.error("Error during graceful shutdown", e);
+                                System.exit(1);
+                            }
+                        });
    }

    @PreDestroy
@@ -1,7 +1,6 @@
 package stirling.software.SPDF.controller.api;

 import java.awt.*;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
@@ -13,6 +12,7 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.util.Matrix;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -30,6 +30,7 @@ import stirling.software.SPDF.model.api.general.BookletImpositionRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@RestController
@@ -39,6 +40,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class BookletImpositionController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(
            value = "/booklet-imposition",
@@ -49,7 +51,7 @@ public class BookletImpositionController {
                    "This operation combines page reordering for booklet printing with multi-page layout. "
                            + "It rearranges pages in the correct order for booklet printing and places multiple pages "
                            + "on each sheet for proper folding and binding. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> createBookletImposition(
+    public ResponseEntity<Resource> createBookletImposition(
            @ModelAttribute BookletImpositionRequest request) throws IOException {

        MultipartFile file = request.getFileInput();
@@ -85,15 +87,12 @@ public class BookletImpositionController {
                            duplexPass,
                            flipOnShortEdge)) {

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
-
-                byte[] result = baos.toByteArray();
-                return WebResponseUtils.bytesToWebResponse(
-                        result,
+                return WebResponseUtils.pdfDocToWebResponse(
+                        newDocument,
                        GeneralUtils.generateFilename(
                                Filenames.toSimpleFileName(file.getOriginalFilename()),
-                                "_booklet.pdf"));
+                                "_booklet.pdf"),
+                        tempFileManager);
            }
        }
    }
@@ -1,10 +1,7 @@
 package stirling.software.SPDF.controller.api;

 import java.awt.image.BufferedImage;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.List;

 import org.apache.pdfbox.multipdf.LayerUtility;
@@ -15,6 +12,7 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream.AppendMode;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.rendering.PDFRenderer;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -32,6 +30,8 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -46,6 +46,7 @@ public class CropController {
    private static final String PDF_EXTENSION = ".pdf";

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    private static int[] detectContentBounds(BufferedImage image) {
        int width = image.getWidth();
@@ -131,7 +132,8 @@ public class CropController {
            description =
                    "This operation takes an input PDF file and crops it according to the given"
                            + " coordinates. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> cropPdf(@ModelAttribute CropPdfForm request) throws IOException {
+    public ResponseEntity<Resource> cropPdf(@ModelAttribute CropPdfForm request)
+            throws IOException {
        if (request.isAutoCrop()) {
            return cropWithAutomaticDetection(request);
        }
@@ -151,7 +153,7 @@ public class CropController {
        }
    }

-    private ResponseEntity<byte[]> cropWithAutomaticDetection(@ModelAttribute CropPdfForm request)
+    private ResponseEntity<Resource> cropWithAutomaticDetection(@ModelAttribute CropPdfForm request)
            throws IOException {
        try (PDDocument sourceDocument = pdfDocumentFactory.load(request)) {

@@ -196,19 +198,16 @@ public class CropController {
                                    cropBounds.height));
                }

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
-                byte[] pdfContent = baos.toByteArray();
-
-                return WebResponseUtils.bytesToWebResponse(
-                        pdfContent,
+                return WebResponseUtils.pdfDocToWebResponse(
+                        newDocument,
                        GeneralUtils.generateFilename(
-                                request.getFileInput().getOriginalFilename(), "_cropped.pdf"));
+                                request.getFileInput().getOriginalFilename(), "_cropped.pdf"),
+                        tempFileManager);
            }
        }
    }

-    private ResponseEntity<byte[]> cropWithPDFBox(@ModelAttribute CropPdfForm request)
+    private ResponseEntity<Resource> cropWithPDFBox(@ModelAttribute CropPdfForm request)
            throws IOException {
        try (PDDocument sourceDocument = pdfDocumentFactory.load(request)) {

@@ -255,22 +254,19 @@ public class CropController {
                                    request.getHeight()));
                }

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
-
-                byte[] pdfContent = baos.toByteArray();
-                return WebResponseUtils.bytesToWebResponse(
-                        pdfContent,
+                return WebResponseUtils.pdfDocToWebResponse(
+                        newDocument,
                        GeneralUtils.generateFilename(
-                                request.getFileInput().getOriginalFilename(), "_cropped.pdf"));
+                                request.getFileInput().getOriginalFilename(), "_cropped.pdf"),
+                        tempFileManager);
            }
        }
    }

-    private ResponseEntity<byte[]> cropWithGhostscript(@ModelAttribute CropPdfForm request)
+    private ResponseEntity<Resource> cropWithGhostscript(@ModelAttribute CropPdfForm request)
            throws IOException {
-        Path tempInputFile = null;
-        Path tempOutputFile = null;
+        TempFile tempInputFile = null;
+        TempFile tempOutputFile = null;

        try (PDDocument sourceDocument = pdfDocumentFactory.load(request)) {
            for (int i = 0; i < sourceDocument.getNumberOfPages(); i++) {
@@ -284,11 +280,11 @@ public class CropController {
                page.setCropBox(cropBox);
            }

-            tempInputFile = Files.createTempFile(TEMP_INPUT_PREFIX, PDF_EXTENSION);
-            tempOutputFile = Files.createTempFile(TEMP_OUTPUT_PREFIX, PDF_EXTENSION);
+            tempInputFile = tempFileManager.createManagedTempFile(PDF_EXTENSION);
+            tempOutputFile = tempFileManager.createManagedTempFile(PDF_EXTENSION);

            // Save the source document with crop boxes
-            sourceDocument.save(tempInputFile.toFile());
+            sourceDocument.save(tempInputFile.getFile());

            // Execute Ghostscript to process the crop boxes
            ProcessExecutor processExecutor =
@@ -299,15 +295,15 @@ public class CropController {
                            "-sDEVICE=pdfwrite",
                            "-dUseCropBox",
                            "-o",
-                            tempOutputFile.toString(),
-                            tempInputFile.toString());
+                            tempOutputFile.getAbsolutePath(),
+                            tempInputFile.getAbsolutePath());

            processExecutor.runCommandWithOutputHandling(command);

-            byte[] pdfContent = Files.readAllBytes(tempOutputFile);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    pdfContent,
+            TempFile out = tempOutputFile;
+            tempOutputFile = null; // ownership transferred to response Resource
+            return WebResponseUtils.pdfFileToWebResponse(
+                    out,
                    GeneralUtils.generateFilename(
                            request.getFileInput().getOriginalFilename(), "_cropped.pdf"));

@@ -316,10 +312,10 @@ public class CropController {
            throw ExceptionUtils.createProcessingInterruptedException("Ghostscript", e);
        } finally {
            if (tempInputFile != null) {
-                Files.deleteIfExists(tempInputFile);
+                tempInputFile.close();
            }
            if (tempOutputFile != null) {
-                Files.deleteIfExists(tempOutputFile);
+                tempOutputFile.close();
            }
        }
    }
@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api;

-import java.io.ByteArrayOutputStream;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -10,6 +9,7 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDDocumentOutline;
 import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDOutlineItem;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
@@ -27,6 +27,7 @@ import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

 import tools.jackson.core.type.TypeReference;
@@ -39,6 +40,7 @@ public class EditTableOfContentsController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final ObjectMapper objectMapper;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(
            value = "/extract-bookmarks",
@@ -149,12 +151,11 @@ public class EditTableOfContentsController {
    @Operation(
            summary = "Edit Table of Contents",
            description = "Add or edit bookmarks/table of contents in a PDF document.")
-    public ResponseEntity<byte[]> editTableOfContents(
+    public ResponseEntity<Resource> editTableOfContents(
            @ModelAttribute EditTableOfContentsRequest request) throws Exception {
        MultipartFile file = request.getFileInput();

-        try (PDDocument document = pdfDocumentFactory.load(file);
-                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+        try (PDDocument document = pdfDocumentFactory.load(file)) {

            // Parse the bookmark data from JSON
            List<BookmarkItem> bookmarks =
@@ -168,13 +169,10 @@ public class EditTableOfContentsController {
            // Add bookmarks to the outline
            addBookmarksToOutline(document, outline, bookmarks);

-            // Save the document to a byte array
-            document.save(baos);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    baos.toByteArray(),
+            return WebResponseUtils.pdfDocToWebResponse(
+                    document,
                    GeneralUtils.generateFilename(file.getOriginalFilename(), "_with_toc.pdf"),
-                    MediaType.APPLICATION_PDF);
+                    tempFileManager);
        }
    }

@@ -3,7 +3,6 @@ package stirling.software.SPDF.controller.api;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Comparator;
@@ -24,6 +23,7 @@ import org.apache.pdfbox.pdmodel.interactive.form.PDSignatureField;
 import org.apache.xmpbox.XMPMetadata;
 import org.apache.xmpbox.schema.XMPBasicSchema;
 import org.apache.xmpbox.xml.DomXmpParser;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -279,7 +279,7 @@ public class MergeController {
                    "This endpoint merges multiple PDF files into a single PDF file. The merged"
                            + " file will contain all pages from the input files in the order they were"
                            + " provided. Input:PDF Output:PDF Type:MISO")
-    public ResponseEntity<byte[]> mergePdfs(
+    public ResponseEntity<Resource> mergePdfs(
            @ModelAttribute MergePdfsRequest request,
            @RequestParam(value = "fileOrder", required = false) String fileOrder)
            throws IOException {
@@ -399,12 +399,6 @@ public class MergeController {
        String mergedFileName =
                GeneralUtils.generateFilename(firstFilename, "_merged_unsigned.pdf");

-        byte[] pdfBytes;
-        try {
-            pdfBytes = Files.readAllBytes(outputTempFile.getPath());
-        } finally {
-            outputTempFile.close();
-        }
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, mergedFileName);
+        return WebResponseUtils.pdfFileToWebResponse(outputTempFile, mergedFileName);
    }
 }
@@ -1,7 +1,6 @@
 package stirling.software.SPDF.controller.api;

 import java.awt.Color;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;

 import org.apache.pdfbox.multipdf.LayerUtility;
@@ -11,6 +10,7 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.util.Matrix;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -28,6 +28,7 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralFormCopyUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -36,6 +37,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class MultiPageLayoutController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(
            value = "/multi-page-layout",
@@ -45,7 +47,7 @@ public class MultiPageLayoutController {
            description =
                    "This operation takes an input PDF file and the number of pages to merge into a"
                            + " single sheet in the output PDF file. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> mergeMultiplePagesIntoOne(
+    public ResponseEntity<Resource> mergeMultiplePagesIntoOne(
            @ModelAttribute MergeMultiplePagesRequest request) throws IOException {

        int MAX_PAGES = 100000;
@@ -338,13 +340,11 @@ public class MultiPageLayoutController {
                    }
                }

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
-                byte[] result = baos.toByteArray();
-                return WebResponseUtils.bytesToWebResponse(
-                        result,
+                return WebResponseUtils.pdfDocToWebResponse(
+                        newDocument,
                        GeneralUtils.generateFilename(
-                                file.getOriginalFilename(), "_multi_page_layout.pdf"));
+                                file.getOriginalFilename(), "_multi_page_layout.pdf"),
+                        tempFileManager);
            } // newDocument is closed here
        } // sourceDocument is closed here
    }
@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api;

