extra validations

codex/re-enable-tool-disabling-functionality

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -306,10 +306,8 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
               environment:
-                DISABLE_ADDITIONAL_FEATURES: "false"
-                SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
+                DISABLE_ADDITIONAL_FEATURES: "true"
+                SECURITY_ENABLELOGIN: "false"
                 SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Frontend/Backend Split Architecture"

.github/workflows/multiOSReleases.yml

@@ -1,4 +1,4 @@
-name: Multi-OS Tauri Releases
+name: Test Installers Build
 
 on:
   workflow_dispatch:
@@ -6,23 +6,7 @@ on:
       test_mode:
         description: "Run in test mode (skip release step)"
         required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo, V2-master]
+        default: "false"
   release:
     types: [created]
 
@@ -30,89 +14,60 @@ permissions:
   contents: read
 
 jobs:
-  determine-matrix:
+  read_versions:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
+      versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
+          distribution: 'temurin'
+          java-version: '21'
 
+      # ✅ Get version from Gradle
       - name: Get version number
         id: versionNumber
         run: |
-          echo "Running gradlew printVersion..."
-          ./gradlew printVersion --quiet
           VERSION=$(./gradlew printVersion --quiet | tail -1)
-          echo "Extracted version: $VERSION"
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      # ✅ Get Mac-specific version from Gradle
+      - name: Get version number mac
+        id: versionNumberMac
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          VERSION_MAC=$(./gradlew printMacVersion --quiet | tail -1)
+          echo "versionNumberMac=$VERSION_MAC" >> $GITHUB_OUTPUT
 
-  build-jars:
-    needs: determine-matrix
+  build-portable:
+    needs: read_versions
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        variant:
-          - name: "default"
-            disable_security: true
-            build_frontend: true
-            file_suffix: ""
-          - name: "with-login"
-            disable_security: false
-            build_frontend: true
+        disable_security: [true, false]
+        include:
+          - disable_security: false
             file_suffix: "-with-login"
-          - name: "server-only"
-            disable_security: true
-            build_frontend: false
-            file_suffix: "-server"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           java-version: "21"
           distribution: "temurin"
@@ -121,409 +76,226 @@ jobs:
         with:
           gradle-version: 8.14
 
-      - name: Setup Node.js
-        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Build JAR
-        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
         env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Rename JAR
+      - name: Rename binaries
         run: |
-          echo "Version from determine-matrix: ${{ needs.determine-matrix.outputs.version }}"
-          echo "Looking for: app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar"
-          ls -la app/core/build/libs/
-          mkdir -p ./jar-dist
-          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
-
-      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: jar${{ matrix.variant.file_suffix }}
-          path: ./jar-dist/*.jar
-          retention-days: 1
-
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on release or V2-master
-          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
+          mkdir ./binaries
+          mv ./build/launch4j/Stirling-PDF.exe ./binaries/win-Stirling-PDF-portable-Server${{ matrix.file_suffix }}.exe
+          mv ./app/core/build/libs/stirling-pdf-${{ needs.read_versions.outputs.version }}.jar ./binaries/Stirling-PDF${{ matrix.file_suffix }}.jar
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
           retention-days: 1
+          if-no-files-found: error
+          name: stirling${{ matrix.file_suffix }}-binaries
+          path: |
+            ./binaries/*
+
+  sign_verify-portable:
+    needs: [build-portable, read_versions]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "with-login-"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: stirling-${{ matrix.file_suffix }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: stirling-${{ matrix.file_suffix }}signed
+          path: |
+            ./*
+            !cosign.*
+
+  build-installers:
+    needs: read_versions
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      # Install Windows dependencies
+      - name: Install WiX Toolset
+        if: matrix.os == 'windows-latest'
+        run: |
+          curl -L -o wix.exe https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314.exe
+          .\wix.exe /install /quiet
+
+      # Build installer
+      - name: Build Installer
+        run: ./gradlew build jpackage -x test --info
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: true
+          BROWSER_OPEN: true
+
+      - name: Set up JDK (x86_64)
+        if: matrix.os == 'macos-latest'
+        run: |
+          curl -L -o jdk.tar.gz https://cdn.azul.com/zulu/bin/zulu17.56.15-ca-jdk17.0.14-macosx_x64.tar.gz
+          mkdir -p zulu17
+          tar -xzf jdk.tar.gz -C zulu17 --strip-components=1
+          echo "JAVA_HOME=$PWD/zulu17" >> $GITHUB_ENV
+          echo "$PWD/zulu17/bin" >> $GITHUB_PATH
+
+      -   name: Verify JDK architecture
+          if: matrix.os == 'macos-latest'
+          run: file $JAVA_HOME/bin/java
+
+      -   name: Build project and run jpackage (x86_64)
+          if: matrix.os == 'macos-latest'
+          run: arch -x86_64 ./gradlew jpackageMacX64
+
+      # Rename and collect artifacts based on OS
+      - name: Prepare artifacts
+        id: prepare
+        shell: bash
+        run: |
+          ls -lah ./build/jpackage/
+          mkdir ./binaries
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.version }}.exe" "./binaries/Stirling-PDF-win-installer.exe"
+          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-installer.dmg"
+            mv "./build/jpackage/x86_64/Stirling PDF (x86_64)-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-x86_64-installer.dmg"
+          else
+            mv "./build/jpackage/stirling-pdf_${{ needs.read_versions.outputs.version }}-1_amd64.deb" "./binaries/Stirling-PDF-linux-installer.deb"
+          fi
+
+      - name: Display structure of downloaded files
+        run: ls -R ./binaries
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}binaries
+          path: |
+            ./binaries/*
+
+  sign_verify:
+    needs: [read_versions, build-installers]
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: ${{ matrix.platform }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        if: matrix.os == 'windows-latest'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+
+      - name: Generate key pair
+        if: matrix.os == 'windows-latest'
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        if: matrix.os == 'windows-latest'
+        run: |
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./Stirling-PDF-win-installer.exe.intoto.jsonl \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}signed
+          path: |
+            ./Stirling-PDF-${{ matrix.platform }}installer.*
+            ./Stirling-PDF-${{ matrix.platform }}x86_64-installer.*
+            !cosign.*
 
   create-release:
-    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-    needs: [determine-matrix, build, build-jars]
+    if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_mode != 'true'
+    needs: [read_versions, sign_verify, sign_verify-portable]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -533,43 +305,14 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Download all Tauri artifacts
+      - name: Download signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          pattern: Stirling-PDF-*
-          path: ./artifacts/tauri
-
-      - name: Download JAR artifact (default)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (with login)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar-with-login
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (server only)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar-server
-          path: ./artifacts/jars
-
       - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Upload binaries to Release
+        run: ls -R
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.read_versions.outputs.version }}
           generate_release_notes: true
           files: |
-            ./artifacts/**/*.jar
-            ./artifacts/**/*.msi
-            ./artifacts/**/*.dmg
-            ./artifacts/**/*.deb
-            ./artifacts/**/*.AppImage
-          draft: false
-          prerelease: false
+            ./*signed/*

.github/workflows/push-docker-v2.yml

@@ -1,244 +0,0 @@
-name: Push Docker Image - V2 Branch
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - V2-master
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  push:
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-
-      - name: Get version number
-        id: versionNumber
-        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for latest (V2-master branch - production)
-        id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Generate tags for latest (V2-demo branch - test)
-        id: meta-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/Dockerfile.unified
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign regular images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --yes \
-              --key env://COSIGN_PRIVATE_KEY \
-              "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for latest-fat (V2-master branch - production)
-        id: meta-fat
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Generate tags for latest-fat (V2-demo branch - test)
-        id: meta-fat-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Build and push Unified Dockerfile (fat variant)
-        id: build-push-fat
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/Dockerfile.unified
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign fat images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite (V2-master branch - production)
-        id: meta-lite
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Generate tags for ultra-lite (V2-demo branch - test)
-        id: meta-lite-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/Dockerfile.unified-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done

.github/workflows/releaseArtifacts.yml

@@ -2,445 +2,85 @@ name: Release Artifacts
 
 on:
   workflow_dispatch:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo]
+  release:
+    types: [created]
 
 permissions:
   contents: read
 
 jobs:
-  determine-matrix:
+  build:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
+
       - name: Get version number
         id: versionNumber
         run: |
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      - name: Rename binaries
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
+      - name: Debug build artifacts
         run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
+          echo "Current Directory: $(pwd)"
+          ls -R ./build/libs
+          ls -R ./build/launch4j
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
-          retention-days: 30
+          name: binaries${{ matrix.file_suffix }}
+          path: |
+            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
 
   sign_verify:
     needs: build
     runs-on: ubuntu-latest
-    if: success()
     strategy:
-      fail-fast: false
       matrix:
-        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -450,8 +90,7 @@ jobs:
       - name: Download build artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-
+          name: binaries${{ matrix.file_suffix }}
       - name: Display structure of downloaded files
         run: ls -R
 
@@ -462,74 +101,80 @@ jobs:
         run: cosign generate-key-pair
 
       - name: Sign and generate attestations
-        shell: bash
         run: |
-          # Sign all artifacts for this platform
-          for file in *; do
-            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
-              echo "Signing: $file"
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Sign the artifact
-              cosign sign-blob \
-                --key ./cosign.key \
-                --yes \
-                --output-signature "${file}.sig" \
-                "$file"
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Generate attestation
-              cosign attest-blob \
-                --predicate - \
-                --key ./cosign.key \
-                --yes \
-                --output-attestation "${file}.intoto.jsonl" \
-                "$file"
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Verify the signature
-              cosign verify-blob \
-                --key ./cosign.pub \
-                --signature "${file}.sig" \
-                "$file"
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
 
-              echo "✅ Signed and verified: $file"
-            fi
-          done
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
 
       - name: Upload signed artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}-signed
+          name: signed${{ matrix.file_suffix }}
           path: |
-            *
-            !cosign.key
-            !cosign.pub
-          retention-days: 30
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
 
   release:
-    needs: [determine-matrix, build, sign_verify]
+    needs: [build, sign_verify]
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     permissions:
       contents: write
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download all signed artifacts
+      - name: Download signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          pattern: Stirling-PDF-*-signed
-          path: ./artifacts
+          name: signed${{ matrix.file_suffix }}
 
-      - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Create GitHub Release
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.build.outputs.version }}
           generate_release_notes: true
-          files: ./artifacts/**/*
-          draft: false
-          prerelease: false
+          files: |
+            ./libs/Stirling-PDF*
+            ./launch4j/Stirling-PDF-Server*

.github/workflows/tauri-build.yml

@@ -92,6 +92,8 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
+
+
       - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
@@ -178,7 +180,7 @@ jobs:
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         uses: digicert/ssm-code-signing@v1.1.0
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -188,7 +190,7 @@ jobs:
           SM_HOST: ${{ secrets.SM_HOST }}
 
       - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         shell: pwsh
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
@@ -223,7 +225,7 @@ jobs:
 
       # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
       - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' }}
         env:
           WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
           WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -310,10 +312,7 @@ jobs:
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          SIGN: ${{ (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true
         with:
           projectPath: ./frontend
@@ -322,7 +321,7 @@ jobs:
 
       # Sign with DigiCert KeyLocker (post-build)
       - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         shell: pwsh
         run: |
           Write-Host "=== DigiCert KeyLocker Signing ==="
@@ -513,7 +512,7 @@ jobs:
           fi
 
       - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'windows-latest'
         shell: pwsh
         run: |
           Write-Host "Verifying Windows code signatures..."

.gitignore

@@ -17,8 +17,8 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/
-!pipeline/.gitkeep
+pipeline/watchedFolders/
+pipeline/finishedFolders/
 customFiles/
 configs/
 watchedFolders/
@@ -31,23 +31,8 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json
 
-# Frontend build artifacts copied to backend static resources
-# These are generated by npm build and should not be committed
-app/core/src/main/resources/static/assets/
-app/core/src/main/resources/static/index.html
-app/core/src/main/resources/static/locales/
-app/core/src/main/resources/static/Login/
-app/core/src/main/resources/static/classic-logo/
-app/core/src/main/resources/static/modern-logo/
-app/core/src/main/resources/static/og_images/
-app/core/src/main/resources/static/samples/
-app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/robots.txt
-# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
-
 # Gradle
 .gradle
-.gradle-home
 .lock
 
 # External tool builders
@@ -228,17 +213,3 @@ node_modules/
 test_batch.json
 *.backup.*.json
 frontend/public/locales/*/translation.backup*.json
-
-# Development/build artifacts
-.gradle-cache/
-scripts/pdf-collection/
-**/tmp/
-*.backup
-
-# Type3 development data
-docs/type3/signatures/
-
-
-# Type3 sample PDFs (development only)
-**/type3/samples/
-

LICENSE

@@ -6,10 +6,6 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "frontend/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
-* All content that resides under the "frontend/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

README.md

@@ -115,46 +115,46 @@ Stirling-PDF currently supports 40 languages!
 