-import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
@@ -12,6 +11,7 @@ import java.util.Map;
 import org.apache.pdfbox.Loader;
 import org.apache.pdfbox.multipdf.Overlay;
 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -28,6 +28,8 @@ import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -35,6 +37,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class PdfOverlayController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(value = "/overlay-pdfs", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @StandardPdfResponse
@@ -43,7 +46,7 @@ public class PdfOverlayController {
            description =
                    "Overlay PDF files onto a base PDF with different modes: Sequential,"
                            + " Interleaved, or Fixed Repeat. Input:PDF Output:PDF Type:MIMO")
-    public ResponseEntity<byte[]> overlayPdfs(@ModelAttribute OverlayPdfsRequest request)
+    public ResponseEntity<Resource> overlayPdfs(@ModelAttribute OverlayPdfsRequest request)
            throws IOException {
        MultipartFile baseFile = request.getFileInput();
        int overlayPos = request.getOverlayPosition();
@@ -52,6 +55,7 @@ public class PdfOverlayController {
        File[] overlayPdfFiles = new File[overlayFiles.length];
        List<File> tempFiles = new ArrayList<>(); // List to keep track of temporary files

+        TempFile tempOut = null;
        try {
            for (int i = 0; i < overlayFiles.length; i++) {
                overlayPdfFiles[i] = GeneralUtils.multipartToFile(overlayFiles[i]);
@@ -62,8 +66,7 @@ public class PdfOverlayController {
            int[] counts = request.getCounts(); // Used for FixedRepeatOverlay mode

            try (PDDocument basePdf = pdfDocumentFactory.load(baseFile);
-                    Overlay overlay = new Overlay();
-                    ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) {
+                    Overlay overlay = new Overlay()) {
                Map<Integer, String> overlayGuide =
                        prepareOverlayGuide(
                                basePdf.getNumberOfPages(),
@@ -79,15 +82,21 @@ public class PdfOverlayController {
                    overlay.setOverlayPosition(Overlay.Position.BACKGROUND);
                }

-                overlay.overlay(overlayGuide).save(outputStream);
-                byte[] data = outputStream.toByteArray();
+                tempOut = tempFileManager.createManagedTempFile(".pdf");
+                overlay.overlay(overlayGuide).save(tempOut.getFile());
                String outputFilename =
                        GeneralUtils.generateFilename(
                                baseFile.getOriginalFilename(), "_overlayed.pdf");

-                return WebResponseUtils.bytesToWebResponse(
-                        data, outputFilename, MediaType.APPLICATION_PDF);
+                TempFile out = tempOut;
+                tempOut = null; // ownership transferred to response Resource
+                return WebResponseUtils.pdfFileToWebResponse(out, outputFilename);
            }
+        } catch (Exception e) {
+            if (tempOut != null) {
+                tempOut.close();
+            }
+            throw e;
        } finally {
            for (File overlayPdfFile : overlayPdfFiles) {
                if (overlayPdfFile != null) {
@@ -14,10 +14,10 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.util.Matrix;
+import org.springframework.core.io.Resource;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;

@@ -52,7 +52,7 @@ public class PosterPdfController {
                            + "suitable for printing on standard paper sizes (e.g., A4, Letter). "
                            + "Divides each page into a grid of smaller pages using Apache PDFBox. "
                            + "Input: PDF Output: ZIP-PDF Type: SISO")
-    public ResponseEntity<StreamingResponseBody> posterPdf(@ModelAttribute PosterPdfRequest request)
+    public ResponseEntity<Resource> posterPdf(@ModelAttribute PosterPdfRequest request)
            throws Exception {

        log.debug("Starting PDF poster split process with request: {}", request);
@@ -8,6 +8,7 @@ import java.util.Locale;

 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -27,6 +28,7 @@ import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -35,6 +37,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class RearrangePagesPDFController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/remove-pages")
    @StandardPdfResponse
@@ -44,7 +47,7 @@ public class RearrangePagesPDFController {
                    "This endpoint removes specified pages from a given PDF file. Users can provide"
                            + " a comma-separated list of page numbers or ranges to delete. Input:PDF"
                            + " Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> deletePages(@ModelAttribute PDFWithPageNums request)
+    public ResponseEntity<Resource> deletePages(@ModelAttribute PDFWithPageNums request)
            throws IOException {

        MultipartFile pdfFile = request.getFileInput();
@@ -67,7 +70,8 @@ public class RearrangePagesPDFController {
            return WebResponseUtils.pdfDocToWebResponse(
                    document,
                    GeneralUtils.generateFilename(
-                            pdfFile.getOriginalFilename(), "_removed_pages.pdf"));
+                            pdfFile.getOriginalFilename(), "_removed_pages.pdf"),
+                    tempFileManager);
        }
    }

@@ -224,7 +228,7 @@ public class RearrangePagesPDFController {
                            + " order or custom mode. Users can provide a page order as a"
                            + " comma-separated list of page numbers or page ranges, or a custom mode."
                            + " Input:PDF Output:PDF")
-    public ResponseEntity<byte[]> rearrangePages(@ModelAttribute RearrangePagesRequest request)
+    public ResponseEntity<Resource> rearrangePages(@ModelAttribute RearrangePagesRequest request)
            throws IOException {
        MultipartFile pdfFile = request.getFileInput();
        String pageOrder = request.getPageNumbers();
@@ -264,7 +268,8 @@ public class RearrangePagesPDFController {
                    return WebResponseUtils.pdfDocToWebResponse(
                            rearrangedDocument,
                            GeneralUtils.generateFilename(
-                                    pdfFile.getOriginalFilename(), "_rearranged.pdf"));
+                                    pdfFile.getOriginalFilename(), "_rearranged.pdf"),
+                            tempFileManager);
                }
            }
        } catch (IOException e) {
@@ -5,6 +5,7 @@ import java.io.IOException;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageTree;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -21,6 +22,7 @@ import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -28,6 +30,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class RotationController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/rotate-pdf")
    @StandardPdfResponse
@@ -36,7 +39,7 @@ public class RotationController {
            description =
                    "This endpoint rotates a given PDF file by a specified angle. The angle must be"
                            + " a multiple of 90. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> rotatePDF(@ModelAttribute RotatePDFRequest request)
+    public ResponseEntity<Resource> rotatePDF(@ModelAttribute RotatePDFRequest request)
            throws IOException {
        MultipartFile pdfFile = request.getFileInput();
        Integer angle = request.getAngle();
@@ -60,7 +63,8 @@ public class RotationController {
            // Return the rotated PDF as a response
            return WebResponseUtils.pdfDocToWebResponse(
                    document,
-                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_rotated.pdf"));
+                    GeneralUtils.generateFilename(pdfFile.getOriginalFilename(), "_rotated.pdf"),
+                    tempFileManager);
        }
    }
 }
@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api;

-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.util.HashMap;
 import java.util.Map;
@@ -12,6 +11,7 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.util.Matrix;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -28,6 +28,7 @@ import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -36,6 +37,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class ScalePagesController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    private static PDRectangle getTargetSize(String targetPDRectangle, PDDocument sourceDocument) {
        if ("KEEP".equals(targetPDRectangle)) {
@@ -118,7 +120,7 @@ public class ScalePagesController {
            description =
                    "This operation takes an input PDF file and the size to scale the pages to in"
                            + " the output PDF file. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> scalePages(@ModelAttribute ScalePagesRequest request)
+    public ResponseEntity<Resource> scalePages(@ModelAttribute ScalePagesRequest request)
            throws IOException {
        MultipartFile file = request.getFileInput();
        String targetPDRectangle = request.getPageSize();
@@ -126,8 +128,7 @@ public class ScalePagesController {

        try (PDDocument sourceDocument = pdfDocumentFactory.load(file);
                PDDocument outputDocument =
-                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument);
-                ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument)) {

            PDRectangle targetSize = getTargetSize(targetPDRectangle, sourceDocument);

@@ -168,11 +169,10 @@ public class ScalePagesController {
                }
            }

-            outputDocument.save(baos);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    baos.toByteArray(),
-                    GeneralUtils.generateFilename(file.getOriginalFilename(), "_scaled.pdf"));
+            return WebResponseUtils.pdfDocToWebResponse(
+                    outputDocument,
+                    GeneralUtils.generateFilename(file.getOriginalFilename(), "_scaled.pdf"),
+                    tempFileManager);
        }
    }
 }
@@ -9,11 +9,11 @@ import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;

 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;

@@ -21,7 +21,7 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.SPDF.config.swagger.MultiFileResponse;
-import stirling.software.SPDF.model.api.PDFWithPageNums;
+import stirling.software.SPDF.model.api.SplitPagesRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
@@ -48,7 +48,7 @@ public class SplitPDFController {
                            + " specified page numbers or ranges. Users can specify pages using"
                            + " individual numbers, ranges, or 'all' for every page. Input:PDF"
                            + " Output:PDF Type:SIMO")
-    public ResponseEntity<StreamingResponseBody> splitPdf(@ModelAttribute PDFWithPageNums request)
+    public ResponseEntity<Resource> splitPdf(@ModelAttribute SplitPagesRequest request)
            throws IOException {

        MultipartFile file = request.getFileInput();
@@ -11,11 +11,11 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDDocumentOutline;
 import org.apache.pdfbox.pdmodel.interactive.documentnavigation.outline.PDOutlineItem;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;

@@ -124,9 +124,11 @@ public class SplitPdfByChaptersController {
    @MultiFileResponse
    @Operation(
            summary = "Split PDFs by Chapters",
-            description = "Splits a PDF into chapters and returns a ZIP file.")
-    public ResponseEntity<StreamingResponseBody> splitPdf(
-            @ModelAttribute SplitPdfByChaptersRequest request) throws Exception {
+            description =
+                    "Splits a PDF into chapters and returns a ZIP file. Input:PDF Output:ZIP-PDF"
+                            + " Type:SISO")
+    public ResponseEntity<Resource> splitPdf(@ModelAttribute SplitPdfByChaptersRequest request)
+            throws Exception {
        MultipartFile file = request.getFileInput();

        boolean includeMetadata = Boolean.TRUE.equals(request.getIncludeMetadata());
@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api;