 | Language                                     | Progress                               |
 | -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![87%](https://geps.dev/progress/87)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![86%](https://geps.dev/progress/86)   |
-| Basque (Euskara) (eu_ES)                     | ![86%](https://geps.dev/progress/86)   |
-| Bulgarian (Български) (bg_BG)                | ![86%](https://geps.dev/progress/86)   |
-| Catalan (Català) (ca_CA)                     | ![85%](https://geps.dev/progress/85)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![86%](https://geps.dev/progress/86)   |
-| Czech (Česky) (cs_CZ)                        | ![84%](https://geps.dev/progress/84)   |
-| Danish (Dansk) (da_DK)                       | ![85%](https://geps.dev/progress/85)   |
-| Dutch (Nederlands) (nl_NL)                   | ![85%](https://geps.dev/progress/85)   |
+| Arabic (العربية) (ar_AR)                        | ![94%](https://geps.dev/progress/94)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![93%](https://geps.dev/progress/93)   |
+| Basque (Euskara) (eu_ES)                     | ![93%](https://geps.dev/progress/93)   |
+| Bulgarian (Български) (bg_BG)                | ![94%](https://geps.dev/progress/94)   |
+| Catalan (Català) (ca_CA)                     | ![93%](https://geps.dev/progress/93)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![93%](https://geps.dev/progress/93)   |
+| Czech (Česky) (cs_CZ)                        | ![91%](https://geps.dev/progress/91)   |
+| Danish (Dansk) (da_DK)                       | ![92%](https://geps.dev/progress/92)   |
+| Dutch (Nederlands) (nl_NL)                   | ![93%](https://geps.dev/progress/93)   |
 | English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
 | English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![85%](https://geps.dev/progress/85)   |
-| German (Deutsch) (de_DE)                     | ![86%](https://geps.dev/progress/86)   |
-| Greek (Ελληνικά) (el_GR)                     | ![86%](https://geps.dev/progress/86)   |
-| Hindi (हिंदी) (hi_IN)                          | ![86%](https://geps.dev/progress/86)   |
-| Hungarian (Magyar) (hu_HU)                   | ![86%](https://geps.dev/progress/86)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![85%](https://geps.dev/progress/85)   |
-| Irish (Gaeilge) (ga_IE)                      | ![86%](https://geps.dev/progress/86)   |
-| Italian (Italiano) (it_IT)                   | ![85%](https://geps.dev/progress/85)   |
-| Japanese (日本語) (ja_JP)                    | ![86%](https://geps.dev/progress/86)   |
-| Korean (한국어) (ko_KR)                      | ![86%](https://geps.dev/progress/86)   |
-| Norwegian (Norsk) (no_NB)                    | ![86%](https://geps.dev/progress/86)   |
-| Persian (فارسی) (fa_IR)                      | ![86%](https://geps.dev/progress/86)   |
-| Polish (Polski) (pl_PL)                      | ![86%](https://geps.dev/progress/86)   |
-| Portuguese (Português) (pt_PT)               | ![86%](https://geps.dev/progress/86)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![86%](https://geps.dev/progress/86)   |
-| Romanian (Română) (ro_RO)                    | ![85%](https://geps.dev/progress/85)   |
-| Russian (Русский) (ru_RU)                    | ![86%](https://geps.dev/progress/86)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![86%](https://geps.dev/progress/86)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![87%](https://geps.dev/progress/87)   |
-| Slovakian (Slovensky) (sk_SK)                | ![86%](https://geps.dev/progress/86)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![86%](https://geps.dev/progress/86)   |
-| Spanish (Español) (es_ES)                    | ![86%](https://geps.dev/progress/86)   |
-| Swedish (Svenska) (sv_SE)                    | ![86%](https://geps.dev/progress/86)   |
-| Thai (ไทย) (th_TH)                           | ![86%](https://geps.dev/progress/86)   |
+| French (Français) (fr_FR)                    | ![93%](https://geps.dev/progress/93)   |
+| German (Deutsch) (de_DE)                     | ![93%](https://geps.dev/progress/93)   |
+| Greek (Ελληνικά) (el_GR)                     | ![93%](https://geps.dev/progress/93)   |
+| Hindi (हिंदी) (hi_IN)                          | ![94%](https://geps.dev/progress/94)   |
+| Hungarian (Magyar) (hu_HU)                   | ![94%](https://geps.dev/progress/94)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![93%](https://geps.dev/progress/93)   |
+| Irish (Gaeilge) (ga_IE)                      | ![94%](https://geps.dev/progress/94)   |
+| Italian (Italiano) (it_IT)                   | ![93%](https://geps.dev/progress/93)   |
+| Japanese (日本語) (ja_JP)                    | ![94%](https://geps.dev/progress/94)   |
+| Korean (한국어) (ko_KR)                      | ![94%](https://geps.dev/progress/94)   |
+| Norwegian (Norsk) (no_NB)                    | ![93%](https://geps.dev/progress/93)   |
+| Persian (فارسی) (fa_IR)                      | ![94%](https://geps.dev/progress/94)   |
+| Polish (Polski) (pl_PL)                      | ![93%](https://geps.dev/progress/93)   |
+| Portuguese (Português) (pt_PT)               | ![93%](https://geps.dev/progress/93)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![93%](https://geps.dev/progress/93)   |
+| Romanian (Română) (ro_RO)                    | ![93%](https://geps.dev/progress/93)   |
+| Russian (Русский) (ru_RU)                    | ![94%](https://geps.dev/progress/94)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![93%](https://geps.dev/progress/93)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![94%](https://geps.dev/progress/94)   |
+| Slovakian (Slovensky) (sk_SK)                | ![93%](https://geps.dev/progress/93)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![94%](https://geps.dev/progress/94)   |
+| Spanish (Español) (es_ES)                    | ![94%](https://geps.dev/progress/94)   |
+| Swedish (Svenska) (sv_SE)                    | ![93%](https://geps.dev/progress/93)   |
+| Thai (ไทย) (th_TH)                           | ![93%](https://geps.dev/progress/93)   |
 | Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![87%](https://geps.dev/progress/87)   |
-| Turkish (Türkçe) (tr_TR)                     | ![86%](https://geps.dev/progress/86)   |
-| Ukrainian (Українська) (uk_UA)               | ![86%](https://geps.dev/progress/86)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![86%](https://geps.dev/progress/86)   |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![94%](https://geps.dev/progress/94)   |
+| Turkish (Türkçe) (tr_TR)                     | ![94%](https://geps.dev/progress/94)   |
+| Ukrainian (Українська) (uk_UA)               | ![94%](https://geps.dev/progress/94)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![93%](https://geps.dev/progress/93)   |
 | Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
 
 ## Stirling PDF Enterprise

app/common/build.gradle

@@ -33,16 +33,14 @@ dependencies {
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20240325.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
-    api 'org.apache.commons:commons-lang3:3.17.0'
+    api 'org.apache.commons:commons-lang3:3.19.0'
     api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
-    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
-    api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.7' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.5' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:2.10'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.14"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.13"
     api 'jakarta.mail:jakarta.mail-api:2.1.5'
     runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
 }

app/common/src/main/java/stirling/software/common/model/api/security/AddParticipantsRequest.java

@@ -1,14 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.util.List;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class AddParticipantsRequest {
-    private List<Long> participantUserIds;
-}

app/common/src/main/java/stirling/software/common/model/api/security/CreateSigningSessionRequest.java

@@ -1,48 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.util.List;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-import lombok.EqualsAndHashCode;
-
-import stirling.software.common.model.api.PDFFile;
-
-@Data
-@EqualsAndHashCode(callSuper = true)
-public class CreateSigningSessionRequest extends PDFFile {
-
-    @Schema(description = "Owner email used for activity updates")
-    private String ownerEmail;
-
-    @Schema(
-            description = "User IDs of participants to invite for signing",
-            requiredMode = Schema.RequiredMode.REQUIRED)
-    private List<Long> participantUserIds;
-
-    @Schema(description = "Optional message included in notifications")
-    private String message;
-
-    @Schema(description = "Optional due date for reminders (ISO-8601 date)")
-    private String dueDate;
-
-    @Schema(description = "Whether to send notifications immediately")
-    private Boolean notifyOnCreate;
-
-    // Signature appearance settings (owner-controlled, applied to all participants)
-    @Schema(description = "Whether to show visible signature")
-    private Boolean showSignature;
-
-    @Schema(description = "Page number for signature (1-indexed)")
-    private Integer pageNumber;
-
-    @Schema(description = "Signature reason")
-    private String reason;
-
-    @Schema(description = "Signature location")
-    private String location;
-
-    @Schema(description = "Whether to show Stirling PDF logo in signature")
-    private Boolean showLogo;
-}

app/common/src/main/java/stirling/software/common/model/api/security/NotifySigningParticipantsRequest.java

@@ -1,17 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.util.List;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-
-@Data
-public class NotifySigningParticipantsRequest {
-
-    @Schema(description = "Participants to notify; defaults to all if omitted")
-    private List<String> participantEmails;
-
-    @Schema(description = "Notification message to deliver")
-    private String message;
-}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantCertificateRequest.java

@@ -1,50 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import org.springframework.web.multipart.MultipartFile;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-
-@Data
-public class ParticipantCertificateRequest {
-
-    @Schema(
-            description = "Certificate type for the participant",
-            allowableValues = {"PEM", "PKCS12", "PFX", "JKS", "SERVER"},
-            requiredMode = Schema.RequiredMode.REQUIRED)
-    private String certType;
-
-    @Schema(description = "Password for keystore or private key", format = "password")
-    private String password;
-
-    @Schema(description = "Private key for PEM flow")
-    private MultipartFile privateKeyFile;
-
-    @Schema(description = "Certificate for PEM flow")
-    private MultipartFile certFile;
-
-    @Schema(description = "PKCS12/PFX keystore")
-    private MultipartFile p12File;
-
-    @Schema(description = "JKS keystore")
-    private MultipartFile jksFile;
-
-    @Schema(description = "Display the signature visually")
-    private Boolean showSignature;
-
-    @Schema(description = "Page number for visible signature (1-indexed)")
-    private Integer pageNumber;
-
-    @Schema(description = "Custom signer name override")
-    private String name;
-
-    @Schema(description = "Signing reason")
-    private String reason;
-
-    @Schema(description = "Signing location")
-    private String location;
-
-    @Schema(description = "Show the Stirling PDF logo in the appearance")
-    private Boolean showLogo;
-}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantCertificateSubmission.java

@@ -1,21 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import lombok.Builder;
-import lombok.Data;
-
-@Data
-@Builder
-public class ParticipantCertificateSubmission {
-    private String certType;
-    private String password;
-    private byte[] privateKey;
-    private byte[] certificate;
-    private byte[] p12Keystore;
-    private byte[] jksKeystore;
-    private Boolean showSignature;
-    private Integer pageNumber;
-    private String name;
-    private String reason;
-    private String location;
-    private Boolean showLogo;
-}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantDTO.java

@@ -1,25 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.time.LocalDateTime;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class ParticipantDTO {
-    private Long userId;
-    private String username;
-    private String displayName;
-    private ParticipantStatus status;
-    private LocalDateTime lastUpdated;
-
-    // Signature appearance settings (owner-controlled)
-    private Boolean showSignature;
-    private Integer pageNumber;
-    private String reason;
-    private String location;
-    private Boolean showLogo;
-}

app/common/src/main/java/stirling/software/common/model/api/security/ParticipantStatus.java

@@ -1,9 +0,0 @@
-package stirling.software.common.model.api.security;
-
-public enum ParticipantStatus {
-    PENDING,
-    NOTIFIED,
-    VIEWED,
-    SIGNED,
-    DECLINED
-}

app/common/src/main/java/stirling/software/common/model/api/security/SignDocumentRequest.java

@@ -1,81 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import org.springframework.web.multipart.MultipartFile;
-
-import jakarta.validation.constraints.NotNull;
-import jakarta.validation.constraints.Pattern;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/**
- * Request object for signing a document. Combines certificate submission data with optional wet
- * signature (visual signature) metadata.
- */
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SignDocumentRequest {
-
-    // Certificate-related fields
-    @NotNull(message = "Certificate type is required")
-    @Pattern(
-            regexp = "SERVER|USER_CERT|UPLOAD|PEM|PKCS12|PFX|JKS",
-            message = "Invalid certificate type")
-    private String certType;
-
-    private MultipartFile p12File;
-    private String password;
-    private MultipartFile privateKeyFile;
-    private MultipartFile certFile;
-
-    // Wet signature metadata fields (optional)
-    private String wetSignatureType; // "canvas" | "image" | "text"
-    private String wetSignatureData; // Base64 image data or text
-    private Integer wetSignaturePage; // Zero-indexed page number
-    private Double wetSignatureX; // X coordinate in PDF points
-    private Double wetSignatureY; // Y coordinate in PDF points (top-left origin)
-    private Double wetSignatureWidth; // Width in PDF points
-    private Double wetSignatureHeight; // Height in PDF points
-
-    /**
-     * Checks if this request includes wet signature metadata.
-     *
-     * @return true if wet signature data is present
-     */
-    public boolean hasWetSignature() {
-        return wetSignatureType != null
-                && wetSignatureData != null
-                && wetSignaturePage != null
-                && wetSignatureX != null
-                && wetSignatureY != null
-                && wetSignatureWidth != null
-                && wetSignatureHeight != null;
-    }
-
-    /**
-     * Extracts wet signature metadata into a dedicated DTO.
-     *
-     * @return WetSignatureMetadata object if wet signature is present, null otherwise
-     */
-    public WetSignatureMetadata extractWetSignatureMetadata() {
-        if (!hasWetSignature()) {
-            return null;
-        }
-
-        WetSignatureMetadata metadata = new WetSignatureMetadata();
-        metadata.setType(wetSignatureType);
-        metadata.setData(wetSignatureData);
-        metadata.setPage(wetSignaturePage);
-        metadata.setX(wetSignatureX);
-        metadata.setY(wetSignatureY);
-        metadata.setWidth(wetSignatureWidth);
-        metadata.setHeight(wetSignatureHeight);
-
-        // Validate the metadata
-        metadata.validate();
-
-        return metadata;
-    }
-}

app/common/src/main/java/stirling/software/common/model/api/security/SignRequestDetailDTO.java

@@ -1,25 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/** DTO for sign request detail (participant view) */
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SignRequestDetailDTO {
-    private String sessionId;
-    private String documentName;
-    private String ownerUsername;
-    private String message;
-    private String dueDate;
-    private String createdAt;
-    private ParticipantStatus myStatus;
-    // Signature appearance settings (read-only, configured by owner)
-    private Boolean showSignature;
-    private Integer pageNumber;
-    private String reason;
-    private String location;
-    private Boolean showLogo;
-}

app/common/src/main/java/stirling/software/common/model/api/security/SignRequestSummaryDTO.java

@@ -1,18 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/** DTO for sign request summary (participant view) */
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SignRequestSummaryDTO {
-    private String sessionId;
-    private String documentName;
-    private String ownerUsername;
-    private String createdAt;
-    private String dueDate;
-    private ParticipantStatus myStatus;
-}

app/common/src/main/java/stirling/software/common/model/api/security/SigningParticipant.java