-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.util.*;
@@ -16,6 +15,7 @@ import org.apache.pdfbox.pdmodel.PDPageContentStream.AppendMode;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.apache.pdfbox.util.Matrix;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -59,8 +59,8 @@ public class SplitPdfBySectionsController {
                            + " which page to split, and how to split"
                            + " ( halves, thirds, quarters, etc.), both vertically and horizontally."
                            + " Input:PDF Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<byte[]> splitPdf(@Valid @ModelAttribute SplitPdfBySectionsRequest request)
-            throws Exception {
+    public ResponseEntity<Resource> splitPdf(
+            @Valid @ModelAttribute SplitPdfBySectionsRequest request) throws Exception {
        MultipartFile file = request.getFileInput();
        String pageNumbers = request.getPageNumbers();
        SplitTypes splitMode =
@@ -80,9 +80,7 @@ public class SplitPdfBySectionsController {

            if (merge) {
                try (PDDocument mergedDoc =
-                                pdfDocumentFactory.createNewDocumentBasedOnOldDocument(
-                                        sourceDocument);
-                        ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
+                        pdfDocumentFactory.createNewDocumentBasedOnOldDocument(sourceDocument)) {
                    LayerUtility layerUtility = new LayerUtility(mergedDoc);
                    for (int pageIndex = 0;
                            pageIndex < sourceDocument.getNumberOfPages();
@@ -99,11 +97,12 @@ public class SplitPdfBySectionsController {
                            addPageToTarget(sourceDocument, pageIndex, mergedDoc, layerUtility);
                        }
                    }
-                    mergedDoc.save(baos);
-                    return WebResponseUtils.baosToWebResponse(baos, filename + ".pdf");
+                    return WebResponseUtils.pdfDocToWebResponse(
+                            mergedDoc, filename + ".pdf", tempFileManager);
                }
            } else {
-                try (TempFile zipTempFile = new TempFile(tempFileManager, ".zip")) {
+                TempFile zipTempFile = tempFileManager.createManagedTempFile(".zip");
+                try {
                    try (ZipOutputStream zipOut =
                            new ZipOutputStream(Files.newOutputStream(zipTempFile.getPath()))) {
                        for (int pageIndex = 0;
@@ -161,9 +160,10 @@ public class SplitPdfBySectionsController {
                        log.error("Error creating ZIP file with split PDF sections", e);
                        throw e;
                    }
-                    byte[] zipBytes = Files.readAllBytes(zipTempFile.getPath());
-                    return WebResponseUtils.bytesToWebResponse(
-                            zipBytes, filename + ".zip", MediaType.APPLICATION_OCTET_STREAM);
+                    return WebResponseUtils.zipFileToWebResponse(zipTempFile, filename + ".zip");
+                } catch (Exception ex) {
+                    zipTempFile.close();
+                    throw ex;
                }
            }
        } catch (Exception e) {
@@ -8,11 +8,11 @@ import java.util.zip.ZipOutputStream;

 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;

@@ -51,7 +51,7 @@ public class SplitPdfBySizeController {
                            + " if 10MB and each page is 1MB and you enter 2MB then 5 docs each 2MB"
                            + " (rounded so that it accepts 1.9MB but not 2.1MB) Input:PDF"
                            + " Output:ZIP-PDF Type:SISO")
-    public ResponseEntity<StreamingResponseBody> autoSplitPdf(
+    public ResponseEntity<Resource> autoSplitPdf(
            @ModelAttribute SplitPdfBySizeOrCountRequest request) throws Exception {

        log.debug("Starting PDF split process with request: {}", request);
@@ -1,7 +1,6 @@
 package stirling.software.SPDF.controller.api;

 import java.awt.geom.AffineTransform;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;

 import org.apache.pdfbox.multipdf.LayerUtility;
@@ -9,6 +8,7 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -23,6 +23,7 @@ import stirling.software.common.annotations.api.GeneralApi;
 import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@GeneralApi
@@ -30,6 +31,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class ToSinglePageController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(
            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
@@ -42,7 +44,7 @@ public class ToSinglePageController {
                            + " document. The width of the single page will be same as the input's"
                            + " width, but the height will be the sum of all the pages' heights."
                            + " Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> pdfToSinglePage(@ModelAttribute PDFFile request)
+    public ResponseEntity<Resource> pdfToSinglePage(@ModelAttribute PDFFile request)
            throws IOException {

        // Load the source document
@@ -85,14 +87,11 @@ public class ToSinglePageController {
                    pageIndex++;
                }

-                ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                newDocument.save(baos);
-
-                byte[] result = baos.toByteArray();
-                return WebResponseUtils.bytesToWebResponse(
-                        result,
+                return WebResponseUtils.pdfDocToWebResponse(
+                        newDocument,
                        GeneralUtils.generateFilename(
-                                request.getFileInput().getOriginalFilename(), "_singlePage.pdf"));
+                                request.getFileInput().getOriginalFilename(), "_singlePage.pdf"),
+                        tempFileManager);
            }
        }
    }
@@ -95,9 +95,8 @@ public class UIDataController {
        Resource resource = new ClassPathResource("static/3rdPartyLicenses.json");

        try (InputStream is = resource.getInputStream()) {
-            String json = new String(is.readAllBytes(), StandardCharsets.UTF_8);
            Map<String, List<Dependency>> licenseData =
-                    objectMapper.readValue(json, new TypeReference<>() {});
+                    objectMapper.readValue(is, new TypeReference<>() {});
            data.setDependencies(licenseData.get("dependencies"));
        } catch (IOException e) {
            log.error("Failed to load licenses data", e);
@@ -12,6 +12,7 @@ import java.util.Set;

 import org.apache.commons.io.FilenameUtils;
 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -31,6 +32,7 @@ import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@@ -60,7 +62,7 @@ public class ConvertEbookToPDFController {
            description =
                    "This endpoint converts common eBook formats (EPUB, MOBI, AZW3, FB2, TXT, DOCX)"
                            + " to PDF using Calibre. Input:BOOK Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> convertEbookToPdf(
+    public ResponseEntity<Resource> convertEbookToPdf(
            @ModelAttribute ConvertEbookToPdfRequest request) throws Exception {
        if (!isCalibreEnabled()) {
            throw new IllegalStateException("Calibre support is disabled");
@@ -140,24 +142,35 @@ public class ConvertEbookToPDFController {
        String outputFilename =
                GeneralUtils.generateFilename(originalFilename, "_convertedToPDF.pdf");

+        TempFile tempOut = null;
        try {
+            tempOut = tempFileManager.createManagedTempFile(".pdf");
            if (optimizeForEbook) {
                byte[] pdfBytes = Files.readAllBytes(outputPath);
                try {
                    byte[] optimizedPdf = GeneralUtils.optimizePdfWithGhostscript(pdfBytes);
-                    return WebResponseUtils.bytesToWebResponse(optimizedPdf, outputFilename);
+                    Files.write(tempOut.getPath(), optimizedPdf);
                } catch (IOException e) {
                    log.warn(
                            "Ghostscript optimization failed for ebook conversion, returning"
                                    + " original PDF",
                            e);
-                    return WebResponseUtils.bytesToWebResponse(pdfBytes, outputFilename);
+                    Files.write(tempOut.getPath(), pdfBytes);
+                }
+            } else {
+                try (PDDocument document = pdfDocumentFactory.load(outputPath.toFile())) {
+                    document.save(tempOut.getFile());
                }
            }
-
-            try (PDDocument document = pdfDocumentFactory.load(outputPath.toFile())) {
-                return WebResponseUtils.pdfDocToWebResponse(document, outputFilename);
+            ResponseEntity<Resource> response =
+                    WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);
+            tempOut = null;
+            return response;
+        } catch (Exception e) {
+            if (tempOut != null) {
+                tempOut.close();
            }
+            throw e;
        } finally {
            cleanupTempFiles(workingDirectory, inputPath, outputPath);
        }
@@ -2,9 +2,12 @@ package stirling.software.SPDF.controller.api.converters;

 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.util.Locale;

 import org.jetbrains.annotations.NotNull;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -26,6 +29,7 @@ import stirling.software.common.model.api.converters.EmlToPdfRequest;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.CustomHtmlSanitizer;
 import stirling.software.common.util.EmlToPdf;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@@ -48,7 +52,7 @@ public class ConvertEmlToPDF {
                            + " with extensive customization options. Features include font settings,"
                            + " image constraints, display modes, attachment handling, and HTML debug"
                            + " output. Input: EML or MSG file, Output: PDF or HTML file. Type: SISO")
-    public ResponseEntity<byte[]> convertEmlToPdf(@ModelAttribute EmlToPdfRequest request) {
+    public ResponseEntity<Resource> convertEmlToPdf(@ModelAttribute EmlToPdfRequest request) {

        MultipartFile inputFile = request.getFileInput();
        String originalFilename = inputFile.getOriginalFilename();
@@ -56,22 +60,19 @@ public class ConvertEmlToPDF {
        // Validate input
        if (inputFile.isEmpty()) {
            log.error("No file provided for EML/MSG to PDF conversion.");
-            return ResponseEntity.badRequest()
-                    .body("No file provided".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(HttpStatus.BAD_REQUEST, "No file provided");
        }

        if (originalFilename == null || originalFilename.trim().isEmpty()) {
            log.error("Filename is null or empty.");
-            return ResponseEntity.badRequest()
-                    .body("Please provide a valid filename".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(HttpStatus.BAD_REQUEST, "Please provide a valid filename");
        }

        // Validate file type - support EML and MSG (Outlook) files
        String lowerFilename = originalFilename.toLowerCase(Locale.ROOT);
        if (!lowerFilename.endsWith(".eml") && !lowerFilename.endsWith(".msg")) {
            log.error("Invalid file type for EML/MSG to PDF: {}", originalFilename);
-            return ResponseEntity.badRequest()
-                    .body("Please upload a valid EML or MSG file".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(HttpStatus.BAD_REQUEST, "Please upload a valid EML or MSG file");
        }

        String baseFilename = Filenames.toSimpleFileName(originalFilename); // Use Filenames utility
@@ -84,16 +85,20 @@ public class ConvertEmlToPDF {
                    String htmlContent =
                            EmlToPdf.convertEmlToHtml(fileBytes, request, customHtmlSanitizer);
                    log.info("Successfully converted email to HTML: {}", originalFilename);
-                    return WebResponseUtils.bytesToWebResponse(
-                            htmlContent.getBytes(StandardCharsets.UTF_8),
-                            baseFilename + ".html",
-                            MediaType.TEXT_HTML);
+                    TempFile tempOut = tempFileManager.createManagedTempFile(".html");
+                    try {
+                        Files.writeString(tempOut.getPath(), htmlContent, StandardCharsets.UTF_8);
+                    } catch (Exception ex) {
+                        tempOut.close();
+                        throw ex;
+                    }
+                    return WebResponseUtils.fileToWebResponse(
+                            tempOut, baseFilename + ".html", MediaType.TEXT_HTML);
                } catch (IOException | IllegalArgumentException e) {
                    log.error("HTML conversion failed for {}", originalFilename, e);
-                    return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                            .body(
-                                    ("HTML conversion failed: " + e.getMessage())
-                                            .getBytes(StandardCharsets.UTF_8));
+                    return errorResponse(
+                            HttpStatus.INTERNAL_SERVER_ERROR,
+                            "HTML conversion failed: " + e.getMessage());
                }
            }

@@ -111,20 +116,25 @@ public class ConvertEmlToPDF {

                if (pdfBytes == null || pdfBytes.length == 0) {
                    log.error("PDF conversion failed - empty output for {}", originalFilename);
-                    return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                            .body(
-                                    "PDF conversion failed - empty output"
-                                            .getBytes(StandardCharsets.UTF_8));
+                    return errorResponse(
+                            HttpStatus.INTERNAL_SERVER_ERROR,
+                            "PDF conversion failed - empty output");
                }
                log.info("Successfully converted email to PDF: {}", originalFilename);
-                return WebResponseUtils.bytesToWebResponse(
-                        pdfBytes, baseFilename + ".pdf", MediaType.APPLICATION_PDF);
+                TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+                try {
+                    Files.write(tempOut.getPath(), pdfBytes);
+                } catch (Exception ex) {
+                    tempOut.close();
+                    throw ex;
+                }
+                return WebResponseUtils.pdfFileToWebResponse(tempOut, baseFilename + ".pdf");

            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                log.error("Email to PDF conversion was interrupted for {}", originalFilename, e);
-                return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                        .body("Conversion was interrupted".getBytes(StandardCharsets.UTF_8));
+                return errorResponse(
+                        HttpStatus.INTERNAL_SERVER_ERROR, "Conversion was interrupted");
            } catch (IllegalArgumentException e) {
                String errorMessage = buildErrorMessage(e, originalFilename);
                log.error(
@@ -132,8 +142,7 @@ public class ConvertEmlToPDF {
                        originalFilename,
                        errorMessage,
                        e);
-                return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                        .body(errorMessage.getBytes(StandardCharsets.UTF_8));
+                return errorResponse(HttpStatus.INTERNAL_SERVER_ERROR, errorMessage);
            } catch (RuntimeException e) {
                String errorMessage = buildErrorMessage(e, originalFilename);
                log.error(
@@ -141,17 +150,22 @@ public class ConvertEmlToPDF {
                        originalFilename,
                        errorMessage,
                        e);
-                return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                        .body(errorMessage.getBytes(StandardCharsets.UTF_8));
+                return errorResponse(HttpStatus.INTERNAL_SERVER_ERROR, errorMessage);
            }

        } catch (IOException e) {
            log.error("File processing error for email to PDF: {}", originalFilename, e);
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body("File processing error".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(HttpStatus.INTERNAL_SERVER_ERROR, "File processing error");
        }
    }

+    private ResponseEntity<Resource> errorResponse(HttpStatus status, String message) {
+        byte[] body = message.getBytes(StandardCharsets.UTF_8);
+        return ResponseEntity.status(status)
+                .contentLength(body.length)
+                .body(new ByteArrayResource(body));
+    }
+
    private static @NotNull String buildErrorMessage(Exception e, String originalFilename) {
        String safeFilename = HtmlUtils.htmlEscape(originalFilename);
        String exceptionMessage = e.getMessage();
@@ -1,5 +1,8 @@
 package stirling.software.SPDF.controller.api.converters;

+import java.nio.file.Files;
+
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -37,7 +40,7 @@ public class ConvertHtmlToPDF {
            description =
                    "This endpoint takes an HTML or ZIP file input and converts it to a PDF format."
                            + " Input:HTML Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> HtmlToPdf(@ModelAttribute HTMLToPdfRequest request)
+    public ResponseEntity<Resource> HtmlToPdf(@ModelAttribute HTMLToPdfRequest request)
            throws Exception {
        MultipartFile fileInput = request.getFileInput();

@@ -65,6 +68,13 @@ public class ConvertHtmlToPDF {

        String outputFilename = GeneralUtils.generateFilename(originalFilename, ".pdf");

-        return WebResponseUtils.bytesToWebResponse(pdfBytes, outputFilename);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+        try {
+            Files.write(tempOut.getPath(), pdfBytes);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);
    }
 }
@@ -18,11 +18,11 @@ import org.apache.commons.io.FileUtils;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.rendering.ImageType;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.multipart.MultipartFile;
-import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;

 import io.swagger.v3.oas.annotations.Operation;

@@ -274,8 +274,8 @@ public class ConvertImgPDFController {
            description =
                    "This endpoint converts a CBZ (ZIP) comic book archive to a PDF file. "
                            + "Input:CBZ Output:PDF Type:SISO")
-    public ResponseEntity<StreamingResponseBody> convertCbzToPdf(
-            @ModelAttribute ConvertCbzToPdfRequest request) throws IOException {
+    public ResponseEntity<Resource> convertCbzToPdf(@ModelAttribute ConvertCbzToPdfRequest request)
+            throws IOException {
        MultipartFile file = request.getFileInput();
        boolean optimizeForEbook = request.isOptimizeForEbook();

@@ -300,8 +300,8 @@ public class ConvertImgPDFController {
            description =
                    "This endpoint converts a PDF file to a CBZ (ZIP) comic book archive. "
                            + "Input:PDF Output:CBZ Type:SISO")
-    public ResponseEntity<StreamingResponseBody> convertPdfToCbz(
-            @ModelAttribute ConvertPdfToCbzRequest request) throws IOException {
+    public ResponseEntity<Resource> convertPdfToCbz(@ModelAttribute ConvertPdfToCbzRequest request)
+            throws IOException {
        MultipartFile file = request.getFileInput();
        int dpi = request.getDpi();

@@ -1,5 +1,6 @@
 package stirling.software.SPDF.controller.api.converters;

+import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;

@@ -10,6 +11,7 @@ import org.commonmark.node.Node;
 import org.commonmark.parser.Parser;
 import org.commonmark.renderer.html.AttributeProvider;
 import org.commonmark.renderer.html.HtmlRenderer;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -46,7 +48,7 @@ public class ConvertMarkdownToPdf {
            description =
                    "This endpoint takes a Markdown file or ZIP (containing Markdown + images) input, converts it to HTML, and then to"
                            + " PDF format. Input:MARKDOWN Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> markdownToPdf(@ModelAttribute GeneralFile generalFile)
+    public ResponseEntity<Resource> markdownToPdf(@ModelAttribute GeneralFile generalFile)
            throws Exception {
        MultipartFile fileInput = generalFile.getFileInput();

@@ -79,7 +81,7 @@ public class ConvertMarkdownToPdf {
                java.nio.file.Path tempDirPath = tempDir.getPath();
                try (java.util.zip.ZipInputStream zipIn =
                        io.github.pixee.security.ZipSecurity.createHardenedInputStream(
-                                new java.io.ByteArrayInputStream(fileInput.getBytes()))) {
+                                fileInput.getInputStream())) {
                    java.util.zip.ZipEntry entry;
                    while ((entry = zipIn.getNextEntry()) != null) {
                        if (!entry.isDirectory()) {
@@ -141,7 +143,7 @@ public class ConvertMarkdownToPdf {
            List<Extension> extensions = List.of(TablesExtension.create());
            Parser parser = Parser.builder().extensions(extensions).build();

-            Node document = parser.parse(new String(fileInput.getBytes()));
+            Node document = parser.parse(new String(fileInput.getBytes(), StandardCharsets.UTF_8));
            HtmlRenderer renderer =
                    HtmlRenderer.builder()
                            .attributeProviderFactory(context -> new TableAttributeProvider())
@@ -154,7 +156,7 @@ public class ConvertMarkdownToPdf {
                    FileToPdf.convertHtmlToPdf(
                            runtimePathConfig.getWeasyPrintPath(),
                            null,
-                            htmlContent.getBytes(),
+                            htmlContent.getBytes(StandardCharsets.UTF_8),
                            "converted.html",
                            tempFileManager,
                            customHtmlSanitizer);
@@ -163,7 +165,15 @@ public class ConvertMarkdownToPdf {
        }

        pdfBytes = pdfDocumentFactory.createNewBytesBasedOnOldDocument(pdfBytes);
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, outputFilename);
+
+        TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+        try {
+            java.nio.file.Files.write(tempOut.getPath(), pdfBytes);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);
    }

    /**
@@ -13,6 +13,7 @@ import java.util.Locale;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.FilenameUtils;
 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -36,6 +37,8 @@ import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
 import stirling.software.common.util.RegexPatternUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@ConvertApi
@@ -47,6 +50,7 @@ public class ConvertOfficeController {
    private final RuntimePathConfig runtimePathConfig;
    private final CustomHtmlSanitizer customHtmlSanitizer;
    private final EndpointConfiguration endpointConfiguration;
+    private final TempFileManager tempFileManager;

    private boolean isUnoconvertAvailable() {
        return endpointConfiguration.isGroupEnabled("Unoconvert")
@@ -202,21 +206,32 @@ public class ConvertOfficeController {
            description =
                    "This endpoint converts a given file to a PDF using LibreOffice API  Input:ANY"
                            + " Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> processFileToPDF(@ModelAttribute GeneralFile generalFile)
+    public ResponseEntity<Resource> processFileToPDF(@ModelAttribute GeneralFile generalFile)
            throws Exception {
        MultipartFile inputFile = generalFile.getFileInput();
        // unused but can start server instance if startup time is to long
        // LibreOfficeListener.getInstance().start();
        File file = null;
+        TempFile tempOut = null;
        try {
            file = convertToPdf(inputFile);

+            tempOut = tempFileManager.createManagedTempFile(".pdf");
            try (PDDocument doc = pdfDocumentFactory.load(file)) {
-                return WebResponseUtils.pdfDocToWebResponse(
-                        doc,
-                        GeneralUtils.generateFilename(
-                                inputFile.getOriginalFilename(), "_convertedToPDF.pdf"));
+                doc.save(tempOut.getFile());
            }
+            String filename =
+                    GeneralUtils.generateFilename(
+                            inputFile.getOriginalFilename(), "_convertedToPDF.pdf");
+            ResponseEntity<Resource> response =
+                    WebResponseUtils.pdfFileToWebResponse(tempOut, filename);
+            tempOut = null;
+            return response;
+        } catch (Exception e) {
+            if (tempOut != null) {
+                tempOut.close();
+            }
+            throw e;
        } finally {
            if (file != null && file.getParent() != null) {
                FileUtils.deleteDirectory(file.getParentFile());
@@ -9,6 +9,7 @@ import java.util.ArrayList;
 import java.util.List;

 import org.apache.commons.io.FilenameUtils;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -29,6 +30,7 @@ import stirling.software.common.annotations.api.ConvertApi;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@@ -85,8 +87,8 @@ public class ConvertPDFToEpubController {
            description =
                    "Convert a PDF file to a high-quality EPUB or AZW3 ebook using Calibre. Input:PDF"
                            + " Output:EPUB/AZW3 Type:SISO")
-    public ResponseEntity<byte[]> convertPdfToEpub(@ModelAttribute ConvertPdfToEpubRequest request)
-            throws Exception {
+    public ResponseEntity<Resource> convertPdfToEpub(
+            @ModelAttribute ConvertPdfToEpubRequest request) throws Exception {

        if (!endpointConfiguration.isGroupEnabled(CALIBRE_GROUP)) {
            throw new IllegalStateException(
@@ -170,9 +172,16 @@ public class ConvertPDFToEpubController {
                                    + "."
                                    + outputFormat.getExtension());

-            byte[] outputBytes = Files.readAllBytes(outputPath);
            MediaType mediaType = MediaType.valueOf(outputFormat.getMediaType());
-            return WebResponseUtils.bytesToWebResponse(outputBytes, outputFilename, mediaType);
+            TempFile tempOut =
+                    tempFileManager.createManagedTempFile("." + outputFormat.getExtension());
+            try {
+                Files.copy(outputPath, tempOut.getPath(), StandardCopyOption.REPLACE_EXISTING);
+            } catch (Exception e) {
+                tempOut.close();
+                throw e;
+            }
+            return WebResponseUtils.fileToWebResponse(tempOut, outputFilename, mediaType);
        } finally {
            cleanupTempFiles(workingDirectory, inputPath, outputPath);
        }
@@ -1,6 +1,7 @@
 package stirling.software.SPDF.controller.api.converters;

-import java.io.ByteArrayOutputStream;
+import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.List;
 import java.util.Locale;