@@ -1,26 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.UUID;
-
-import lombok.Data;
-
-@Data
-public class SigningParticipant {
-
-    private Long userId; // Database user ID (null for in-memory sessions)
-    private String email;
-    private String name;
-    private ParticipantStatus status = ParticipantStatus.PENDING;
-    private List<String> notifications = new ArrayList<>();
-    private String shareToken = UUID.randomUUID().toString();
-    private String lastUpdated = Instant.now().toString();
-    private ParticipantCertificateSubmission certificateSubmission;
-
-    public void recordNotification(String message) {
-        notifications.add(message);
-        lastUpdated = Instant.now().toString();
-    }
-}

app/common/src/main/java/stirling/software/common/model/api/security/SigningSession.java

@@ -1,26 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.UUID;
-
-import lombok.Data;
-
-@Data
-public class SigningSession {
-    private String sessionId = UUID.randomUUID().toString();
-    private String documentName;
-    private byte[] originalPdf;
-    private byte[] signedPdf;
-    private String ownerEmail;
-    private String message;
-    private String dueDate;
-    private String createdAt = Instant.now().toString();
-    private String updatedAt = Instant.now().toString();
-    private List<SigningParticipant> participants = new ArrayList<>();
-
-    public void touch() {
-        updatedAt = Instant.now().toString();
-    }
-}

app/common/src/main/java/stirling/software/common/model/api/security/SigningSessionDetailDTO.java

@@ -1,23 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.time.LocalDateTime;
-import java.util.List;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SigningSessionDetailDTO {
-    private String sessionId;
-    private String documentName;
-    private String ownerEmail;
-    private String message;
-    private String dueDate;
-    private LocalDateTime createdAt;
-    private LocalDateTime updatedAt;
-    private boolean finalized;
-    private List<ParticipantDTO> participants;
-}

app/common/src/main/java/stirling/software/common/model/api/security/SigningSessionSummaryDTO.java

@@ -1,19 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import java.time.LocalDateTime;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SigningSessionSummaryDTO {
-    private String sessionId;
-    private String documentName;
-    private LocalDateTime createdAt;
-    private int participantCount;
-    private int signedCount;
-    private boolean finalized;
-}

app/common/src/main/java/stirling/software/common/model/api/security/UserSummaryDTO.java

@@ -1,16 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class UserSummaryDTO {
-    private Long userId;
-    private String username;
-    private String displayName;
-    private String teamName;
-    private boolean enabled;
-}

app/common/src/main/java/stirling/software/common/model/api/security/WetSignatureMetadata.java

@@ -1,96 +0,0 @@
-package stirling.software.common.model.api.security;
-
-import jakarta.validation.constraints.NotNull;
-import jakarta.validation.constraints.Pattern;
-import jakarta.validation.constraints.Positive;
-import jakarta.validation.constraints.PositiveOrZero;
-import jakarta.validation.constraints.Size;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-/**
- * Data Transfer Object for wet signature (visual signature) metadata. Contains information about a
- * signature annotation placed by a participant on the PDF. This data is used to overlay the
- * signature on the PDF during finalization.
- */
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class WetSignatureMetadata {
-
-    /** Type of wet signature: "canvas" (drawn), "image" (uploaded), or "text" (typed) */
-    @NotNull(message = "Wet signature type is required")
-    @Pattern(
-            regexp = "canvas|image|text",
-            message = "Wet signature type must be canvas, image, or text")
-    private String type;
-
-    /**
-     * Base64-encoded image data or text content for the signature. For canvas/image types:
-     * data:image/png;base64,... format For text type: plain text string
-     */
-    @NotNull(message = "Wet signature data is required")
-    @Size(max = 5_000_000, message = "Wet signature data exceeds maximum size of 5MB")
-    private String data;
-
-    /** Zero-indexed page number where the signature is placed */
-    @NotNull(message = "Page number is required")
-    @PositiveOrZero(message = "Page number must be zero or positive")
-    private Integer page;
-
-    /** X coordinate (in PDF points) of the signature rectangle, measured from left edge */
-    @NotNull(message = "X coordinate is required")
-    @PositiveOrZero(message = "X coordinate must be zero or positive")
-    private Double x;
-
-    /**
-     * Y coordinate (in PDF points) of the signature rectangle, measured from top edge. Note: This
-     * is UI coordinate system (top-left origin). Will be converted to PDF coordinate system
-     * (bottom-left origin) during overlay.
-     */
-    @NotNull(message = "Y coordinate is required")
-    @PositiveOrZero(message = "Y coordinate must be zero or positive")
-    private Double y;
-
-    /** Width of the signature rectangle in PDF points */
-    @NotNull(message = "Width is required")
-    @Positive(message = "Width must be positive")
-    private Double width;
-
-    /** Height of the signature rectangle in PDF points */
-    @NotNull(message = "Height is required")
-    @Positive(message = "Height must be positive")
-    private Double height;
-
-    /**
-     * Validates that the wet signature data is properly formatted based on type. For image types,
-     * ensures data starts with data:image prefix.
-     *
-     * @return true if validation passes
-     * @throws IllegalArgumentException if validation fails
-     */
-    public boolean validate() {
-        if (type.equals("canvas") || type.equals("image")) {
-            if (!data.startsWith("data:image/")) {
-                throw new IllegalArgumentException(
-                        "Image wet signature data must start with data:image/ prefix");
-            }
-        }
-        return true;
-    }
-
-    /**
-     * Extracts just the base64 data portion from a data URL. Removes the "data:image/png;base64,"
-     * prefix.
-     *
-     * @return pure base64 string without data URL prefix
-     */
-    public String extractBase64Data() {
-        if (data != null && data.contains(",")) {
-            return data.substring(data.indexOf(",") + 1);
-        }
-        return data;
-    }
-}

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -41,7 +41,7 @@ public class CustomPDFDocumentFactory {
 
     // Memory thresholds and limits
 
-    public static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
+    private static final long SMALL_FILE_THRESHOLD = 10 * 1024 * 1024; // 10 MB
     // Files smaller than this threshold are loaded entirely in memory for better performance.
     // These files use IOUtils.createMemoryOnlyStreamCache() which keeps all document data in RAM.
     // No temp files are created for document data, reducing I/O operations but consuming more

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -9,7 +9,6 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -38,9 +37,6 @@ public class JobExecutorService {
     private final ExecutorService executor = ExecutorFactory.newVirtualOrCachedThreadExecutor();
     private final long effectiveTimeoutMs;
 
-    @Autowired(required = false)
-    private JobOwnershipService jobOwnershipService;
-
     public JobExecutorService(
             TaskManager taskManager,
             FileStorage fileStorage,
@@ -102,17 +98,11 @@ public class JobExecutorService {
             long customTimeoutMs,
             boolean queueable,
             int resourceWeight) {
-        // Generate base UUID
-        String baseJobId = UUID.randomUUID().toString();
+        String jobId = UUID.randomUUID().toString();
 
-        // Scope job to authenticated user if security is enabled
-        String scopedJobKey = getScopedJobKey(baseJobId);
-
-        log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
-
-        // Store the scoped job ID in the request for potential use by other components
+        // Store the job ID in the request for potential use by other components
         if (request != null) {
-            request.setAttribute("jobId", scopedJobKey);
+            request.setAttribute("jobId", jobId);
 
             // Also track this job ID in the user's session for authorization purposes
             // This ensures users can only cancel their own jobs
@@ -126,13 +116,11 @@ public class JobExecutorService {
                     request.getSession().setAttribute("userJobIds", userJobIds);
                 }
 
-                userJobIds.add(scopedJobKey);
-                log.debug("Added scoped job ID {} to user session", scopedJobKey);
+                userJobIds.add(jobId);
+                log.debug("Added job ID {} to user session", jobId);
             }
         }
 
-        String jobId = scopedJobKey;
-
         // Determine which timeout to use
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
 
@@ -161,31 +149,17 @@ public class JobExecutorService {
             taskManager.createTask(jobId);
 
             // Create a specialized wrapper that updates the TaskManager
-            final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
                     () -> {
                         try {
-                            // Set jobId in ThreadLocal context for the queued job
-                            stirling.software.common.util.JobContext.setJobId(
-                                    capturedJobIdForQueue);
-                            log.debug(
-                                    "Set jobId {} in JobContext for queued job execution",
-                                    capturedJobIdForQueue);
-
                             Object result = work.get();
-                            processJobResult(capturedJobIdForQueue, result);
+                            processJobResult(jobId, result);
                             return result;
                         } catch (Exception e) {
                             log.error(
-                                    "Error executing queued job {}: {}",
-                                    capturedJobIdForQueue,
-                                    e.getMessage(),
-                                    e);
-                            taskManager.setError(capturedJobIdForQueue, e.getMessage());
+                                    "Error executing queued job {}: {}", jobId, e.getMessage(), e);
+                            taskManager.setError(jobId, e.getMessage());
                             throw e;
-                        } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
-                            stirling.software.common.util.JobContext.clear();
                         }
                     };
 
@@ -197,36 +171,21 @@ public class JobExecutorService {
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
-
-            // Capture the jobId for the async thread
-            final String capturedJobId = jobId;
-
             executor.execute(
                     () -> {
                         try {
                             log.debug(
-                                    "Running async job {} with timeout {} ms",
-                                    capturedJobId,
-                                    timeoutToUse);
-
-                            // Set jobId in ThreadLocal context for the async thread
-                            stirling.software.common.util.JobContext.setJobId(capturedJobId);
-                            log.debug(
-                                    "Set jobId {} in JobContext for async execution",
-                                    capturedJobId);
+                                    "Running async job {} with timeout {} ms", jobId, timeoutToUse);
 
                             // Execute with timeout
                             Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
-                            processJobResult(capturedJobId, result);
+                            processJobResult(jobId, result);
                         } catch (TimeoutException te) {
                             log.error("Job {} timed out after {} ms", jobId, timeoutToUse);
                             taskManager.setError(jobId, "Job timed out");
                         } catch (Exception e) {
                             log.error("Error executing job {}: {}", jobId, e.getMessage(), e);
                             taskManager.setError(jobId, e.getMessage());
-                        } finally {
-                            // Clean up ThreadLocal to avoid memory leaks
-                            stirling.software.common.util.JobContext.clear();
                         }
                     });
 
@@ -235,10 +194,6 @@ public class JobExecutorService {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
 
-                // Make jobId available to downstream components on the worker thread
-                stirling.software.common.util.JobContext.setJobId(jobId);
-                log.debug("Set jobId {} in JobContext for sync execution", jobId);
-
                 // Execute with timeout
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
@@ -258,8 +213,6 @@ public class JobExecutorService {
                 // Construct a JSON error response
                 return ResponseEntity.internalServerError()
                         .body(Map.of("error", "Job failed: " + e.getMessage()));
-            } finally {
-                stirling.software.common.util.JobContext.clear();
             }
         }
     }
@@ -513,23 +466,8 @@ public class JobExecutorService {
             throws TimeoutException, Exception {
         // Use the same executor as other async jobs for consistency
         // This ensures all operations run on the same thread pool
-        String currentJobId = stirling.software.common.util.JobContext.getJobId();
-
         java.util.concurrent.CompletableFuture<T> future =
-                java.util.concurrent.CompletableFuture.supplyAsync(
-                        () -> {
-                            if (currentJobId != null) {
-                                stirling.software.common.util.JobContext.setJobId(currentJobId);
-                            }
-                            try {
-                                return supplier.get();
-                            } finally {
-                                if (currentJobId != null) {
-                                    stirling.software.common.util.JobContext.clear();
-                                }
-                            }
-                        },
-                        executor);
+                java.util.concurrent.CompletableFuture.supplyAsync(supplier, executor);
 
         try {
             return future.get(timeoutMs, TimeUnit.MILLISECONDS);
@@ -545,18 +483,4 @@ public class JobExecutorService {
             throw new Exception("Execution was interrupted", e);
         }
     }
-
-    /**
-     * Get a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param baseJobId the base job identifier
-     * @return scoped job key, or just baseJobId if no ownership service available
-     */
-    private String getScopedJobKey(String baseJobId) {
-        if (jobOwnershipService != null) {
-            return jobOwnershipService.createScopedJobKey(baseJobId);
-        }
-        // Security disabled, return unsecured job key
-        return baseJobId;
-    }
 }

app/common/src/main/java/stirling/software/common/service/JobOwnershipService.java

@@ -1,42 +0,0 @@
-package stirling.software.common.service;
-
-import java.util.Optional;
-
-/**
- * Service interface for managing job ownership and access control. Implementations can provide
- * user-scoped job isolation when security is enabled, or no-op behavior when security is disabled.
- */
-public interface JobOwnershipService {
-
-    /**
-     * Get the current authenticated user's identifier.
-     *
-     * @return Optional containing user identifier, or empty if not authenticated
-     */
-    Optional<String> getCurrentUserId();
-
-    /**
-     * Create a scoped job key that includes user ownership when security is enabled.
-     *
-     * @param jobId the base job identifier
-     * @return scoped job key in format "userId:jobId", or just jobId if no user authenticated
-     */
-    String createScopedJobKey(String jobId);
-
-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param scopedJobKey the scoped job key to validate
-     * @return true if current user owns the job or no authentication is required
-     * @throws SecurityException if current user does not own the job
-     */
-    boolean validateJobAccess(String scopedJobKey);
-
-    /**
-     * Extract the base job ID from a scoped job key.
-     *
-     * @param scopedJobKey the scoped job key
-     * @return the base job ID without user prefix
-     */
-    String extractJobId(String scopedJobKey);
-}

app/common/src/main/java/stirling/software/common/service/SigningSessionServiceInterface.java