@@ -11,8 +12,7 @@ import org.apache.poi.ss.usermodel.Sheet;
 import org.apache.poi.ss.usermodel.Workbook;
 import org.apache.poi.ss.util.WorkbookUtil;
 import org.apache.poi.xssf.usermodel.XSSFWorkbook;
-import org.springframework.http.ContentDisposition;
-import org.springframework.http.HttpHeaders;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -27,6 +27,9 @@ import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.ConvertApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.WebResponseUtils;

 import technology.tabula.ObjectExtractor;
 import technology.tabula.Page;
@@ -40,6 +43,7 @@ import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
 public class ConvertPDFToExcelController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(value = "/pdf/xlsx", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    @Operation(
@@ -47,11 +51,12 @@ public class ConvertPDFToExcelController {
            description =
                    "Extracts tabular data from each page of a PDF and writes it into an Excel"
                            + " workbook, one sheet per table. Input:PDF Output:XLSX Type:SISO")
-    public ResponseEntity<byte[]> pdfToExcel(@ModelAttribute PDFWithPageNums request)
+    public ResponseEntity<Resource> pdfToExcel(@ModelAttribute PDFWithPageNums request)
            throws Exception {
        String baseName =
                GeneralUtils.removeExtension(request.getFileInput().getOriginalFilename());

+        TempFile tempOut = tempFileManager.createManagedTempFile(".xlsx");
        try (PDDocument document = pdfDocumentFactory.load(request);
                XSSFWorkbook workbook = new XSSFWorkbook();
                ObjectExtractor extractor = new ObjectExtractor(document)) {
@@ -89,21 +94,22 @@ public class ConvertPDFToExcelController {
            }

            if (sheetCount == 0) {
+                tempOut.close();
                return ResponseEntity.noContent().build();
            }

-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            workbook.write(baos);
-
-            HttpHeaders headers = new HttpHeaders();
-            headers.setContentDisposition(
-                    ContentDisposition.builder("attachment").filename(baseName + ".xlsx").build());
-            headers.setContentType(
-                    MediaType.parseMediaType(
-                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"));
-
-            return ResponseEntity.ok().headers(headers).body(baos.toByteArray());
+            try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
+                workbook.write(os);
+            }
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
        }
+
+        MediaType mediaType =
+                MediaType.parseMediaType(
+                        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
+        return WebResponseUtils.fileToWebResponse(tempOut, baseName + ".xlsx", mediaType);
    }

    private String getUniqueSheetName(Workbook workbook, String baseName) {
@@ -1,5 +1,6 @@
 package stirling.software.SPDF.controller.api.converters;

+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -28,7 +29,8 @@ public class ConvertPDFToHtml {
            summary = "Convert PDF to HTML",
            description =
                    "This endpoint converts a PDF file to HTML format. Input:PDF Output:HTML Type:SISO")
-    public ResponseEntity<byte[]> processPdfToHTML(@ModelAttribute PDFFile file) throws Exception {
+    public ResponseEntity<Resource> processPdfToHTML(@ModelAttribute PDFFile file)
+            throws Exception {
        MultipartFile inputFile = file.getFileInput();
        PDFToFile pdfToFile = new PDFToFile(tempFileManager, runtimePathConfig);
        return pdfToFile.processPdfToHtml(inputFile);
@@ -1,9 +1,12 @@
 package stirling.software.SPDF.controller.api.converters;

 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;

 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.text.PDFTextStripper;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -23,6 +26,7 @@ import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.PDFToFile;
+import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@@ -40,7 +44,7 @@ public class ConvertPDFToOffice {
            description =
                    "This endpoint converts a given PDF file to a Presentation format. Input:PDF"
                            + " Output:PPT Type:SISO")
-    public ResponseEntity<byte[]> processPdfToPresentation(
+    public ResponseEntity<Resource> processPdfToPresentation(
            @ModelAttribute PdfToPresentationRequest request)
            throws IOException, InterruptedException {
        MultipartFile inputFile = request.getFileInput();
@@ -55,20 +59,24 @@ public class ConvertPDFToOffice {
            description =
                    "This endpoint converts a given PDF file to Text or RTF format. Input:PDF"
                            + " Output:TXT Type:SISO")
-    public ResponseEntity<byte[]> processPdfToRTForTXT(
+    public ResponseEntity<Resource> processPdfToRTForTXT(
            @ModelAttribute PdfToTextOrRTFRequest request)
            throws IOException, InterruptedException {
        MultipartFile inputFile = request.getFileInput();
        String outputFormat = request.getOutputFormat();
        if ("txt".equals(request.getOutputFormat())) {
+            String fileName =
+                    GeneralUtils.generateFilename(inputFile.getOriginalFilename(), ".txt");
+            TempFile finalOut = tempFileManager.createManagedTempFile(".txt");
            try (PDDocument document = pdfDocumentFactory.load(inputFile)) {
                PDFTextStripper stripper = new PDFTextStripper();
                String text = stripper.getText(document);
-                return WebResponseUtils.bytesToWebResponse(
-                        text.getBytes(),
-                        GeneralUtils.generateFilename(inputFile.getOriginalFilename(), ".txt"),
-                        MediaType.TEXT_PLAIN);
+                Files.writeString(finalOut.getPath(), text, StandardCharsets.UTF_8);
+            } catch (Exception e) {
+                finalOut.close();
+                throw e;
            }
+            return WebResponseUtils.fileToWebResponse(finalOut, fileName, MediaType.TEXT_PLAIN);
        } else {
            PDFToFile pdfToFile = new PDFToFile(tempFileManager, runtimePathConfig);
            return pdfToFile.processPdfToOfficeFormat(inputFile, outputFormat, "writer_pdf_import");
@@ -81,7 +89,7 @@ public class ConvertPDFToOffice {
            description =
                    "This endpoint converts a given PDF file to a Word document format. Input:PDF"
                            + " Output:WORD Type:SISO")
-    public ResponseEntity<byte[]> processPdfToWord(@ModelAttribute PdfToWordRequest request)
+    public ResponseEntity<Resource> processPdfToWord(@ModelAttribute PdfToWordRequest request)
            throws IOException, InterruptedException {
        MultipartFile inputFile = request.getFileInput();
        String outputFormat = request.getOutputFormat();
@@ -95,7 +103,7 @@ public class ConvertPDFToOffice {
            description =
                    "This endpoint converts a PDF file to an XML file. Input:PDF Output:XML"
                            + " Type:SISO")
-    public ResponseEntity<byte[]> processPdfToXML(@ModelAttribute PDFFile file) throws Exception {
+    public ResponseEntity<Resource> processPdfToXML(@ModelAttribute PDFFile file) throws Exception {
        MultipartFile inputFile = file.getFileInput();

        PDFToFile pdfToFile = new PDFToFile(tempFileManager, runtimePathConfig);
@@ -71,6 +71,7 @@ import org.apache.xmpbox.schema.PDFAIdentificationSchema;
 import org.apache.xmpbox.schema.XMPBasicSchema;
 import org.apache.xmpbox.xml.DomXmpParser;
 import org.apache.xmpbox.xml.XmpSerializer;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -92,6 +93,8 @@ import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.ProcessExecutor.ProcessExecutorResult;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@ConvertApi
@@ -102,6 +105,7 @@ public class ConvertPDFToPDFA {
    private static final Pattern NON_PRINTABLE_ASCII = Pattern.compile("[^\\x20-\\x7E]");
    private final RuntimePathConfig runtimePathConfig;
    private final stirling.software.SPDF.service.VeraPDFService veraPDFService;
+    private final TempFileManager tempFileManager;

    private static final String ICC_RESOURCE_PATH = "/icc/sRGB2014.icc";
    private static final int PDFA_COMPATIBILITY_POLICY = 1;
@@ -573,7 +577,7 @@ public class ConvertPDFToPDFA {
            summary = "Convert a PDF to a PDF/A or PDF/X",
            description =
                    "This endpoint converts a PDF file to a PDF/A or PDF/X file using Ghostscript (preferred) or PDFBox/LibreOffice (fallback). PDF/A is a format designed for long-term archiving, while PDF/X is optimized for print production. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> pdfToPdfA(@ModelAttribute PdfToPdfARequest request)
+    public ResponseEntity<Resource> pdfToPdfA(@ModelAttribute PdfToPdfARequest request)
            throws Exception {
        MultipartFile inputFile = request.getFileInput();
        String outputFormat = request.getOutputFormat();
@@ -609,7 +613,7 @@ public class ConvertPDFToPDFA {
        return missing;
    }

-    private ResponseEntity<byte[]> handlePdfXConversion(
+    private ResponseEntity<Resource> handlePdfXConversion(
            MultipartFile inputFile, String outputFormat) throws Exception {
        PdfXProfile profile = PdfXProfile.fromRequest(outputFormat);

@@ -640,8 +644,14 @@ public class ConvertPDFToPDFA {

            log.info("PDF/X conversion completed successfully to {}", profile.getDisplayName());

-            return WebResponseUtils.bytesToWebResponse(
-                    converted, outputFilename, MediaType.APPLICATION_PDF);
+            TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+            try {
+                Files.write(tempOut.getPath(), converted);
+            } catch (Exception ex) {
+                tempOut.close();
+                throw ex;
+            }
+            return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);

        } catch (IOException | InterruptedException e) {
            log.error("PDF/X conversion failed", e);
@@ -1796,7 +1806,7 @@ public class ConvertPDFToPDFA {
        return Files.readAllBytes(outputPdf);
    }

-    private ResponseEntity<byte[]> handlePdfAConversion(
+    private ResponseEntity<Resource> handlePdfAConversion(
            MultipartFile inputFile, String outputFormat, boolean strict) throws Exception {
        PdfaProfile profile = PdfaProfile.fromRequest(outputFormat);

@@ -1830,8 +1840,14 @@ public class ConvertPDFToPDFA {
                        verifyStrictCompliance(converted);
                    }

-                    return WebResponseUtils.bytesToWebResponse(
-                            converted, outputFilename, MediaType.APPLICATION_PDF);
+                    TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+                    try {
+                        Files.write(tempOut.getPath(), converted);
+                    } catch (Exception ex) {
+                        tempOut.close();
+                        throw ex;
+                    }
+                    return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);
                } catch (IOException | InterruptedException e) {
                    log.warn(
                            "Ghostscript conversion failed, falling back to PDFBox/LibreOffice method",
@@ -1851,8 +1867,14 @@ public class ConvertPDFToPDFA {
                verifyStrictCompliance(converted);
            }

-            return WebResponseUtils.bytesToWebResponse(
-                    converted, outputFilename, MediaType.APPLICATION_PDF);
+            TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+            try {
+                Files.write(tempOut.getPath(), converted);
+            } catch (Exception ex) {
+                tempOut.close();
+                throw ex;
+            }
+            return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);
        } finally {
            deleteQuietly(workingDir);
        }
@@ -1,11 +1,16 @@
 package stirling.software.SPDF.controller.api.converters;

+import java.io.IOException;
+import java.io.OutputStream;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.Optional;
 import java.util.UUID;
 import java.util.regex.Pattern;

 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -31,6 +36,8 @@ import stirling.software.common.model.api.GeneralFile;
 import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.JobOwnershipService;
 import stirling.software.common.util.ExceptionUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@Slf4j
@@ -42,6 +49,7 @@ public class ConvertPdfJsonController {
    private static final Pattern WHITESPACE_PATTERN = Pattern.compile("[\\r\\n\\t]+");
    private static final Pattern NON_PRINTABLE_PATTERN = Pattern.compile("[^\\x20-\\x7E]");
    private final PdfJsonConversionService pdfJsonConversionService;
+    private final TempFileManager tempFileManager;