@@ -1,155 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-import java.util.List;
-
-public interface SigningSessionServiceInterface {
-
-    /**
-     * Creates a new signing session
-     *
-     * @param request The session creation request
-     * @param username The username of the session owner (optional, pass null for non-authenticated)
-     * @return The created session (implementation-specific return type)
-     */
-    Object createSession(Object request, String username) throws IOException;
-
-    /**
-     * Gets a signing session by ID
-     *
-     * @param sessionId The session ID
-     * @return The session object (implementation-specific return type)
-     */
-    Object getSession(String sessionId);
-
-    /**
-     * Lists all sessions for a user
-     *
-     * @param username The username
-     * @return List of session summaries (implementation-specific return type)
-     */
-    List<?> listUserSessions(String username);
-
-    /**
-     * Gets detailed session information with ownership validation
-     *
-     * @param sessionId The session ID
-     * @param username The username for ownership validation
-     * @return Detailed session object (implementation-specific return type)
-     */
-    Object getSessionDetail(String sessionId, String username);
-
-    /**
-     * Deletes a session
-     *
-     * @param sessionId The session ID
-     * @param username The username for ownership validation
-     */
-    void deleteSession(String sessionId, String username);
-
-    /**
-     * Adds participants to a session
-     *
-     * @param sessionId The session ID
-     * @param request The request containing participant emails and names
-     * @param username The username for ownership validation
-     * @return Updated session detail (implementation-specific return type)
-     */
-    Object addParticipants(String sessionId, Object request, String username);
-
-    /**
-     * Removes a participant from a session
-     *
-     * @param sessionId The session ID
-     * @param userId The participant's user ID
-     * @param username The username for ownership validation
-     */
-    void removeParticipant(String sessionId, Long userId, String username);
-
-    /**
-     * Notifies participants
-     *
-     * @param sessionId The session ID
-     * @param request The notification request
-     * @return The updated session (implementation-specific return type)
-     */
-    Object notifyParticipants(String sessionId, Object request);
-
-    /**
-     * Attaches a certificate for a participant
-     *
-     * @param sessionId The session ID
-     * @param userId The participant's user ID
-     * @param request The certificate request
-     * @return The updated session (implementation-specific return type)
-     */
-    Object attachCertificate(String sessionId, Long userId, Object request) throws IOException;
-
-    /**
-     * Marks a session as finalized
-     *
-     * @param sessionId The session ID
-     * @param signedPdf The final signed PDF bytes
-     */
-    void markSessionFinalized(String sessionId, byte[] signedPdf);
-
-    /**
-     * Gets the PDF for a session with user authentication
-     *
-     * @param sessionId The session ID
-     * @param username The participant's username
-     * @return The PDF bytes
-     */
-    byte[] getSessionPdf(String sessionId, String username);
-
-    /**
-     * Gets the signed PDF from a finalized session with ownership validation
-     *
-     * @param sessionId The session ID
-     * @param username The username for ownership validation
-     * @return The signed PDF bytes, or null if not finalized
-     */
-    byte[] getSignedPdf(String sessionId, String username);
-
-    /**
-     * Lists sign requests for a participant
-     *
-     * @param username The participant's username
-     * @return List of sign requests where user is a participant
-     */
-    List<?> listSignRequests(String username);
-
-    /**
-     * Gets sign request detail for a participant
-     *
-     * @param sessionId The session ID
-     * @param username The participant's username
-     * @return Sign request detail DTO (implementation-specific return type)
-     */
-    Object getSignRequestDetail(String sessionId, String username);
-
-    /**
-     * Declines a sign request
-     *
-     * @param sessionId The session ID
-     * @param username The participant's username
-     */
-    void declineSignRequest(String sessionId, String username);
-
-    /**
-     * Signs a document with optional wet signature metadata
-     *
-     * @param sessionId The session ID
-     * @param username The participant's username
-     * @param request The sign document request containing certificate and wet signature data
-     * @throws IOException if certificate processing fails
-     */
-    void signDocument(String sessionId, String username, Object request) throws IOException;
-
-    /**
-     * Checks if this is the database-backed implementation
-     *
-     * @return true if database-backed, false if in-memory
-     */
-    boolean isDatabaseBacked();
-}

app/common/src/main/java/stirling/software/common/util/JobContext.java

@@ -1,18 +0,0 @@
-package stirling.software.common.util;
-
-/** Thread-local context for passing job ID across async boundaries */
-public class JobContext {
-    private static final ThreadLocal<String> CURRENT_JOB_ID = new ThreadLocal<>();
-
-    public static void setJobId(String jobId) {
-        CURRENT_JOB_ID.set(jobId);
-    }
-
-    public static String getJobId() {
-        return CURRENT_JOB_ID.get();
-    }
-
-    public static void clear() {
-        CURRENT_JOB_ID.remove();
-    }
-}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -96,7 +96,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getSessionLimit()
                                                 .getOcrMyPdfSessionLimit();
-                                case CFF_CONVERTER -> 1;
                             };
 
                     long timeoutMinutes =
@@ -151,7 +150,6 @@ public class ProcessExecutor {
                                                 .getProcessExecutor()
                                                 .getTimeoutMinutes()
                                                 .getOcrMyPdfTimeoutMinutes();
-                                case CFF_CONVERTER -> 5L;
                             };
                     return new ProcessExecutor(semaphoreLimit, liveUpdates, timeoutMinutes);
                 });
@@ -304,8 +302,7 @@ public class ProcessExecutor {
         TESSERACT,
         QPDF,
         GHOSTSCRIPT,
-        OCR_MY_PDF,
-        CFF_CONVERTER
+        OCR_MY_PDF
     }
 
     @Setter

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -7,103 +7,23 @@ public class RequestUriUtils {
     }
 
     public static boolean isStaticResource(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // API routes are never static except for the public status endpoint
-        if (normalizedUri.startsWith("/api/")) {
-            return normalizedUri.startsWith("/api/v1/info/status");
-        }
-
-        // Well-known static asset directories (backend + React build artifacts)
-        if (normalizedUri.startsWith("/css/")
-                || normalizedUri.startsWith("/fonts/")
-                || normalizedUri.startsWith("/js/")
-                || normalizedUri.startsWith("/images/")
-                || normalizedUri.startsWith("/public/")
-                || normalizedUri.startsWith("/pdfjs/")
-                || normalizedUri.startsWith("/pdfjs-legacy/")
-                || normalizedUri.startsWith("/assets/")
-                || normalizedUri.startsWith("/locales/")
-                || normalizedUri.startsWith("/Login/")
-                || normalizedUri.startsWith("/samples/")
-                || normalizedUri.startsWith("/classic-logo/")
-                || normalizedUri.startsWith("/modern-logo/")
-                || normalizedUri.startsWith("/og_images/")) {
-            return true;
-        }
-
-        // Specific static files bundled with the frontend
-        if (normalizedUri.equals("/robots.txt")
-                || normalizedUri.equals("/favicon.ico")
-                || normalizedUri.equals("/site.webmanifest")
-                || normalizedUri.equals("/manifest-classic.json")
-                || normalizedUri.equals("/index.html")) {
-            return true;
-        }
-
-        // Login/error pages remain public
-        if (normalizedUri.startsWith("/login") || normalizedUri.startsWith("/error")) {
-            return true;
-        }
-
-        // Treat common static file extensions as static resources
-        return normalizedUri.endsWith(".svg")
-                || normalizedUri.endsWith(".png")
-                || normalizedUri.endsWith(".ico")
-                || normalizedUri.endsWith(".txt")
-                || normalizedUri.endsWith(".webmanifest")
-                || normalizedUri.endsWith(".js")
-                || normalizedUri.endsWith(".css")
-                || normalizedUri.endsWith(".mjs")
-                || normalizedUri.endsWith(".html")
-                || normalizedUri.endsWith(".toml");
-    }
-
-    public static boolean isFrontendRoute(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // APIs are never treated as frontend routes
-        if (normalizedUri.startsWith("/api/")) {
-            return false;
-        }
-
-        // Blocklist of backend/non-frontend paths that should still go through filters
-        String[] backendOnlyPrefixes = {
-            "/register",
-            "/invite",
-            "/pipeline",
-            "/pdfjs",
-            "/pdfjs-legacy",
-            "/fonts",
-            "/images",
-            "/files",
-            "/css",
-            "/js",
-            "/swagger",
-            "/v1/api-docs",
-            "/actuator"
-        };
-
-        for (String prefix : backendOnlyPrefixes) {
-            if (normalizedUri.equals(prefix) || normalizedUri.startsWith(prefix + "/")) {
-                return false;
-            }
-        }
-
-        if (normalizedUri.isBlank()) {
-            return false;
-        }
-
-        // Allow root and any extensionless path (React Router will handle these)
-        return !normalizedUri.contains(".");
+        return requestURI.startsWith(contextPath + "/css/")
+                || requestURI.startsWith(contextPath + "/fonts/")
+                || requestURI.startsWith(contextPath + "/js/")
+                || requestURI.endsWith(contextPath + "robots.txt")
+                || requestURI.startsWith(contextPath + "/images/")
+                || requestURI.startsWith(contextPath + "/public/")
+                || requestURI.startsWith(contextPath + "/pdfjs/")
+                || requestURI.startsWith(contextPath + "/pdfjs-legacy/")
+                || requestURI.startsWith(contextPath + "/login")
+                || requestURI.startsWith(contextPath + "/error")
+                || requestURI.startsWith(contextPath + "/favicon")
+                || requestURI.endsWith(".svg")
+                || requestURI.endsWith(".png")
+                || requestURI.endsWith(".ico")
+                || requestURI.endsWith(".txt")
+                || requestURI.endsWith(".webmanifest")
+                || requestURI.startsWith(contextPath + "/api/v1/info/status");
     }
 
     public static boolean isTrackableResource(String requestURI) {
@@ -123,7 +43,6 @@ public class RequestUriUtils {
                 || requestURI.endsWith(".svg")
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
-                || requestURI.endsWith(".toml")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
@@ -164,11 +83,4 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith("/api/v1/invite/accept")
                 || trimmedUri.contains("/v1/api-docs");
     }
-
-    private static String stripContextPath(String contextPath, String requestURI) {
-        if (contextPath != null && !contextPath.isBlank() && requestURI.startsWith(contextPath)) {
-            return requestURI.substring(contextPath.length());
-        }
-        return requestURI;
-    }
 }

app/common/src/test/java/stirling/software/common/service/JobExecutorServiceTest.java

@@ -78,23 +78,6 @@ class JobExecutorServiceTest {
         verify(request).setAttribute(eq("jobId"), anyString());
     }
 
-    @Test
-    void shouldExposeJobIdInJobContextDuringSyncExecution() throws Exception {
-        // Given
-        Supplier<Object> work = stirling.software.common.util.JobContext::getJobId;
-
-        // When
-        ResponseEntity<?> response = jobExecutorService.runJobGeneric(false, work);
-
-        // Then
-        assertEquals(HttpStatus.OK, response.getStatusCode());
-        assertNotNull(response.getBody());
-
-        var requestJobIdCaptor = ArgumentCaptor.forClass(String.class);
-        verify(request).setAttribute(eq("jobId"), requestJobIdCaptor.capture());
-        assertEquals(requestJobIdCaptor.getValue(), response.getBody());
-    }
-
     @Test
     void shouldRunAsyncJobSuccessfully() throws Exception {
         // Given

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -49,27 +49,6 @@ public class RequestUriUtilsTest {
                 "API products should not be static");
     }
 
-    @Test
-    void testIsFrontendRoute() {
-        assertTrue(
-                RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
-        assertTrue(
-                RequestUriUtils.isFrontendRoute("", "/app/dashboard"),
-                "React routes without extensions should be frontend routes");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/api/v1/users"),
-                "API routes should not be frontend routes");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/register"),
-                "Register should not be treated as a frontend route");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/pipeline/jobs"),
-                "Pipeline should not be treated as a frontend route");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/files/download"),
-                "Files path should not be treated as a frontend route");
-    }
-
     @Test
     void testIsStaticResourceWithContextPath() {
         String contextPath = "/myapp";
@@ -104,7 +83,6 @@ public class RequestUriUtilsTest {
                 "/favicon.ico",
                 "/icon.svg",
                 "/image.png",
-                "/locales/en/translation.toml",
                 "/site.webmanifest",
                 "/app/logo.svg",
                 "/downloads/document.png",

app/core/build.gradle

@@ -1,7 +1,5 @@
 apply plugin: 'org.springframework.boot'
 
-import org.apache.tools.ant.taskdefs.condition.Os
-
 repositories {
     maven { url = 'https://build.shibboleth.net/maven/releases' }
     maven { url = 'https://maven.pkg.github.com/jcefmaven/jcefmaven' }
@@ -17,7 +15,6 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
-        targetExclude 'src/main/resources/static/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
@@ -28,14 +25,12 @@ spotless {
     }
     yaml {
         target '**/*.yml', '**/*.yaml'
-        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
     }
     format 'gradle', {
         target '**/gradle/*.gradle', '**/*.gradle'
-        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -162,125 +157,5 @@ springBoot {
     mainClass = 'stirling.software.SPDF.SPDFApplication'
 }
 