    @Autowired(required = false)
    private JobOwnershipService jobOwnershipService;
@@ -51,7 +59,7 @@ public class ConvertPdfJsonController {
            summary = "Convert PDF to Text Editor Format",
            description =
                    "Extracts PDF text, fonts, and metadata into an editable JSON structure for the text editor tool. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<byte[]> convertPdfToJson(
+    public ResponseEntity<Resource> convertPdfToJson(
            @ModelAttribute PDFFile request,
            @RequestParam(value = "lightweight", defaultValue = "false") boolean lightweight)
            throws Exception {
@@ -60,8 +68,6 @@ public class ConvertPdfJsonController {
            throw ExceptionUtils.createNullArgumentException("fileInput");
        }

-        byte[] jsonBytes = pdfJsonConversionService.convertPdfToJson(inputFile, lightweight);
-        logJsonResponse("pdf/text-editor", jsonBytes);
        String originalName = inputFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
@@ -70,7 +76,20 @@ public class ConvertPdfJsonController {
                                .replaceFirst("")
                        : "document";
        String docName = baseName + ".json";
-        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".json");
+        try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
+            pdfJsonConversionService.convertPdfToJson(inputFile, lightweight, os);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        try {
+            logJsonResponse("pdf/text-editor", tempOut.getPath());
+            return WebResponseUtils.fileToWebResponse(tempOut, docName, MediaType.APPLICATION_JSON);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
    }

    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/text-editor/pdf")
@@ -79,14 +98,13 @@ public class ConvertPdfJsonController {
            summary = "Convert Text Editor Format to PDF",
            description =
                    "Rebuilds a PDF from the editable JSON structure generated by the text editor tool. Input:JSON Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> convertJsonToPdf(@ModelAttribute GeneralFile request)
+    public ResponseEntity<Resource> convertJsonToPdf(@ModelAttribute GeneralFile request)
            throws Exception {
        MultipartFile jsonFile = request.getFileInput();
        if (jsonFile == null) {
            throw ExceptionUtils.createNullArgumentException("fileInput");
        }

-        byte[] pdfBytes = pdfJsonConversionService.convertJsonToPdf(jsonFile);
        String originalName = jsonFile.getOriginalFilename();
        String baseName =
                (originalName != null && !originalName.isBlank())
@@ -95,7 +113,14 @@ public class ConvertPdfJsonController {
                                .replaceFirst("")
                        : "document";
        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+        try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
+            pdfJsonConversionService.convertJsonToPdf(jsonFile, os);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        return WebResponseUtils.pdfFileToWebResponse(tempOut, docName);
    }

    @AutoJobPostMapping(consumes = "multipart/form-data", value = "/pdf/text-editor/metadata")
@@ -105,38 +130,37 @@ public class ConvertPdfJsonController {
                    "Extracts document metadata, fonts, and page dimensions for the text editor tool. Caches the document for"
                            + " subsequent page requests. Returns a server-generated jobId scoped to the"
                            + " authenticated user. Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<byte[]> extractPdfMetadata(@ModelAttribute PDFFile request)
+    public ResponseEntity<Resource> extractPdfMetadata(@ModelAttribute PDFFile request)
            throws Exception {
        MultipartFile inputFile = request.getFileInput();
        if (inputFile == null) {
            throw ExceptionUtils.createNullArgumentException("fileInput");
        }

-        // Generate server-side UUID for job
        String baseJobId = UUID.randomUUID().toString();

-        // Scope job to authenticated user if security is enabled
        String scopedJobKey = getScopedJobKey(baseJobId);

        log.debug("Extracting metadata for PDF, assigned jobId: {}", scopedJobKey);

-        byte[] jsonBytes =
-                pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey);
-        logJsonResponse("pdf/text-editor/metadata", jsonBytes);
-        String originalName = inputFile.getOriginalFilename();
-        String baseName =
-                (originalName != null && !originalName.isBlank())
-                        ? FILE_EXTENSION_PATTERN
-                                .matcher(Filenames.toSimpleFileName(originalName))
-                                .replaceFirst("")
-                        : "document";
-        String docName = baseName + "_metadata.json";
-
-        // Return jobId in response header for client
-        return ResponseEntity.ok()
-                .header("X-Job-Id", scopedJobKey)
-                .contentType(MediaType.APPLICATION_JSON)
-                .body(jsonBytes);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".json");
+        try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
+            pdfJsonConversionService.extractDocumentMetadata(inputFile, scopedJobKey, os);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        try {
+            logJsonResponse("pdf/text-editor/metadata", tempOut.getPath());
+            return ResponseEntity.ok()
+                    .header("X-Job-Id", scopedJobKey)
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .contentLength(Files.size(tempOut.getPath()))
+                    .body(new WebResponseUtils.ManagedTempFileResource(tempOut));
+        } catch (IOException | RuntimeException e) {
+            tempOut.close();
+            throw e;
+        }
    }

    @AutoJobPostMapping(
@@ -149,7 +173,7 @@ public class ConvertPdfJsonController {
                    "Applies edits for the specified pages of a cached PDF and returns an updated PDF."
                            + " Requires the PDF to have been previously cached via the text editor metadata endpoint."
                            + " The jobId must be obtained from the metadata extraction endpoint.")
-    public ResponseEntity<byte[]> exportPartialPdf(
+    public ResponseEntity<Resource> exportPartialPdf(
            @PathVariable String jobId,
            @RequestBody PdfJsonDocument document,
            @RequestParam(value = "filename", required = false) String filename)
@@ -158,7 +182,6 @@ public class ConvertPdfJsonController {
            throw ExceptionUtils.createNullArgumentException("document");
        }

-        // Validate job ownership
        validateJobAccess(jobId);

        byte[] pdfBytes = pdfJsonConversionService.exportUpdatedPages(jobId, document);
@@ -173,7 +196,14 @@ public class ConvertPdfJsonController {
                                .filter(title -> title != null && !title.isBlank())
                                .orElse("document");
        String docName = baseName.endsWith(".pdf") ? baseName : baseName + ".pdf";
-        return WebResponseUtils.bytesToWebResponse(pdfBytes, docName);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+        try {
+            Files.write(tempOut.getPath(), pdfBytes);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        return WebResponseUtils.pdfFileToWebResponse(tempOut, docName);
    }

    @GetMapping(value = "/pdf/text-editor/page/{jobId}/{pageNumber}")
@@ -183,16 +213,26 @@ public class ConvertPdfJsonController {
                    "Retrieves a single page's content from a previously cached PDF document for the text editor tool."
                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
                            + " authenticated user. Output:JSON")
-    public ResponseEntity<byte[]> extractSinglePage(
+    public ResponseEntity<Resource> extractSinglePage(
            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {

-        // Validate job ownership
        validateJobAccess(jobId);

-        byte[] jsonBytes = pdfJsonConversionService.extractSinglePage(jobId, pageNumber);
-        logJsonResponse("pdf/text-editor/page", jsonBytes);
        String docName = "page_" + pageNumber + ".json";
-        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".json");
+        try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
+            pdfJsonConversionService.extractSinglePage(jobId, pageNumber, os);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        try {
+            logJsonResponse("pdf/text-editor/page", tempOut.getPath());
+            return WebResponseUtils.fileToWebResponse(tempOut, docName, MediaType.APPLICATION_JSON);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
    }

    @GetMapping(value = "/pdf/text-editor/fonts/{jobId}/{pageNumber}")
@@ -202,16 +242,26 @@ public class ConvertPdfJsonController {
                    "Retrieves the font payloads used by a single page from a previously cached PDF document."
                            + " Requires prior call to /pdf/text-editor/metadata. The jobId must belong to the"
                            + " authenticated user. Output:JSON")
-    public ResponseEntity<byte[]> extractPageFonts(
+    public ResponseEntity<Resource> extractPageFonts(
            @PathVariable String jobId, @PathVariable int pageNumber) throws Exception {

-        // Validate job ownership
        validateJobAccess(jobId);

-        byte[] jsonBytes = pdfJsonConversionService.extractPageFonts(jobId, pageNumber);
-        logJsonResponse("pdf/text-editor/fonts/page", jsonBytes);
        String docName = "page_fonts_" + pageNumber + ".json";
-        return WebResponseUtils.bytesToWebResponse(jsonBytes, docName, MediaType.APPLICATION_JSON);
+        TempFile tempOut = tempFileManager.createManagedTempFile(".json");
+        try (OutputStream os = Files.newOutputStream(tempOut.getPath())) {
+            pdfJsonConversionService.extractPageFonts(jobId, pageNumber, os);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
+        try {
+            logJsonResponse("pdf/text-editor/fonts/page", tempOut.getPath());
+            return WebResponseUtils.fileToWebResponse(tempOut, docName, MediaType.APPLICATION_JSON);
+        } catch (Exception e) {
+            tempOut.close();
+            throw e;
+        }
    }

    @AutoJobPostMapping(
@@ -225,35 +275,47 @@ public class ConvertPdfJsonController {
                            + " authenticated user.")
    public ResponseEntity<Void> clearCache(@PathVariable String jobId) {

-        // Validate job ownership
        validateJobAccess(jobId);

        pdfJsonConversionService.clearCachedDocument(jobId);
        return ResponseEntity.ok().build();
    }

-    /**
-     * Get a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param baseJobId the base job identifier
-     * @return scoped job key, or just baseJobId if no ownership service available
-     */
    private String getScopedJobKey(String baseJobId) {
        if (jobOwnershipService != null) {
            return jobOwnershipService.createScopedJobKey(baseJobId);
        }
-        // Security disabled, return unsecured job key
        return baseJobId;
    }

-    private void logJsonResponse(String label, byte[] jsonBytes) {
-        if (jsonBytes == null) {
-            log.warn("Returning {} JSON response: null bytes", label);
+    private void logJsonResponse(String label, Path jsonPath) {
+        if (jsonPath == null) {
+            log.warn("Returning {} JSON response: null path", label);
            return;
        }

-        // Only perform expensive tail extraction if debug logging is enabled
-        if (log.isDebugEnabled()) {
+        boolean debugEnabled = log.isDebugEnabled();
+        boolean dumpEnabled = isPdfJsonDebugDumpEnabled();
+        boolean repeatScanEnabled = isPdfJsonRepeatScanEnabled();
+
+        // Reading the full file back from disk is only worth it for these diagnostic paths.
+        // The happy path (no debug flags) returns here immediately — no extra IO.
+        if (!debugEnabled && !dumpEnabled && !repeatScanEnabled) {
+            return;
+        }
+
+        byte[] jsonBytes;
+        try {
+            jsonBytes = Files.readAllBytes(jsonPath);
+        } catch (IOException ex) {
+            log.warn(
+                    "Failed to read PDF JSON ({}) for diagnostic logging: {}",
+                    label,
+                    ex.getMessage());
+            return;
+        }
+
+        if (debugEnabled) {
            int length = jsonBytes.length;
            boolean endsWithJson =
                    length > 0 && (jsonBytes[length - 1] == '}' || jsonBytes[length - 1] == ']');
@@ -274,24 +336,23 @@ public class ConvertPdfJsonController {
                    tail);
        }