-// Frontend build tasks - only enabled with -PbuildWithFrontend=true
-def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
-def frontendDir = file('../../frontend')
-def frontendDistDir = file('../../frontend/dist')
-def resourcesStaticDir = file('src/main/resources/static')
-def generatedFrontendPaths = [
-    'assets',
-    'index.html',
-    'locales',
-    'Login',
-    'classic-logo',
-    'modern-logo',
-    'og_images',
-    'samples',
-    'manifest-classic.json'
-]
-
-tasks.register('npmInstall', Exec) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Install frontend dependencies'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
-    inputs.file(new File(frontendDir, 'package.json'))
-    inputs.file(new File(frontendDir, 'package-lock.json'))
-    outputs.dir(new File(frontendDir, 'node_modules'))
-
-    // Show live output
-    standardOutput = System.out
-    errorOutput = System.err
-
-    // Skip if node_modules exists and is up-to-date
-    onlyIf {
-        def nodeModules = new File(frontendDir, 'node_modules')
-        if (!nodeModules.exists()) {
-            println "node_modules not found, will install..."
-            return true
-        }
-        def packageJson = new File(frontendDir, 'package.json')
-        def packageLock = new File(frontendDir, 'package-lock.json')
-        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
-                        nodeModules.lastModified() < packageLock.lastModified()
-        if (isOutdated) {
-            println "package.json or package-lock.json changed, will reinstall..."
-        } else {
-            println "node_modules is up-to-date, skipping npm install"
-        }
-        return isOutdated
-    }
-
-    doFirst {
-        println "Installing npm dependencies in ${frontendDir}..."
-    }
-}
-
-tasks.register('npmBuild', Exec) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Build frontend application'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
-    dependsOn npmInstall
-    inputs.dir(new File(frontendDir, 'src'))
-    inputs.file(new File(frontendDir, 'package.json'))
-    outputs.dir(frontendDistDir)
-
-    // Show live output
-    standardOutput = System.out
-    errorOutput = System.err
-
-    // Override VITE_API_BASE_URL to use relative paths for production builds
-    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
-    environment 'VITE_API_BASE_URL', '/'
-
-    doFirst {
-        println "Building frontend application for production (VITE_API_BASE_URL=/)"
-    }
-}
-
-tasks.register('copyFrontendAssets', Copy) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Copy frontend build to static resources'
-    dependsOn npmBuild
-    from(frontendDistDir) {
-        // Exclude files that conflict with backend static resources
-        exclude 'robots.txt'  // Backend already has this
-        exclude 'favicon.ico' // Backend already has this
-    }
-    into resourcesStaticDir
-    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
-    doFirst {
-        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
-        println "Backend static resources will be preserved"
-    }
-    doLast {
-        println "Frontend assets copied successfully!"
-    }
-}
-
-tasks.register('cleanFrontendAssets', Delete) {
-    group = 'frontend'
-    description = 'Remove previously generated frontend assets from static resources'
-    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
-}
-
-// Ensure copyFrontendAssets runs after spotless tasks
-tasks.named('copyFrontendAssets').configure {
-    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
-}
-
-if (buildWithFrontend) {
-    println "Frontend build enabled - JAR will include React frontend"
-    processResources.dependsOn copyFrontendAssets
-} else {
-    println "Frontend build disabled - JAR will be backend-only"
-    // When not building the UI, ensure any stale frontend assets are removed
-    processResources.dependsOn cleanFrontendAssets
-}
-
 bootJar.dependsOn ':common:jar'
 bootJar.dependsOn ':proprietary:jar'

app/core/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -336,8 +336,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Convert", "eml-to-pdf");
         addEndpointToGroup("Convert", "cbz-to-pdf");
         addEndpointToGroup("Convert", "pdf-to-cbz");
-        addEndpointToGroup("Convert", "pdf-to-json");
-        addEndpointToGroup("Convert", "json-to-pdf");
 
         // Adding endpoints to "Security" group
         addEndpointToGroup("Security", "add-password");
@@ -473,8 +471,6 @@ public class EndpointConfiguration {
         addEndpointToGroup("Java", "compress-pdf");
         addEndpointToGroup("Java", "cbz-to-pdf");
         addEndpointToGroup("Java", "pdf-to-cbz");
-        addEndpointToGroup("Java", "pdf-to-json");
-        addEndpointToGroup("Java", "json-to-pdf");
         addEndpointToGroup("rar", "pdf-to-cbr");
 
         // Javascript

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -25,7 +25,6 @@ public class ExternalAppDepConfig {
     private final String weasyprintPath;
     private final String unoconvPath;
     private final Map<String, List<String>> commandToGroupMapping;
-    private volatile boolean dependenciesChecked = false;
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -112,10 +111,6 @@ public class ExternalAppDepConfig {
         }
     }
 
-    public boolean isDependenciesChecked() {
-        return dependenciesChecked;
-    }
-
     @PostConstruct
     public void checkDependencies() {
         // Check core dependencies
@@ -167,7 +162,5 @@ public class ExternalAppDepConfig {
             }
         }
         endpointConfiguration.logDisabledEndpointsSummary();
-        dependenciesChecked = true;
-        log.info("Dependency checks completed");
     }
 }

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -95,7 +95,7 @@ public class InitialSetup {
         isNewServer =
                 existingVersion == null
                         || existingVersion.isEmpty()
-                        || "0.0.0".equals(existingVersion);
+                        || existingVersion.equals("0.0.0");
 
         String appVersion = "0.0.0";
         Resource resource = new ClassPathResource("version.properties");

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -42,7 +42,7 @@ public class WebMvcConfig implements WebMvcConfigurer {
             // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
             logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
             registry.addMapping("/**")
-                    .allowedOriginPatterns(
+                    .allowedOrigins(
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -35,7 +35,6 @@ public class ConfigController {
     private final EndpointConfiguration endpointConfiguration;
     private final ServerCertificateServiceInterface serverCertificateService;
     private final UserServiceInterface userService;
-    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;
 
     public ConfigController(
             ApplicationProperties applicationProperties,
@@ -44,14 +43,12 @@ public class ConfigController {
             @org.springframework.beans.factory.annotation.Autowired(required = false)
                     ServerCertificateServiceInterface serverCertificateService,
             @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    UserServiceInterface userService,
-            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
+                    UserServiceInterface userService) {
         this.applicationProperties = applicationProperties;
         this.applicationContext = applicationContext;
         this.endpointConfiguration = endpointConfiguration;
         this.serverCertificateService = serverCertificateService;
         this.userService = userService;
-        this.externalAppDepConfig = externalAppDepConfig;
     }
 
     @GetMapping("/app-config")
@@ -59,9 +56,6 @@ public class ConfigController {
         Map<String, Object> configData = new HashMap<>();
 
         try {
-            // Add dependency check status
-            configData.put("dependenciesReady", externalAppDepConfig.isDependenciesChecked());
-
             // Get AppConfig bean
             AppConfig appConfig = applicationContext.getBean(AppConfig.class);
 

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java

@@ -196,9 +196,9 @@ public class StampController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
-                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
-                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
+                    case "japanese" -> "static/fonts/Meiryo.ttf";
+                    case "korean" -> "static/fonts/malgun.ttf";
+                    case "chinese" -> "static/fonts/SimSun.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     case "roman" -> "static/fonts/NotoSans-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";

app/core/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java

@@ -72,7 +72,6 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.config.swagger.StandardPdfResponse;
-import stirling.software.SPDF.model.api.security.MultiSignPDFWithCertRequest;
 import stirling.software.SPDF.model.api.security.SignPDFWithCertRequest;
 import stirling.software.common.annotations.AutoJobPostMapping;
 import stirling.software.common.service.CustomPDFDocumentFactory;
@@ -114,7 +113,7 @@ public class CertSignController {
         this.serverCertificateService = serverCertificateService;
     }
 
-    static void sign(
+    private static void sign(
             CustomPDFDocumentFactory pdfDocumentFactory,
             MultipartFile input,
             OutputStream output,
@@ -150,42 +149,6 @@ public class CertSignController {
         }
     }
 
-    static void sign(
-            CustomPDFDocumentFactory pdfDocumentFactory,
-            InputStream input,
-            OutputStream output,
-            CreateSignature instance,
-            Boolean showSignature,
-            Integer pageNumber,
-            String name,
-            String location,
-            String reason,
-            Boolean showLogo) {
-        try (PDDocument doc = pdfDocumentFactory.load(input)) {
-            PDSignature signature = new PDSignature();
-            signature.setFilter(PDSignature.FILTER_ADOBE_PPKLITE);
-            signature.setSubFilter(PDSignature.SUBFILTER_ADBE_PKCS7_DETACHED);
-            signature.setName(name);
-            signature.setLocation(location);
-            signature.setReason(reason);
-            signature.setSignDate(Calendar.getInstance());
-            if (Boolean.TRUE.equals(showSignature)) {
-                SignatureOptions signatureOptions = new SignatureOptions();
-                signatureOptions.setVisualSignature(
-                        instance.createVisibleSignature(doc, signature, pageNumber, showLogo));
-                signatureOptions.setPage(pageNumber);
-
-                doc.addSignature(signature, instance, signatureOptions);
-
-            } else {
-                doc.addSignature(signature, instance);
-            }
-            doc.saveIncremental(output);
-        } catch (Exception e) {
-            ExceptionUtils.logException("PDF signing", e);
-        }
-    }
-
     @AutoJobPostMapping(
             consumes = {
                 MediaType.MULTIPART_FORM_DATA_VALUE,
@@ -288,143 +251,7 @@ public class CertSignController {
                 GeneralUtils.generateFilename(pdf.getOriginalFilename(), "_signed.pdf"));
     }
 
-    @AutoJobPostMapping(
-            consumes = {
-                MediaType.MULTIPART_FORM_DATA_VALUE,
-                MediaType.APPLICATION_FORM_URLENCODED_VALUE
-            },
-            value = "/cert-sign/multi")
-    @StandardPdfResponse
-    @Operation(
-            summary = "Sign PDF with multiple Digital Certificates",
-            description =
-                    "This endpoint accepts a PDF file and multiple digital certificates to"
-                            + " sequentially sign the document. Input:PDF Output:PDF Type:SISO")
-    public ResponseEntity<byte[]> multiSignPDFWithCert(
-            @ModelAttribute MultiSignPDFWithCertRequest request) throws Exception {
-        if (request.getCertTypes() == null || request.getCertTypes().isEmpty()) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.optionsNotSpecified",
-                    "{0} options are not specified",
-                    "certificate types");
-        }
-
-        byte[] currentPdf = request.getFileInput().getBytes();
-        String originalFilename = request.getFileInput().getOriginalFilename();
-
-        for (int i = 0; i < request.getCertTypes().size(); i++) {
-            String certType = request.getCertTypes().get(i);
-            KeyStore ks = null;
-            String keystorePassword = getFromList(request.getPasswords(), i, "");
-
-            switch (certType) {
-                case "PEM":
-                    ks = KeyStore.getInstance("JKS");
-                    ks.load(null);
-                    MultipartFile privateKeyFile =
-                            getFromList(request.getPrivateKeyFiles(), i, null);
-                    MultipartFile certFile = getFromList(request.getCertFiles(), i, null);
-                    if (privateKeyFile == null || certFile == null) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.optionsNotSpecified",
-                                "{0} options are not specified",
-                                "certificate and key files for signer " + (i + 1));
-                    }
-                    PrivateKey privateKey =
-                            getPrivateKeyFromPEM(privateKeyFile.getBytes(), keystorePassword);
-                    Certificate cert = (Certificate) getCertificateFromPEM(certFile.getBytes());
-                    ks.setKeyEntry(
-                            "alias",
-                            privateKey,
-                            keystorePassword.toCharArray(),
-                            new Certificate[] {cert});
-                    break;
-                case "PKCS12":
-                case "PFX":
-                    MultipartFile p12File = getFromList(request.getP12Files(), i, null);
-                    if (p12File == null) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.optionsNotSpecified",
-                                "{0} options are not specified",
-                                "PKCS12/PFX keystore for signer " + (i + 1));
-                    }
-                    ks = KeyStore.getInstance("PKCS12");
-                    ks.load(p12File.getInputStream(), keystorePassword.toCharArray());
-                    break;
-                case "JKS":
-                    MultipartFile jksfile = getFromList(request.getJksFiles(), i, null);
-                    if (jksfile == null) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.optionsNotSpecified",
-                                "{0} options are not specified",
-                                "JKS keystore for signer " + (i + 1));
-                    }
-                    ks = KeyStore.getInstance("JKS");
-                    ks.load(jksfile.getInputStream(), keystorePassword.toCharArray());
-                    break;
-                case "SERVER":
-                    if (serverCertificateService == null) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.serverCertificateNotAvailable",
-                                "Server certificate service is not available in this edition");
-                    }
-                    if (!serverCertificateService.isEnabled()) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.serverCertificateDisabled",
-                                "Server certificate feature is disabled");
-                    }
-                    if (!serverCertificateService.hasServerCertificate()) {
-                        throw ExceptionUtils.createIllegalArgumentException(
-                                "error.serverCertificateNotFound",
-                                "No server certificate configured");
-                    }
-                    ks = serverCertificateService.getServerKeyStore();
-                    keystorePassword = serverCertificateService.getServerCertificatePassword();
-                    break;
-                default:
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.invalidArgument",
-                            "Invalid argument: {0}",
-                            "certificate type: " + certType);
-            }
-
-            CreateSignature createSignature =
-                    new CreateSignature(ks, keystorePassword.toCharArray());
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            String signerName = getFromList(request.getNames(), i, "SPDF");
-            String location = getFromList(request.getLocations(), i, "SPDF");
-            String reason = getFromList(request.getReasons(), i, "Signed by SPDF");
-            Boolean showSignature = getFromList(request.getShowSignatures(), i, Boolean.FALSE);
-            Boolean showLogo = getFromList(request.getShowLogos(), i, Boolean.TRUE);
-            Integer pageNumber = getFromList(request.getPageNumbers(), i, null);
-            pageNumber = pageNumber != null ? pageNumber - 1 : null;
-
-            sign(
-                    pdfDocumentFactory,
-                    new ByteArrayInputStream(currentPdf),
-                    baos,
-                    createSignature,
-                    showSignature,
-                    pageNumber,
-                    signerName,
-                    location,
-                    reason,
-                    showLogo);
-            currentPdf = baos.toByteArray();
-        }
-
-        return WebResponseUtils.bytesToWebResponse(
-                currentPdf, GeneralUtils.generateFilename(originalFilename, "_multi_signed.pdf"));
-    }
-
-    private static <T> T getFromList(List<T> list, int index, T defaultValue) {
-        if (list == null || list.size() <= index) {
-            return defaultValue;
-        }
-        return list.get(index);
-    }
-
-    public PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
+    private PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
             throws IOException, OperatorCreationException, PKCSException {
         try (PEMParser pemParser =
                 new PEMParser(new InputStreamReader(new ByteArrayInputStream(pemBytes)))) {
@@ -446,14 +273,14 @@ public class CertSignController {
         }
     }
 
-    public Certificate getCertificateFromPEM(byte[] pemBytes)
+    private Certificate getCertificateFromPEM(byte[] pemBytes)
             throws IOException, CertificateException {
         try (ByteArrayInputStream bis = new ByteArrayInputStream(pemBytes)) {
             return CertificateFactory.getInstance("X.509").generateCertificate(bis);
         }
     }
 
-    static class CreateSignature extends CreateSignatureBase {
+    class CreateSignature extends CreateSignatureBase {
         File logoFile;
 
         public CreateSignature(KeyStore keystore, char[] pin)

app/core/src/main/java/stirling/software/SPDF/controller/api/security/SigningSessionController.java

@@ -1,678 +0,0 @@
-package stirling.software.SPDF.controller.api.security;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.security.KeyStore;
-import java.security.Principal;
-import java.security.PrivateKey;
-import java.security.cert.Certificate;
-import java.util.List;
-import java.util.Locale;
-
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.tags.Tag;
-
-import jakarta.validation.constraints.NotBlank;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.config.swagger.StandardPdfResponse;
-import stirling.software.SPDF.controller.api.security.CertSignController.CreateSignature;
-import stirling.software.SPDF.service.SigningSessionService;
-import stirling.software.common.model.api.security.*;
-import stirling.software.common.service.CustomPDFDocumentFactory;
-import stirling.software.common.service.ServerCertificateServiceInterface;
-import stirling.software.common.service.SigningSessionServiceInterface;
-import stirling.software.common.util.ExceptionUtils;
-import stirling.software.common.util.GeneralUtils;
-import stirling.software.common.util.WebResponseUtils;
-import stirling.software.proprietary.service.UserServerCertificateService;
-
-@Slf4j
-@RestController
-@RequestMapping("/api/v1/security")
-@Tag(name = "Security", description = "Security APIs")
-public class SigningSessionController {
-
-    private final SigningSessionService signingSessionService;
-    private final CustomPDFDocumentFactory pdfDocumentFactory;
-    private final ServerCertificateServiceInterface serverCertificateServiceInterface;
-    private final SigningSessionServiceInterface sessionServiceInterface;
-    private final UserServerCertificateService userServerCertificateService;
-
-    public SigningSessionController(
-            SigningSessionService signingSessionService,
-            CustomPDFDocumentFactory pdfDocumentFactory,
-            @Autowired(required = false)
-                    ServerCertificateServiceInterface serverCertificateServiceInterface,
-            @Autowired(required = false)
-                    List<SigningSessionServiceInterface> signingSessionServices,
-            @Autowired(required = false)
-                    UserServerCertificateService userServerCertificateService) {
-        this.signingSessionService = signingSessionService;
-        this.pdfDocumentFactory = pdfDocumentFactory;
-        this.serverCertificateServiceInterface = serverCertificateServiceInterface;
-        this.userServerCertificateService = userServerCertificateService;
-        // Use database-backed service if available, otherwise fall back to in-memory
-        this.sessionServiceInterface =
-                signingSessionServices != null && !signingSessionServices.isEmpty()
-                        ? signingSessionServices.stream()
-                                .filter(SigningSessionServiceInterface::isDatabaseBacked)
-                                .findFirst()
-                                .orElse(signingSessionService)
-                        : signingSessionService;
-    }
-
-    @Operation(summary = "List all signing sessions for current user")
-    @GetMapping(value = "/cert-sign/sessions")
-    public ResponseEntity<?> listSessions(Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            List<?> sessions = sessionServiceInterface.listUserSessions(principal.getName());
-            return ResponseEntity.ok(sessions);
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body("Error listing sessions");
-        }
-    }
-
-    @PostMapping(
-            consumes = {
-                MediaType.MULTIPART_FORM_DATA_VALUE,
-                MediaType.APPLICATION_FORM_URLENCODED_VALUE
-            },
-            value = "/cert-sign/sessions",
-            produces = MediaType.APPLICATION_JSON_VALUE)
-    @Operation(
-            summary = "Create a shared signing session",
-            description =
-                    "Starts a collaboration session, distributes share links, and optionally notifies participants."
-                            + " Input:PDF Output:JSON Type:SISO")
-    public ResponseEntity<?> createSession(
-            @ModelAttribute CreateSigningSessionRequest request, Principal principal)
-            throws Exception {
-        if (sessionServiceInterface.isDatabaseBacked() && principal != null) {
-            Object session = sessionServiceInterface.createSession(request, principal.getName());
-            return ResponseEntity.ok(session);
-        } else {
-            SigningSession session = signingSessionService.createSession(request);
-            return ResponseEntity.ok(session);
-        }
-    }
-
-    @Operation(summary = "Fetch signing session details")
-    @GetMapping(value = "/cert-sign/sessions/{sessionId}")
-    public ResponseEntity<?> getSession(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
-        if (sessionServiceInterface.isDatabaseBacked() && principal != null) {
-            try {
-                Object session =
-                        sessionServiceInterface.getSessionDetail(sessionId, principal.getName());
-                return ResponseEntity.ok(session);
-            } catch (Exception e) {
-                return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                        .body("Access denied or session not found");
-            }
-        } else {
-            SigningSession session = signingSessionService.getSession(sessionId);
-            return ResponseEntity.ok(session);
-        }
-    }
-
-    @Operation(summary = "Delete a signing session")
-    @DeleteMapping(value = "/cert-sign/sessions/{sessionId}")
-    public ResponseEntity<?> deleteSession(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            sessionServiceInterface.deleteSession(sessionId, principal.getName());
-            return ResponseEntity.noContent().build();
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                    .body("Cannot delete session: " + e.getMessage());
-        }
-    }
-
-    @Operation(summary = "Add participants to an existing session")
-    @PostMapping(value = "/cert-sign/sessions/{sessionId}/participants")
-    public ResponseEntity<?> addParticipants(
-            @PathVariable("sessionId") @NotBlank String sessionId,
-            @RequestBody AddParticipantsRequest request,
-            Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            Object session =
-                    sessionServiceInterface.addParticipants(
-                            sessionId, request, principal.getName());
-            return ResponseEntity.ok(session);
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                    .body("Cannot add participants: " + e.getMessage());
-        }
-    }
-
-    @Operation(summary = "Remove a participant from a session")
-    @DeleteMapping(value = "/cert-sign/sessions/{sessionId}/participants/{userId}")
-    public ResponseEntity<?> removeParticipant(
-            @PathVariable("sessionId") @NotBlank String sessionId,
-            @PathVariable("userId") Long userId,
-            Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            sessionServiceInterface.removeParticipant(sessionId, userId, principal.getName());
-            return ResponseEntity.noContent().build();
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                    .body("Cannot remove participant: " + e.getMessage());
-        }
-    }
-
-    @Operation(summary = "Get session PDF for participant view")
-    @GetMapping(value = "/cert-sign/sessions/{sessionId}/pdf")
-    public ResponseEntity<byte[]> getSessionPdf(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
-        }
-        try {
-            byte[] pdfBytes = sessionServiceInterface.getSessionPdf(sessionId, principal.getName());
-            return WebResponseUtils.bytesToWebResponse(pdfBytes, "document.pdf");
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-        }
-    }
-
-    @PostMapping(value = "/cert-sign/sessions/{sessionId}/notify")
-    @Operation(summary = "Notify signing participants about outstanding requests")
-    public SigningSession notifyParticipants(
-            @PathVariable("sessionId") @NotBlank String sessionId,
-            @RequestBody NotifySigningParticipantsRequest request) {
-        return (SigningSession) sessionServiceInterface.notifyParticipants(sessionId, request);
-    }
-
-    @PostMapping(
-            value = "/cert-sign/sessions/{sessionId}/participants/{userId}/certificate",
-            consumes = {
-                MediaType.MULTIPART_FORM_DATA_VALUE,
-                MediaType.APPLICATION_FORM_URLENCODED_VALUE
-            })
-    @Operation(summary = "Attach certificate details for a specific participant")
-    public SigningSession attachCertificate(
-            @PathVariable("sessionId") @NotBlank String sessionId,
-            @PathVariable("userId") Long userId,
-            @ModelAttribute ParticipantCertificateRequest request)
-            throws Exception {
-        return (SigningSession)
-                sessionServiceInterface.attachCertificate(sessionId, userId, request);
-    }
-
-    @Operation(summary = "Get signed PDF from finalized session")
-    @GetMapping(value = "/cert-sign/sessions/{sessionId}/signed-pdf")
-    @StandardPdfResponse
-    public ResponseEntity<byte[]> getSignedPdf(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
-        }
-        try {
-            byte[] signedPdf = sessionServiceInterface.getSignedPdf(sessionId, principal.getName());
-            if (signedPdf == null) {
-                return ResponseEntity.status(HttpStatus.NOT_FOUND)
-                        .body("Session not finalized".getBytes());
-            }
-            SigningSession session = (SigningSession) sessionServiceInterface.getSession(sessionId);
-            return WebResponseUtils.bytesToWebResponse(
-                    signedPdf,
-                    GeneralUtils.generateFilename(session.getDocumentName(), "_shared_signed.pdf"));
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-        }
-    }
-
-    @PostMapping(value = "/cert-sign/sessions/{sessionId}/finalize")
-    @Operation(
-            summary = "Finalize signing session",
-            description =
-                    "Applies collected certificates in order and returns the signed document.")
-    @StandardPdfResponse
-    public ResponseEntity<byte[]> finalizeSession(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal)
-            throws Exception {
-        // Validate ownership if database service is available
-        if (sessionServiceInterface.isDatabaseBacked() && principal != null) {
-            try {
-                sessionServiceInterface.getSessionDetail(sessionId, principal.getName());
-            } catch (Exception e) {
-                return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
-            }
-        }
-
-        SigningSession session = (SigningSession) sessionServiceInterface.getSession(sessionId);
-        byte[] pdf = session.getOriginalPdf();
-
-        // Step 1: Apply wet signatures (visual annotations) FIRST
-        if (sessionServiceInterface.isDatabaseBacked()) {
-            try {
-                pdf = applyWetSignatures(pdf, sessionId);
-            } catch (Exception e) {
-                log.error(
-                        "Failed to apply wet signatures for session {}: {}",
-                        sessionId,
-                        e.getMessage());
-                // Continue with certificate signing even if wet signatures fail
-            }
-        }
-
-        // Step 2: Apply digital certificates
-        for (SigningParticipant participant : session.getParticipants()) {
-            ParticipantCertificateSubmission submission = participant.getCertificateSubmission();
-            if (submission == null || participant.getStatus() != ParticipantStatus.SIGNED) {
-                continue;
-            }
-
-            // Skip SERVER certificate type if feature is not available/enabled
-            if ("SERVER".equalsIgnoreCase(submission.getCertType())) {
-                if (serverCertificateServiceInterface == null
-                        || !serverCertificateServiceInterface.isEnabled()
-                        || !serverCertificateServiceInterface.hasServerCertificate()) {
-                    // Skip this participant - server certificate not available
-                    continue;
-                }
-            }
-
-            // Handle USER_CERT type - auto-generate if needed
-            if ("USER_CERT".equalsIgnoreCase(submission.getCertType())) {
-                if (userServerCertificateService == null
-                        || !sessionServiceInterface.isDatabaseBacked()) {
-                    log.warn(
-                            "USER_CERT requested but service not available, skipping participant: {}",
-                            participant.getEmail());
-                    continue;
-                }
-            }
-
-            KeyStore keystore = buildKeystore(submission, participant);
-            boolean usingServer = "SERVER".equalsIgnoreCase(submission.getCertType());
-            boolean usingUserCert = "USER_CERT".equalsIgnoreCase(submission.getCertType());
-            String password;
-            if (usingServer && serverCertificateServiceInterface != null) {
-                password = serverCertificateServiceInterface.getServerCertificatePassword();
-            } else if (usingUserCert && userServerCertificateService != null) {
-                password = submission.getPassword(); // Password stored in submission for user cert
-            } else {
-                password = submission.getPassword();
-            }
-            CreateSignature createSignature =
-                    new CreateSignature(
-                            keystore, password != null ? password.toCharArray() : new char[0]);
-
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            CertSignController.sign(
-                    pdfDocumentFactory,
-                    new ByteArrayInputStream(pdf),
-                    baos,
-                    createSignature,
-                    submission.getShowSignature(),
-                    submission.getPageNumber() != null
-                            ? Math.max(submission.getPageNumber() - 1, 0)
-                            : null,
-                    StringUtils.defaultIfBlank(participant.getName(), "Shared Signing"),
-                    StringUtils.defaultIfBlank(submission.getLocation(), ""),
-                    StringUtils.defaultIfBlank(submission.getReason(), "Document Signing"),
-                    submission.getShowLogo());
-
-            pdf = baos.toByteArray();
-        }
-
-        session.setSignedPdf(pdf);
-
-        // Mark session as finalized in database if database service is available
-        sessionServiceInterface.markSessionFinalized(sessionId, pdf);
-
-        // Step 3: Clean up wet signature metadata (GDPR compliance)
-        if (sessionServiceInterface.isDatabaseBacked()) {
-            try {
-                clearWetSignatureMetadata(sessionId);
-            } catch (Exception e) {
-                log.error(
-                        "Failed to clear wet signature metadata for session {}: {}",
-                        sessionId,
-                        e.getMessage());
-                // Don't fail the finalization if cleanup fails
-            }
-        }
-
-        return WebResponseUtils.bytesToWebResponse(
-                pdf,
-                GeneralUtils.generateFilename(session.getDocumentName(), "_shared_signed.pdf"));
-    }
-
-    private KeyStore buildKeystore(
-            ParticipantCertificateSubmission submission, SigningParticipant participant)
-            throws Exception {
-        CertSignController certSignController =
-                new CertSignController(pdfDocumentFactory, serverCertificateServiceInterface);
-        String certType = submission.getCertType().toUpperCase(Locale.ROOT);
-        String password = submission.getPassword();
-        switch (certType) {
-            case "USER_CERT":
-                if (userServerCertificateService == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.userCertificateNotAvailable",
-                            "User certificate service is not available in this edition");
-                }
-                // Get user ID from participant
-                Long userId = getUserIdFromParticipant(participant);
-                if (userId == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.userNotFound", "Cannot determine user ID for participant");
-                }
-                // Auto-generate certificate if user doesn't have one
-                try {
-                    userServerCertificateService.getOrCreateUserCertificate(userId);
-                    KeyStore userKeyStore = userServerCertificateService.getUserKeyStore(userId);
-                    String userPassword =
-                            userServerCertificateService.getUserKeystorePassword(userId);
-                    // Store password in submission for later use
-                    submission.setPassword(userPassword);
-                    return userKeyStore;
-                } catch (Exception e) {
-                    log.error("Failed to get/create user certificate for user {}", userId, e);
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.userCertificateFailure",
-                            "Failed to get user certificate: " + e.getMessage());
-                }
-            case "PEM":
-                KeyStore pemStore = KeyStore.getInstance("JKS");
-                pemStore.load(null);
-                if (submission.getPrivateKey() == null || submission.getCertificate() == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.optionsNotSpecified",
-                            "{0} options are not specified",
-                            "PEM certificate and key bytes for signer");
-                }
-                PrivateKey privateKey =
-                        certSignController.getPrivateKeyFromPEM(
-                                submission.getPrivateKey(), password);
-                Certificate certificate =
-                        (Certificate)
-                                certSignController.getCertificateFromPEM(
-                                        submission.getCertificate());
-                pemStore.setKeyEntry(
-                        "alias",
-                        privateKey,
-                        password.toCharArray(),
-                        new Certificate[] {certificate});
-                return pemStore;
-            case "PKCS12":
-            case "PFX":
-                if (submission.getP12Keystore() == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.optionsNotSpecified",
-                            "{0} options are not specified",
-                            "PKCS12 keystore bytes");
-                }
-                KeyStore p12Store = KeyStore.getInstance("PKCS12");
-                p12Store.load(
-                        new ByteArrayInputStream(submission.getP12Keystore()),
-                        password.toCharArray());
-                return p12Store;
-            case "JKS":
-                if (submission.getJksKeystore() == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.optionsNotSpecified",
-                            "{0} options are not specified",
-                            "JKS keystore bytes");
-                }
-                KeyStore jksStore = KeyStore.getInstance("JKS");
-                jksStore.load(
-                        new ByteArrayInputStream(submission.getJksKeystore()),
-                        password.toCharArray());
-                return jksStore;
-            case "SERVER":
-                if (serverCertificateServiceInterface == null) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.serverCertificateNotAvailable",
-                            "Server certificate service is not available in this edition");
-                }
-                if (!serverCertificateServiceInterface.isEnabled()) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.serverCertificateDisabled",
-                            "Server certificate feature is disabled");
-                }
-                if (!serverCertificateServiceInterface.hasServerCertificate()) {
-                    throw ExceptionUtils.createIllegalArgumentException(
-                            "error.serverCertificateNotFound", "No server certificate configured");
-                }
-                return serverCertificateServiceInterface.getServerKeyStore();
-            default:
-                throw ExceptionUtils.createIllegalArgumentException(
-                        "error.invalidArgument",
-                        "Invalid argument: {0}",
-                        "certificate type: " + submission.getCertType());
-        }
-    }
-
-    /**
-     * Applies wet signatures (visual annotations) to the PDF. This must be done BEFORE applying
-     * digital certificates.
-     *
-     * @param pdfBytes Original PDF bytes
-     * @param sessionId Session ID
-     * @return PDF bytes with wet signatures overlaid
-     * @throws Exception if PDF processing fails
-     */
-    private byte[] applyWetSignatures(byte[] pdfBytes, String sessionId) throws Exception {
-        // Cast to database service to access wet signature methods
-        if (!(sessionServiceInterface
-                instanceof
-                stirling.software.proprietary.security.service.DatabaseSigningSessionService)) {
-            return pdfBytes; // Skip if not database service
-        }
-
-        stirling.software.proprietary.security.service.DatabaseSigningSessionService dbService =
-                (stirling.software.proprietary.security.service.DatabaseSigningSessionService)
-                        sessionServiceInterface;
-
-        List<WetSignatureMetadata> wetSignatures = dbService.getAllWetSignatures(sessionId);
-        if (wetSignatures.isEmpty()) {
-            return pdfBytes; // No wet signatures to apply
-        }
-
-        // Load PDF document
-        org.apache.pdfbox.pdmodel.PDDocument document =
-                pdfDocumentFactory.load(new ByteArrayInputStream(pdfBytes));
-
-        try {
-            for (WetSignatureMetadata wetSig : wetSignatures) {
-                applyWetSignatureToPage(document, wetSig);
-            }
-
-            // Save modified PDF
-            ByteArrayOutputStream baos = new ByteArrayOutputStream();
-            document.save(baos);
-            return baos.toByteArray();
-        } finally {
-            document.close();
-        }
-    }
-
-    /**
-     * Applies a single wet signature to the appropriate page of the PDF.
-     *
-     * @param document PDF document
-     * @param wetSig Wet signature metadata
-     * @throws Exception if image processing or PDF manipulation fails
-     */
-    private void applyWetSignatureToPage(
-            org.apache.pdfbox.pdmodel.PDDocument document, WetSignatureMetadata wetSig)
-            throws Exception {
-        if (wetSig.getPage() >= document.getNumberOfPages()) {
-            log.warn(
-                    "Wet signature page {} exceeds document pages {}, skipping",
-                    wetSig.getPage(),
-                    document.getNumberOfPages());
-            return;
-        }
-
-        org.apache.pdfbox.pdmodel.PDPage page = document.getPage(wetSig.getPage());
-        org.apache.pdfbox.pdmodel.PDPageContentStream contentStream =
-                new org.apache.pdfbox.pdmodel.PDPageContentStream(
-                        document,
-                        page,
-                        org.apache.pdfbox.pdmodel.PDPageContentStream.AppendMode.APPEND,
-                        true,
-                        true);
-
-        try {
-            // Extract base64 data (remove data:image/png;base64, prefix if present)
-            String base64Data = wetSig.extractBase64Data();
-            byte[] imageBytes = java.util.Base64.getDecoder().decode(base64Data);
-
-            // Create PDImageXObject from bytes
-            org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject image =
-                    org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject.createFromByteArray(
-                            document, imageBytes, "signature");
-
-            // Convert Y coordinate from UI (top-left) to PDF (bottom-left) coordinate system
-            float pdfY =
-                    page.getMediaBox().getHeight()
-                            - wetSig.getY().floatValue()
-                            - wetSig.getHeight().floatValue();
-
-            // Draw image at specified position
-            contentStream.drawImage(
-                    image,
-                    wetSig.getX().floatValue(),
-                    pdfY,
-                    wetSig.getWidth().floatValue(),
-                    wetSig.getHeight().floatValue());
-        } finally {
-            contentStream.close();
-        }
-    }
-
-    /**
-     * Clears wet signature metadata from all participants. Called after successful finalization for
-     * GDPR compliance.
-     *
-     * @param sessionId Session ID
-     */
-    private void clearWetSignatureMetadata(String sessionId) {
-        if (sessionServiceInterface
-                instanceof
-                stirling.software.proprietary.security.service.DatabaseSigningSessionService) {
-            stirling.software.proprietary.security.service.DatabaseSigningSessionService dbService =
-                    (stirling.software.proprietary.security.service.DatabaseSigningSessionService)
-                            sessionServiceInterface;
-            dbService.clearWetSignatureMetadata(sessionId);
-        }
-    }
-
-    /**
-     * Helper method to get user ID from participant. Returns null if not available (e.g., in-memory
-     * sessions).
-     *
-     * @param participant The signing participant
-     * @return User ID or null
-     */
-    private Long getUserIdFromParticipant(SigningParticipant participant) {
-        return participant.getUserId();
-    }
-
-    @Operation(summary = "List sign requests for authenticated user")
-    @GetMapping(value = "/cert-sign/sign-requests")
-    public ResponseEntity<?> listSignRequests(Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            return ResponseEntity.ok(sessionServiceInterface.listSignRequests(principal.getName()));
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body("Cannot list sign requests: " + e.getMessage());
-        }
-    }
-
-    @Operation(summary = "Get sign request detail for participant")
-    @GetMapping(value = "/cert-sign/sign-requests/{sessionId}")
-    public ResponseEntity<?> getSignRequestDetail(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            return ResponseEntity.ok(
-                    sessionServiceInterface.getSignRequestDetail(sessionId, principal.getName()));
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                    .body("Access denied or sign request not found: " + e.getMessage());
-        }
-    }
-
-    @Operation(summary = "Decline a sign request")
-    @PostMapping(value = "/cert-sign/sign-requests/{sessionId}/decline")
-    public ResponseEntity<?> declineSignRequest(
-            @PathVariable("sessionId") @NotBlank String sessionId, Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            sessionServiceInterface.declineSignRequest(sessionId, principal.getName());
-            return ResponseEntity.noContent().build();
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                    .body("Cannot decline sign request: " + e.getMessage());
-        }
-    }
-
-    @Operation(
-            summary = "Sign a document with optional wet signature",
-            description =
-                    "Submits certificate and optional wet signature annotation metadata for a signing session")
-    @PostMapping(
-            value = "/cert-sign/sessions/{sessionId}/sign",
-            consumes = {
-                MediaType.MULTIPART_FORM_DATA_VALUE,
-                MediaType.APPLICATION_FORM_URLENCODED_VALUE
-            })
-    public ResponseEntity<?> signDocument(
-            @PathVariable("sessionId") @NotBlank String sessionId,
-            @ModelAttribute SignDocumentRequest request,
-            Principal principal) {
-        if (principal == null || !sessionServiceInterface.isDatabaseBacked()) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication required");
-        }
-        try {
-            sessionServiceInterface.signDocument(sessionId, principal.getName(), request);
-            return ResponseEntity.noContent().build();
-        } catch (IllegalArgumentException e) {
-            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(e.getMessage());
-        } catch (Exception e) {
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-                    .body("Cannot sign document: " + e.getMessage());
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java