-        if (isPdfJsonDebugDumpEnabled()) {
+        if (dumpEnabled) {
            try {
                String tmpDir = System.getProperty("java.io.tmpdir");
                String customDir = System.getenv("SPDF_PDFJSON_DUMP_DIR");
-                java.nio.file.Path dumpDir =
+                Path dumpDir =
                        customDir != null && !customDir.isBlank()
-                                ? java.nio.file.Path.of(customDir)
-                                : java.nio.file.Path.of(tmpDir);
-                java.nio.file.Path dumpPath =
-                        java.nio.file.Files.createTempFile(dumpDir, "pdfjson_", ".json");
-                java.nio.file.Files.write(dumpPath, jsonBytes);
+                                ? Path.of(customDir)
+                                : Path.of(tmpDir);
+                Path dumpPath = Files.createTempFile(dumpDir, "pdfjson_", ".json");
+                Files.copy(jsonPath, dumpPath, java.nio.file.StandardCopyOption.REPLACE_EXISTING);
                log.debug("PDF JSON debug dump ({}): {}", label, dumpPath);
            } catch (Exception ex) {
                log.warn("Failed to write PDF JSON debug dump ({}): {}", label, ex.getMessage());
            }
        }

-        if (isPdfJsonRepeatScanEnabled()) {
+        if (repeatScanEnabled) {
            logRepeatedJsonStrings(label, jsonBytes);
        }
    }
@@ -431,16 +492,9 @@ public class ConvertPdfJsonController {
        return WHITESPACE_PATTERN.matcher(value.substring(0, max)).replaceAll(" ") + "...";
    }

-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param jobId the job identifier to validate
-     * @throws SecurityException if current user does not own the job
-     */
    private void validateJobAccess(String jobId) {
        if (jobOwnershipService != null) {
            jobOwnershipService.validateJobAccess(jobId);
        }
-        // If jobOwnershipService is null (security disabled), allow all access
    }
 }
@@ -9,6 +9,8 @@ import java.util.Locale;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;

+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -53,7 +55,7 @@ public class ConvertSvgToPDF {
                            + "SVG dimensions (width/height) determine the PDF page size; defaults to A4 if not specified. "
                            + "SVG content is sanitized to prevent XSS attacks. "
                            + "Input: SVG file(s), Output: PDF file(s) or ZIP. Type: MIMO")
-    public ResponseEntity<byte[]> convertSvgToPdf(@ModelAttribute SvgToPdfRequest request) {
+    public ResponseEntity<Resource> convertSvgToPdf(@ModelAttribute SvgToPdfRequest request) {

        MultipartFile[] inputFiles = request.getFileInput();
        boolean combineIntoSinglePdf = Boolean.TRUE.equals(request.getCombineIntoSinglePdf());
@@ -61,8 +63,7 @@ public class ConvertSvgToPDF {
        // Validate input
        if (inputFiles == null || inputFiles.length == 0) {
            log.error("No files provided for SVG to PDF conversion.");
-            return ResponseEntity.badRequest()
-                    .body("No files provided".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(HttpStatus.BAD_REQUEST, "No files provided");
        }

        try {
@@ -94,17 +95,13 @@ public class ConvertSvgToPDF {
                    filenames.add(Filenames.toSimpleFileName(originalFilename));

                } catch (IOException e) {
-                    log.error(
-                            "SVG sanitization/reading failed for {}: {}",
-                            originalFilename,
-                            e.getMessage());
+                    log.error("SVG sanitization/reading failed for {}", originalFilename, e);
                }
            }

            if (sanitizedSvgs.isEmpty()) {
                log.error("No valid SVG files were found");
-                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                        .body("No valid SVG files were found".getBytes(StandardCharsets.UTF_8));
+                return errorResponse(HttpStatus.BAD_REQUEST, "No valid SVG files were found");
            }

            if (combineIntoSinglePdf) {
@@ -115,14 +112,20 @@ public class ConvertSvgToPDF {

        } catch (Exception e) {
            log.error("Unexpected error during SVG to PDF conversion", e);
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body(
-                            "An unexpected error occurred during conversion"
-                                    .getBytes(StandardCharsets.UTF_8));
+            return errorResponse(
+                    HttpStatus.INTERNAL_SERVER_ERROR,
+                    "An unexpected error occurred during conversion");
        }
    }

-    private ResponseEntity<byte[]> handleCombinedConversion(
+    private ResponseEntity<Resource> errorResponse(HttpStatus status, String message) {
+        byte[] body = message.getBytes(StandardCharsets.UTF_8);
+        return ResponseEntity.status(status)
+                .contentLength(body.length)
+                .body(new ByteArrayResource(body));
+    }
+
+    private ResponseEntity<Resource> handleCombinedConversion(
            List<byte[]> sanitizedSvgs, List<String> filenames) {
        try {
            log.info("Combining {} SVG files into single PDF", sanitizedSvgs.size());
@@ -131,10 +134,8 @@ public class ConvertSvgToPDF {

            if (pdfBytes == null || pdfBytes.length == 0) {
                log.error("PDF conversion failed - empty output");
-                return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                        .body(
-                                "PDF conversion failed - empty output"
-                                        .getBytes(StandardCharsets.UTF_8));
+                return errorResponse(
+                        HttpStatus.INTERNAL_SERVER_ERROR, "PDF conversion failed - empty output");
            }

            pdfBytes = pdfDocumentFactory.createNewBytesBasedOnOldDocument(pdfBytes);
@@ -146,19 +147,23 @@ public class ConvertSvgToPDF {

            log.info("Successfully combined {} SVGs into single PDF", sanitizedSvgs.size());

-            return WebResponseUtils.bytesToWebResponse(
-                    pdfBytes, outputFilename, MediaType.APPLICATION_PDF);
+            TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+            try {
+                Files.write(tempOut.getPath(), pdfBytes);
+            } catch (Exception e) {
+                tempOut.close();
+                throw e;
+            }
+            return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);

        } catch (IOException e) {
            log.error("Error combining SVGs into PDF", e);
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body(
-                            ("Conversion failed: " + e.getMessage())
-                                    .getBytes(StandardCharsets.UTF_8));
+            return errorResponse(
+                    HttpStatus.INTERNAL_SERVER_ERROR, "Conversion failed: " + e.getMessage());
        }
    }

-    private ResponseEntity<byte[]> handleSeparateConversion(
+    private ResponseEntity<Resource> handleSeparateConversion(
            List<byte[]> sanitizedSvgs, List<String> filenames) {
        List<ConvertedPdf> convertedPdfs = new ArrayList<>();

@@ -188,15 +193,21 @@ public class ConvertSvgToPDF {

        if (convertedPdfs.isEmpty()) {
            log.error("No files were successfully converted");
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body("No files were successfully converted".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(
+                    HttpStatus.INTERNAL_SERVER_ERROR, "No files were successfully converted");
        }

        try {
            if (convertedPdfs.size() == 1) {
                ConvertedPdf pdf = convertedPdfs.get(0);
-                return WebResponseUtils.bytesToWebResponse(
-                        pdf.content, pdf.filename, MediaType.APPLICATION_PDF);
+                TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+                try {
+                    Files.write(tempOut.getPath(), pdf.content);
+                } catch (Exception e) {
+                    tempOut.close();
+                    throw e;
+                }
+                return WebResponseUtils.pdfFileToWebResponse(tempOut, pdf.filename);
            }

            String zipFilename =
@@ -204,22 +215,18 @@ public class ConvertSvgToPDF {
                            ? "converted_svgs.zip"
                            : GeneralUtils.generateFilename(
                                    filenames.get(0), "_converted_svgs.zip");
-            byte[] zipBytes = createZipFromPdfs(convertedPdfs);
-
-            return WebResponseUtils.bytesToWebResponse(
-                    zipBytes, zipFilename, MediaType.APPLICATION_OCTET_STREAM);
+            TempFile zipFile = createZipFromPdfs(convertedPdfs);
+            return WebResponseUtils.zipFileToWebResponse(zipFile, zipFilename);
        } catch (IOException e) {
            log.error("Failed to create response", e);
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body("Failed to create response".getBytes(StandardCharsets.UTF_8));
+            return errorResponse(HttpStatus.INTERNAL_SERVER_ERROR, "Failed to create response");
        }
    }

-    private byte[] createZipFromPdfs(List<ConvertedPdf> pdfs) throws IOException {
-        try (TempFile tempZipFile = new TempFile(tempFileManager, ".zip");
-                ZipOutputStream zipOut =
-                        new ZipOutputStream(Files.newOutputStream(tempZipFile.getPath()))) {
-
+    private TempFile createZipFromPdfs(List<ConvertedPdf> pdfs) throws IOException {
+        TempFile tempZipFile = tempFileManager.createManagedTempFile(".zip");
+        try (ZipOutputStream zipOut =
+                new ZipOutputStream(Files.newOutputStream(tempZipFile.getPath()))) {
            for (ConvertedPdf pdf : pdfs) {
                ZipEntry pdfEntry = new ZipEntry(pdf.filename);
                zipOut.putNextEntry(pdfEntry);
@@ -227,9 +234,11 @@ public class ConvertSvgToPDF {
                zipOut.closeEntry();
                log.debug("Added {} to ZIP", pdf.filename);
            }
-
-            return Files.readAllBytes(tempZipFile.getPath());
+        } catch (IOException e) {
+            tempZipFile.close();
+            throw e;
        }
+        return tempZipFile;
    }

    private static class ConvertedPdf {
@@ -1,6 +1,5 @@
 package stirling.software.SPDF.controller.api.converters;

-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.net.URI;
 import java.net.http.HttpClient;
@@ -39,6 +38,8 @@ import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.RegexPatternUtils;
+import stirling.software.common.util.TempFile;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@ConvertApi
@@ -49,6 +50,7 @@ public class ConvertWebsiteToPDF {
    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final RuntimePathConfig runtimePathConfig;
    private final ApplicationProperties applicationProperties;
+    private final TempFileManager tempFileManager;

    private static final Pattern FILE_SCHEME_PATTERN =
            Pattern.compile("(?<![a-z0-9_])file\\s*:(?:/{1,3}|%2f|%5c|%3a|&#x2f;|&#47;)");
@@ -136,14 +138,15 @@ public class ConvertWebsiteToPDF {
                    .runCommandWithOutputHandling(command);

            // Load the PDF using pdfDocumentFactory
-            try (PDDocument doc = pdfDocumentFactory.load(tempOutputFile.toFile());
-                    ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
-                // Convert URL to a safe filename
-                String outputFilename = convertURLToFileName(URL);
-
-                doc.save(baos);
-                return WebResponseUtils.baosToWebResponse(baos, outputFilename);
+            String outputFilename = convertURLToFileName(URL);
+            TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
+            try (PDDocument doc = pdfDocumentFactory.load(tempOutputFile.toFile())) {
+                doc.save(tempOut.getFile());
+            } catch (Exception e) {
+                tempOut.close();
+                throw e;
            }
+            return WebResponseUtils.pdfFileToWebResponse(tempOut, outputFilename);
        } finally {
            if (tempHtmlInput != null) {
                try {
@@ -1,7 +1,6 @@
 package stirling.software.SPDF.controller.api.converters;

 import java.io.ByteArrayOutputStream;
-import java.io.IOException;
 import java.io.StringWriter;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
@@ -32,6 +31,7 @@ import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.annotations.api.ConvertApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.GeneralUtils;
+import stirling.software.common.util.WebResponseUtils;

 import technology.tabula.ObjectExtractor;
 import technology.tabula.Page;
@@ -90,7 +90,7 @@ public class ExtractCSVController {
    }

    private ResponseEntity<byte[]> createZipResponse(List<CsvEntry> entries, String baseName)
-            throws IOException {
+            throws Exception {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        try (ZipOutputStream zipOut = new ZipOutputStream(baos)) {
            for (CsvEntry entry : entries) {
@@ -101,14 +101,10 @@ public class ExtractCSVController {
            }
        }