@@ -171,9 +171,9 @@ public class WatermarkController {
         resourceDir =
                 switch (alphabet) {
                     case "arabic" -> "static/fonts/NotoSansArabic-Regular.ttf";
-                    case "japanese" -> "static/fonts/NotoSansJP-Regular.ttf";
-                    case "korean" -> "static/fonts/NotoSansKR-Regular.ttf";
-                    case "chinese" -> "static/fonts/NotoSansSC-Regular.ttf";
+                    case "japanese" -> "static/fonts/Meiryo.ttf";
+                    case "korean" -> "static/fonts/malgun.ttf";
+                    case "chinese" -> "static/fonts/SimSun.ttf";
                     case "thai" -> "static/fonts/NotoSansThai-Regular.ttf";
                     default -> "static/fonts/NotoSans-Regular.ttf";
                 };

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,19 +1,16 @@
 package stirling.software.SPDF.controller.web;
 
-import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-@Controller
+// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
 public class ReactRoutingController {
 
-    @GetMapping(
-            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*$}")
+    @GetMapping("/{path:^(?!api|static|robots\\.txt|favicon\\.ico)[^\\.]*$}")
     public String forwardRootPaths() {
         return "forward:/index.html";
     }
 
-    @GetMapping(
-            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    @GetMapping("/{path:^(?!api|static)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
     public String forwardNestedPaths() {
         return "forward:/index.html";
     }

app/core/src/main/java/stirling/software/SPDF/model/api/security/MultiSignPDFWithCertRequest.java

@@ -1,68 +0,0 @@
-package stirling.software.SPDF.model.api.security;
-
-import java.util.List;
-
-import org.springframework.web.multipart.MultipartFile;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-import lombok.EqualsAndHashCode;
-
-import stirling.software.common.model.api.PDFFile;
-
-@Data
-@EqualsAndHashCode(callSuper = true)
-public class MultiSignPDFWithCertRequest extends PDFFile {
-
-    @Schema(
-            description = "The list of certificate types for each signer",
-            allowableValues = {"PEM", "PKCS12", "PFX", "JKS", "SERVER"},
-            requiredMode = Schema.RequiredMode.REQUIRED)
-    private List<String> certTypes;
-
-    @Schema(
-            description =
-                    "Private key files for PEM certificates (supports .pem, .der, or .key files)."
-                            + " Should match the order of certTypes when PEM is selected")
-    private List<MultipartFile> privateKeyFiles;
-
-    @Schema(
-            description =
-                    "Certificate files for PEM certificates (supports .pem, .der, .crt, or .cer files)."
-                            + " Should match the order of certTypes when PEM is selected")
-    private List<MultipartFile> certFiles;
-
-    @Schema(
-            description =
-                    "PKCS12/PFX keystore files. Should match the order of certTypes when PKCS12 or PFX is selected")
-    private List<MultipartFile> p12Files;
-
-    @Schema(
-            description =
-                    "JKS keystore files. Should match the order of certTypes when JKS is selected")
-    private List<MultipartFile> jksFiles;
-
-    @Schema(description = "Passwords for keystores or private keys", format = "password")
-    private List<String> passwords;
-
-    @Schema(description = "Whether to visually show each signature in the PDF")
-    private List<Boolean> showSignatures;
-
-    @Schema(description = "Reasons for signing, aligned with certTypes")
-    private List<String> reasons;
-
-    @Schema(description = "Locations for signing, aligned with certTypes")
-    private List<String> locations;
-
-    @Schema(description = "Signer names, aligned with certTypes")
-    private List<String> names;
-
-    @Schema(
-            description =
-                    "Page numbers for visible signatures (1-indexed). Required when showSignature is true for a signer")
-    private List<Integer> pageNumbers;
-
-    @Schema(description = "Whether to show a signature logo for each signer")
-    private List<Boolean> showLogos;
-}

app/core/src/main/java/stirling/software/SPDF/service/SigningSessionService.java

@@ -1,214 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.stereotype.Service;
-import org.springframework.web.multipart.MultipartFile;
-
-import stirling.software.common.model.api.security.CreateSigningSessionRequest;
-import stirling.software.common.model.api.security.NotifySigningParticipantsRequest;
-import stirling.software.common.model.api.security.ParticipantCertificateRequest;
-import stirling.software.common.model.api.security.ParticipantCertificateSubmission;
-import stirling.software.common.model.api.security.ParticipantStatus;
-import stirling.software.common.model.api.security.SigningParticipant;
-import stirling.software.common.model.api.security.SigningSession;
-import stirling.software.common.service.SigningSessionServiceInterface;
-import stirling.software.common.util.ExceptionUtils;
-
-@Service
-public class SigningSessionService implements SigningSessionServiceInterface {
-
-    private final Map<String, SigningSession> sessions = new ConcurrentHashMap<>();
-
-    public SigningSession createSession(CreateSigningSessionRequest request) throws IOException {
-        return createSession(request, null);
-    }
-
-    @Override
-    public SigningSession createSession(Object requestObj, String username) throws IOException {
-        // In-memory implementation not supported for user-based signing (requires database)
-        throw new UnsupportedOperationException(
-                "User-based signing requires database-backed implementation");
-    }
-
-    public SigningSession getSession(String sessionId) {
-        SigningSession session = sessions.get(sessionId);
-        if (session == null) {
-            throw ExceptionUtils.createIllegalArgumentException(
-                    "error.notFound", "Signing session {0} was not found", sessionId);
-        }
-        return session;
-    }
-
-    @Override
-    public SigningSession notifyParticipants(String sessionId, Object requestObj) {
-        NotifySigningParticipantsRequest request = (NotifySigningParticipantsRequest) requestObj;
-        SigningSession session = getSession(sessionId);
-        List<SigningParticipant> targets = getTargets(session, request.getParticipantEmails());
-        String message =
-                StringUtils.defaultIfBlank(
-                        request.getMessage(), "A reminder to review and sign the document.");
-
-        for (SigningParticipant participant : targets) {
-            participant.recordNotification(message);
-            if (participant.getStatus() == ParticipantStatus.PENDING) {
-                participant.setStatus(ParticipantStatus.NOTIFIED);
-            }
-        }
-        session.touch();
-        return session;
-    }
-
-    @Override
-    public SigningSession attachCertificate(String sessionId, Long userId, Object requestObj)
-            throws IOException {
-        // In-memory implementation doesn't support user-based participants
-        throw new UnsupportedOperationException(
-                "User-based signing not supported in non-database mode");
-    }
-
-    private void broadcastNotification(SigningSession session, String message) {
-        for (SigningParticipant participant : session.getParticipants()) {
-            participant.recordNotification(message);
-            if (participant.getStatus() == ParticipantStatus.PENDING) {
-                participant.setStatus(ParticipantStatus.NOTIFIED);
-            }
-        }
-        session.touch();
-    }
-
-    private ParticipantCertificateSubmission toSubmission(ParticipantCertificateRequest request)
-            throws IOException {
-        return ParticipantCertificateSubmission.builder()
-                .certType(request.getCertType())
-                .password(request.getPassword())
-                .privateKey(toBytes(request.getPrivateKeyFile()))
-                .certificate(toBytes(request.getCertFile()))
-                .p12Keystore(toBytes(request.getP12File()))
-                .jksKeystore(toBytes(request.getJksFile()))
-                .showSignature(request.getShowSignature())
-                .pageNumber(request.getPageNumber())
-                .name(request.getName())
-                .reason(request.getReason())
-                .location(request.getLocation())
-                .showLogo(request.getShowLogo())
-                .build();
-    }
-
-    private byte[] toBytes(MultipartFile file) throws IOException {
-        if (file == null || file.isEmpty()) {
-            return null;
-        }
-        return file.getBytes();
-    }
-
-    private List<SigningParticipant> getTargets(
-            SigningSession session, List<String> requestedEmails) {
-        if (requestedEmails == null || requestedEmails.isEmpty()) {
-            return session.getParticipants();
-        }
-
-        List<SigningParticipant> participants = new ArrayList<>();
-        for (String email : requestedEmails) {
-            Optional<SigningParticipant> participant =
-                    session.getParticipants().stream()
-                            .filter(p -> Objects.equals(p.getEmail(), email))
-                            .findFirst();
-            participant.ifPresent(participants::add);
-        }
-        return participants;
-    }
-
-    // Interface methods that are not supported by in-memory implementation
-    @Override
-    public List<?> listUserSessions(String username) {
-        // In-memory implementation doesn't support user filtering
-        return Collections.emptyList();
-    }
-
-    @Override
-    public Object getSessionDetail(String sessionId, String username) {
-        // In-memory implementation doesn't have separate detail view
-        return getSession(sessionId);
-    }
-
-    @Override
-    public void deleteSession(String sessionId, String username) {
-        // In-memory implementation doesn't support deletion
-        throw new UnsupportedOperationException(
-                "Session deletion not supported in non-database mode");
-    }
-
-    @Override
-    public Object addParticipants(String sessionId, Object request, String username) {
-        // In-memory implementation doesn't support adding participants
-        throw new UnsupportedOperationException(
-                "Adding participants not supported in non-database mode");
-    }
-
-    @Override
-    public void removeParticipant(String sessionId, Long userId, String username) {
-        // In-memory implementation doesn't support user-based participants
-        throw new UnsupportedOperationException(
-                "User-based signing not supported in non-database mode");
-    }
-
-    @Override
-    public void markSessionFinalized(String sessionId, byte[] signedPdf) {
-        SigningSession session = getSession(sessionId);
-        session.setSignedPdf(signedPdf);
-    }
-
-    @Override
-    public byte[] getSessionPdf(String sessionId, String username) {
-        // In-memory implementation doesn't support user authentication
-        throw new UnsupportedOperationException(
-                "User-based signing not supported in non-database mode");
-    }
-
-    @Override
-    public byte[] getSignedPdf(String sessionId, String username) {
-        throw new UnsupportedOperationException(
-                "getSignedPdf is only available in database-backed mode");
-    }
-
-    @Override
-    public List<?> listSignRequests(String username) {
-        // In-memory implementation doesn't support user-based sign requests
-        return Collections.emptyList();
-    }
-
-    @Override
-    public Object getSignRequestDetail(String sessionId, String username) {
-        // In-memory implementation doesn't support user-based signing
-        throw new UnsupportedOperationException(
-                "User-based signing not supported in non-database mode");
-    }
-
-    @Override
-    public void declineSignRequest(String sessionId, String username) {
-        // In-memory implementation doesn't support user-based signing
-        throw new UnsupportedOperationException(
-                "User-based signing not supported in non-database mode");
-    }
-
-    @Override
-    public void signDocument(String sessionId, String username, Object request) throws IOException {
-        // In-memory implementation doesn't support user-based signing with wet signatures
-        throw new UnsupportedOperationException(
-                "User-based signing not supported in non-database mode");
-    }
-
-    @Override
-    public boolean isDatabaseBacked() {
-        return false;
-    }
-}

app/core/src/main/java/stirling/software/common/controller/JobController.java

@@ -5,7 +5,6 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
@@ -25,7 +24,6 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.job.JobResult;
 import stirling.software.common.model.job.ResultFile;
 import stirling.software.common.service.FileStorage;
-import stirling.software.common.service.JobOwnershipService;
 import stirling.software.common.service.JobQueue;
 import stirling.software.common.service.TaskManager;
 import stirling.software.common.util.RegexPatternUtils;
@@ -43,9 +41,6 @@ public class JobController {
     private final JobQueue jobQueue;
     private final HttpServletRequest request;
 
-    @Autowired(required = false)
-    private JobOwnershipService jobOwnershipService;
-
     /**
      * Get the status of a job
      *
@@ -55,13 +50,6 @@ public class JobController {
     @GetMapping("/job/{jobId}")
     @Operation(summary = "Get job status")
     public ResponseEntity<?> getJobStatus(@PathVariable("jobId") String jobId) {
-        // Validate job ownership
-        if (!validateJobAccess(jobId)) {
-            log.warn("Unauthorized attempt to access job status: {}", jobId);
-            return ResponseEntity.status(403)
-                    .body(Map.of("message", "You are not authorized to access this job"));
-        }
-
         JobResult result = taskManager.getJobResult(jobId);
         if (result == null) {
             return ResponseEntity.notFound().build();
@@ -91,13 +79,6 @@ public class JobController {
     @GetMapping("/job/{jobId}/result")
     @Operation(summary = "Get job result")
     public ResponseEntity<?> getJobResult(@PathVariable("jobId") String jobId) {
-        // Validate job ownership
-        if (!validateJobAccess(jobId)) {
-            log.warn("Unauthorized attempt to access job result: {}", jobId);
-            return ResponseEntity.status(403)
-                    .body(Map.of("message", "You are not authorized to access this job"));
-        }
-
         JobResult result = taskManager.getJobResult(jobId);
         if (result == null) {
             return ResponseEntity.notFound().build();
@@ -163,8 +144,13 @@ public class JobController {
     public ResponseEntity<?> cancelJob(@PathVariable("jobId") String jobId) {
         log.debug("Request to cancel job: {}", jobId);
 
-        // Validate job ownership
-        if (!validateJobAccess(jobId)) {
+        // Verify that this job belongs to the current user
+        // We can use the current request's session to validate ownership
+        Object sessionJobIds = request.getSession().getAttribute("userJobIds");
+        if (sessionJobIds == null
+                || !(sessionJobIds instanceof java.util.Set)
+                || !((java.util.Set<?>) sessionJobIds).contains(jobId)) {
+            // Either no jobs in session or jobId doesn't match user's jobs
             log.warn("Unauthorized attempt to cancel job: {}", jobId);
             return ResponseEntity.status(403)
                     .body(Map.of("message", "You are not authorized to cancel this job"));
@@ -224,13 +210,6 @@ public class JobController {
     @GetMapping("/job/{jobId}/result/files")
     @Operation(summary = "Get job result files")
     public ResponseEntity<?> getJobFiles(@PathVariable("jobId") String jobId) {
-        // Validate job ownership
-        if (!validateJobAccess(jobId)) {
-            log.warn("Unauthorized attempt to access job files: {}", jobId);
-            return ResponseEntity.status(403)
-                    .body(Map.of("message", "You are not authorized to access this job"));
-        }
-
         JobResult result = taskManager.getJobResult(jobId);
         if (result == null) {
             return ResponseEntity.notFound().build();
@@ -351,26 +330,4 @@ public class JobController {
             return "attachment; filename=\"" + fileName + "\"";
         }
     }
-
-    /**
-     * Validate that the current user has access to the given job.
-     *
-     * @param jobId the job identifier to validate
-     * @return true if user has access, false otherwise
-     */
-    private boolean validateJobAccess(String jobId) {
-        // If JobOwnershipService is available (security enabled), use it
-        if (jobOwnershipService != null) {
-            try {
-                return jobOwnershipService.validateJobAccess(jobId);
-            } catch (SecurityException e) {
-                log.warn("Job ownership validation failed for jobId {}: {}", jobId, e.getMessage());
-                return false;
-            }
-        }
-
-        // Security disabled - allow all access (backwards compatibility)
-        // When security is not enabled, any user can access any job by jobId
-        return true;
-    }
 }

app/core/src/main/resources/application.properties

@@ -1,6 +1,5 @@
 multipart.enabled=true
 logging.level.org.springframework=WARN
-logging.level.org.springframework.security=WARN
 logging.level.org.hibernate=WARN
 logging.level.org.eclipse.jetty=WARN
 #logging.level.org.springframework.security.oauth2=DEBUG
@@ -8,9 +7,6 @@ logging.level.org.eclipse.jetty=WARN
 #logging.level.org.opensaml=DEBUG
 #logging.level.stirling.software.proprietary.security=DEBUG
 logging.level.com.zaxxer.hikari=WARN
-logging.level.stirling.software.SPDF.service.PdfJsonConversionService=INFO
-logging.level.stirling.software.common.service.JobExecutorService=INFO
-logging.level.stirling.software.common.service.TaskManager=INFO
 spring.jpa.open-in-view=false
 server.forward-headers-strategy=NATIVE
 server.error.path=/error
@@ -37,11 +33,8 @@ spring.datasource.url=jdbc:h2:file:./configs/stirling-pdf-DB-2.3.232;DB_CLOSE_DE
 spring.datasource.driver-class-name=org.h2.Driver
 spring.datasource.username=sa
 spring.datasource.password=
-spring.h2.console.enabled=true
+spring.h2.console.enabled=false
 spring.jpa.hibernate.ddl-auto=update
-spring.jpa.properties.hibernate.format_sql=true
-logging.level.org.hibernate.SQL=error
-logging.level.org.hibernate.type.descriptor.sql.BasicBinder=TRACE
 # Defer datasource initialization to ensure that the database is fully set up
 # before Hibernate attempts to access it. This is particularly useful when
 # using database initialization scripts or tools.
@@ -55,7 +48,7 @@ server.servlet.session.timeout:30m
 springdoc.api-docs.path=/v1/api-docs
 # Set the URL of the OpenAPI JSON for the Swagger UI
 springdoc.swagger-ui.url=/v1/api-docs
-springdoc.swagger-ui.path=/swagger-ui.html
+springdoc.swagger-ui.path=/index.html
 # Force OpenAPI 3.0 specification version
 springdoc.api-docs.version=OPENAPI_3_0
 posthog.api.key=phc_fiR65u5j6qmXTYL56MNrLZSWqLaDW74OrZH0Insd2xq
@@ -68,9 +61,3 @@ java.io.tmpdir=${stirling.tempfiles.directory:${java.io.tmpdir}/stirling-pdf}
 
 # V2 features
 v2=true
-
-# User personal certificates (per-user signing certificates)
-system.userCertificates.enabled=true
-system.userCertificates.autoGenerate=true
-system.userCertificates.validity=365
-system.userCertificates.keySize=2048

app/core/src/main/resources/settings.yml.template

@@ -11,7 +11,7 @@
 #############################################################################################################
 
 security:
-  enableLogin: true # set to 'true' to enable login
+  enableLogin: false # set to 'true' to enable login
   csrfDisabled: false # set to 'true' to disable CSRF protection (not recommended for production)
   loginAttemptCount: 5 # lock user account after 5 tries; when using e.g. Fail2Ban you can deactivate the function with -1
   loginResetTimeMinutes: 120 # lock account for 2 hours after x attempts
@@ -174,23 +174,6 @@ system:
   databaseBackup:
     cron: '0 0 0 * * ?' # Cron expression for automatic database backups "0 0 0 * * ?" daily at midnight
 
-stirling:
-  pdf:
-    fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
-    json:
-      font-normalization:
-        enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
-      cff-converter:
-        enabled: true # Wrap CFF/Type1C fonts as OpenType-CFF for browser compatibility
-        method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
-        python-command: /opt/venv/bin/python3 # Python interpreter path
-        python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
-        fontforge-command: fontforge # Override if FontForge is installed under a different name/path
-      type3:
-        library:
-          enabled: true # Match common Type3 fonts against the built-in library of converted programs
-          index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)
-
 ui:
   appNameNavbar: '' # name displayed on the navigation bar
   logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)

app/core/src/main/resources/static/css/cookieconsentCustomisation.css

@@ -76,9 +76,4 @@
     .cm__btns{
         padding-top: 1rem !important;
     }
-}
-
-/* Lower z-index so cookie banner appears behind onboarding modals */
-#cc-main {
-    z-index: 100 !important;
 }