-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentDisposition(
-                ContentDisposition.builder("attachment")
-                        .filename(baseName + "_extracted.zip")
-                        .build());
-        headers.setContentType(MediaType.parseMediaType("application/zip"));
-
-        return ResponseEntity.ok().headers(headers).body(baos.toByteArray());
+        return WebResponseUtils.bytesToWebResponse(
+                baos.toByteArray(),
+                baseName + "_extracted.zip",
+                MediaType.APPLICATION_OCTET_STREAM);
    }

    private ResponseEntity<String> createCsvResponse(CsvEntry entry, String baseName) {
@@ -10,6 +10,7 @@ import java.util.Locale;
 import java.util.Set;

 import org.apache.commons.io.FilenameUtils;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -38,7 +39,6 @@ import stirling.software.common.util.WebResponseUtils;
@RequiredArgsConstructor
 public class PdfVectorExportController {

-    private static final MediaType PDF_MEDIA_TYPE = MediaType.APPLICATION_PDF;
    private static final Set<String> GHOSTSCRIPT_INPUTS =
            Set.of("ps", "eps", "epsf"); // PCL/PXL/XPS require GhostPDL (gpcl6/gxps)

@@ -51,7 +51,7 @@ public class PdfVectorExportController {
            description =
                    "Converts PostScript vector inputs (PS, EPS, EPSF) to PDF using Ghostscript."
                            + " Input:PS/EPS Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> convertGhostscriptInputsToPdf(
+    public ResponseEntity<Resource> convertGhostscriptInputsToPdf(
            @Valid @ModelAttribute PdfVectorExportRequest request) throws Exception {

        String originalName =
@@ -63,9 +63,9 @@ public class PdfVectorExportController {
                        ? FilenameUtils.getExtension(originalName).toLowerCase(Locale.ROOT)
                        : "";

+        TempFile outputTemp = tempFileManager.createManagedTempFile(".pdf");
        try (TempFile inputTemp =
-                        new TempFile(tempFileManager, extension.isEmpty() ? "" : "." + extension);
-                TempFile outputTemp = new TempFile(tempFileManager, ".pdf")) {
+                new TempFile(tempFileManager, extension.isEmpty() ? "" : "." + extension)) {

            request.getFileInput().transferTo(inputTemp.getFile());

@@ -83,11 +83,13 @@ public class PdfVectorExportController {
                        "Unsupported Ghostscript input format {0}",
                        extension);
            }
-
-            byte[] pdfBytes = Files.readAllBytes(outputTemp.getPath());
-            String outputName = GeneralUtils.generateFilename(originalName, "_converted.pdf");
-            return WebResponseUtils.bytesToWebResponse(pdfBytes, outputName, PDF_MEDIA_TYPE);
+        } catch (Exception e) {
+            outputTemp.close();
+            throw e;
        }
+
+        String outputName = GeneralUtils.generateFilename(originalName, "_converted.pdf");
+        return WebResponseUtils.pdfFileToWebResponse(outputTemp, outputName);
    }

    @AutoJobPostMapping(consumes = MediaType.MULTIPART_FORM_DATA_VALUE, value = "/pdf/vector")
@@ -96,7 +98,7 @@ public class PdfVectorExportController {
            description =
                    "Converts PDF to Ghostscript vector formats (EPS, PS, PCL, or XPS)."
                            + " Input:PDF Output:VECTOR Type:SISO")
-    public ResponseEntity<byte[]> convertPdfToVector(
+    public ResponseEntity<Resource> convertPdfToVector(
            @Valid @ModelAttribute PdfVectorExportRequest request) throws Exception {

        String originalName =
@@ -110,35 +112,37 @@ public class PdfVectorExportController {
        }
        outputFormat = outputFormat.toLowerCase(Locale.ROOT);

-        try (TempFile inputTemp = new TempFile(tempFileManager, ".pdf");
-                TempFile outputTemp = new TempFile(tempFileManager, "." + outputFormat)) {
+        TempFile outputTemp = tempFileManager.createManagedTempFile("." + outputFormat);
+        try (TempFile inputTemp = new TempFile(tempFileManager, ".pdf")) {

            request.getFileInput().transferTo(inputTemp.getFile());

            runGhostscriptPdfToVector(inputTemp.getPath(), outputTemp.getPath(), outputFormat);
-
-            byte[] vectorBytes = Files.readAllBytes(outputTemp.getPath());
-            String outputName =
-                    GeneralUtils.generateFilename(originalName, "_converted." + outputFormat);
-
-            MediaType mediaType;
-            switch (outputFormat.toLowerCase(Locale.ROOT)) {
-                case "eps":
-                case "ps":
-                    mediaType = MediaType.parseMediaType("application/postscript");
-                    break;
-                case "pcl":
-                    mediaType = MediaType.parseMediaType("application/vnd.hp-PCL");
-                    break;
-                case "xps":
-                    mediaType = MediaType.parseMediaType("application/vnd.ms-xpsdocument");
-                    break;
-                default:
-                    mediaType = MediaType.APPLICATION_OCTET_STREAM;
-            }
-
-            return WebResponseUtils.bytesToWebResponse(vectorBytes, outputName, mediaType);
+        } catch (Exception e) {
+            outputTemp.close();
+            throw e;
        }
+
+        String outputName =
+                GeneralUtils.generateFilename(originalName, "_converted." + outputFormat);
+
+        MediaType mediaType;
+        switch (outputFormat.toLowerCase(Locale.ROOT)) {
+            case "eps":
+            case "ps":
+                mediaType = MediaType.parseMediaType("application/postscript");
+                break;
+            case "pcl":
+                mediaType = MediaType.parseMediaType("application/vnd.hp-PCL");
+                break;
+            case "xps":
+                mediaType = MediaType.parseMediaType("application/vnd.ms-xpsdocument");
+                break;
+            default:
+                mediaType = MediaType.APPLICATION_OCTET_STREAM;
+        }
+
+        return WebResponseUtils.fileToWebResponse(outputTemp, outputName, mediaType);
    }

    private void runGhostscriptPdfToVector(Path inputPath, Path outputPath, String outputFormat)
@@ -5,6 +5,7 @@ import java.io.IOException;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -29,6 +30,7 @@ import stirling.software.common.annotations.api.FilterApi;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.PdfUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

@FilterApi
@@ -36,6 +38,7 @@ import stirling.software.common.util.WebResponseUtils;
 public class FilterController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;

    @AutoJobPostMapping(
            consumes = MediaType.MULTIPART_FORM_DATA_VALUE,
@@ -53,7 +56,7 @@ public class FilterController {
                description = "PDF did not pass filter",
                content = @Content())
    })
-    public ResponseEntity<byte[]> containsText(@ModelAttribute ContainsTextRequest request)
+    public ResponseEntity<Resource> containsText(@ModelAttribute ContainsTextRequest request)
            throws IOException, InterruptedException {
        MultipartFile inputFile = request.getFileInput();
        String text = request.getText();
@@ -62,7 +65,9 @@ public class FilterController {
        try (PDDocument pdfDocument = pdfDocumentFactory.load(inputFile)) {
            if (PdfUtils.hasText(pdfDocument, pageNumber, text)) {
                return WebResponseUtils.pdfDocToWebResponse(
-                        pdfDocument, Filenames.toSimpleFileName(inputFile.getOriginalFilename()));
+                        pdfDocument,
+                        Filenames.toSimpleFileName(inputFile.getOriginalFilename()),
+                        tempFileManager);
            }
        }
        return ResponseEntity.noContent().build();
@@ -84,7 +89,7 @@ public class FilterController {
                description = "PDF did not pass filter",
                content = @Content())
    })
-    public ResponseEntity<byte[]> containsImage(@ModelAttribute PDFWithPageNums request)
+    public ResponseEntity<Resource> containsImage(@ModelAttribute PDFWithPageNums request)
            throws IOException, InterruptedException {
        MultipartFile inputFile = request.getFileInput();
        String pageNumber = request.getPageNumbers();
@@ -92,7 +97,9 @@ public class FilterController {
        try (PDDocument pdfDocument = pdfDocumentFactory.load(inputFile)) {
            if (PdfUtils.hasImages(pdfDocument, pageNumber)) {
                return WebResponseUtils.pdfDocToWebResponse(
-                        pdfDocument, Filenames.toSimpleFileName(inputFile.getOriginalFilename()));
+                        pdfDocument,
+                        Filenames.toSimpleFileName(inputFile.getOriginalFilename()),
+                        tempFileManager);
            }
        }
        return ResponseEntity.noContent().build();
@@ -10,6 +10,7 @@ import java.util.Map;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.poi.ss.usermodel.*;
 import org.apache.poi.xssf.usermodel.XSSFWorkbook;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -34,6 +35,7 @@ import stirling.software.common.model.FormFieldWithCoordinates;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.FormUtils;
+import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;

 import tools.jackson.core.type.TypeReference;
@@ -59,12 +61,11 @@ public class FormFillController {

    private final CustomPDFDocumentFactory pdfDocumentFactory;
    private final ObjectMapper objectMapper;
+    private final TempFileManager tempFileManager;

-    private static ResponseEntity<byte[]> saveDocument(PDDocument document, String baseName)
+    private ResponseEntity<Resource> saveDocument(PDDocument document, String baseName)
            throws IOException {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        document.save(baos);
-        return WebResponseUtils.bytesToWebResponse(baos.toByteArray(), baseName + ".pdf");
+        return WebResponseUtils.pdfDocToWebResponse(document, baseName + ".pdf", tempFileManager);
    }

    private static String buildBaseName(MultipartFile file, String suffix) {
@@ -261,7 +262,7 @@ public class FormFillController {
            summary = "Modify existing form fields",
            description =
                    "Updates existing fields in the provided PDF and returns the updated file")
-    public ResponseEntity<byte[]> modifyFields(
+    public ResponseEntity<Resource> modifyFields(
            @Parameter(
                            description = "The input PDF file",
                            required = true,
@@ -292,7 +293,7 @@ public class FormFillController {
    @Operation(
            summary = "Delete form fields",
            description = "Removes the specified fields from the PDF and returns the updated file")
-    public ResponseEntity<byte[]> deleteFields(
+    public ResponseEntity<Resource> deleteFields(
            @Parameter(
                            description = "The input PDF file",
                            required = true,
@@ -328,7 +329,7 @@ public class FormFillController {
            description =
                    "Populates the supplied PDF form using values from the provided JSON payload"
                            + " and returns the filled PDF")
-    public ResponseEntity<byte[]> fillForm(
+    public ResponseEntity<Resource> fillForm(
            @Parameter(
                            description = "The input PDF file",
                            required = true,
@@ -355,7 +356,7 @@ public class FormFillController {
                document -> FormUtils.applyFieldValues(document, values, flatten, true));
    }

-    private ResponseEntity<byte[]> processSingleFile(
+    private ResponseEntity<Resource> processSingleFile(
            MultipartFile file, String suffix, DocumentProcessor processor) throws IOException {
        requirePdf(file);

--- a/Show More
+++ b/Show More