fix

Critical:
- Remove orphaned delegate_form_fill ToolOutput from OrchestratorAgent;
  the method didn't exist and OrchestratorAgent(runtime) crashed at boot.
  Also drop unused DocumentExtractorAgent import and KnowledgeUpdateResponse
  from the OrchestratorResponse union. Form fill stays on its own endpoints
  (POST /api/v1/form/ai/*) and is not wired as an orchestrator delegate.

Medium:
- Thread conversation_history through the three form-fill agents.
  Contracts: FormAnalysisRequest, FormFillBatchRequest, and
  DocumentExtractionRequest now carry conversation_history. Agents call
  format_conversation_history() when building prompts, matching the
  pattern from PdfQuestionAgent / PdfEditAgent.
- Add input bounds to form-fill contracts (max_length on strings,
  min_length/max_length on lists and dicts). Caps: 50 files, 500 fields
  per file, 20 documents per request, 500 knowledge entries, 50k chars
  per document text, 8k chars per page text. Stops unbounded prompt growth.
- Replace Literal["fill_result"] / Literal["knowledge_update"] etc. with
  WorkflowOutcome enum values. Adds KNOWLEDGE_UPDATE, MULTI_PROFILE_EXTRACTION,
  and BATCH_FILL_RESULT to both WorkflowOutcome (Python) and
  AiWorkflowOutcome (Java) to keep the "must stay in sync" contract honest.

Low:
- Drop duplicate build_test_settings() helper in test_form_fill_agent.py;
  use conftest.build_app_settings() like the rest of the suite.
- Add test coverage for extract_multiple -> MultiProfileExtractionResponse
  (the two-person detection path).
- ARCHITECTURE.md: clarify where state actually lives
  (localStorage keys on the frontend, no user-scoping) and note that form
  fill is not an orchestrator delegate.

128 engine tests pass. Lifespan boots cleanly with all four agents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -1,8 +1,6 @@
 # Version control
 .git/
 .gitignore
-.git-blame-ignore-revs
-.gitattributes
 
 # Build outputs
 build/
@@ -17,34 +15,22 @@ version_builds/
 # Gradle caches (local, not what's in the container)
 .gradle/
 **/.gradle/
-.gradle-home/
-
-# Task (go-task) cache
-.task/
 
 # Node / frontend
 node_modules/
 **/node_modules/
 frontend/node_modules/
 frontend/dist/
-frontend/playwright-report/
 .npm/
 .yarn/
 
 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
-frontend/src-tauri/target/
-frontend/src-tauri/dist/
 
 # IDE and editor
 .idea/
 .vscode/
-.settings/
-.settings.zip
-.classpath
-.project
-.devcontainer/
 *.iml
 *.ipr
 *.iws
@@ -55,7 +41,6 @@ frontend/src-tauri/dist/
 *.pid
 .DS_Store
 Thumbs.db
-logs/
 
 # Docker itself
 Dockerfile*
@@ -69,33 +54,13 @@ Dockerfile*
 # Test reports
 **/test-results/
 **/jacoco/
-test_*.pdf
 
 # Testing and documentation (not needed in build)
 testing/
 docs/
-devGuide/
-devTools/
 *.md
 README*
 
-# Separate projects not consumed by the Java/frontend build
-commonforms-onnx/
-
-# Runtime mount points used by docker-compose volumes, not build input
-stirling/
-customFiles/
-configs/
-
-# Claude Code workspace
-.claude/
-
-# Python caches
-.pytest_cache/
-.ruff_cache/
-__pycache__/
-**/__pycache__/
-
 # Local env
 .env
 .env.*
@@ -108,3 +73,4 @@ __pycache__/
 *~
 .DS_Store
 .cache/
+.pytest_cache/

.github/actions/setup-bot/action.yml

@@ -22,7 +22,7 @@ runs:
   steps:
     - name: Generate a GitHub App Token
       id: generate-token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}

.github/aur/stirling-pdf-bin/PKGBUILD

@@ -1,14 +1,14 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
-pkgname=stirling-pdf-desktop
-pkgver=2.11.0
+pkgname=stirling-pdf-bin
+pkgver=2.7.3
 pkgrel=1
-pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
+pkgdesc="Locally hosted, web-based PDF manipulation tool (desktop app, prebuilt binary)"
 arch=('x86_64')
 url="https://www.stirling.com"
 license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3')
+depends=('gtk3' 'webkit2gtk' 'libappindicator-gtk3')
 provides=('stirling-pdf')
-conflicts=('stirling-pdf' 'stirling-pdf-git' 'stirling-pdf-bin')
+conflicts=('stirling-pdf' 'stirling-pdf-git')
 options=('!strip')
 
 source_x86_64=("${pkgname}-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,32 +1,27 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.11.0
+pkgver=2.7.3
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
 url="https://www.stirling.com"
 license=('MIT' 'LicenseRef-Stirling-PDF-Proprietary')
-depends=('java-runtime>=25')
+depends=('java-runtime>=21')
 provides=('stirling-pdf-server')
 conflicts=('stirling-pdf-server' 'stirling-pdf-server-git')
 backup=('etc/stirling-pdf-server/settings.yml')
 
-source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar")
-sha256sums=('PLACEHOLDER_JAR_SHA256')
+source=("Stirling-PDF-with-login-${pkgver}.jar::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-with-login.jar"
+        "stirling-pdf-server.service"
+        "stirling-pdf-server.sysusers"
+        "stirling-pdf-server.tmpfiles")
+sha256sums=('PLACEHOLDER_JAR_SHA256'
+            'PLACEHOLDER_SERVICE_SHA256'
+            'PLACEHOLDER_SYSUSERS_SHA256'
+            'PLACEHOLDER_TMPFILES_SHA256')
 
-package() {
-    # JAR
-    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
-        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
-
-    # Wrapper script
-    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
-#!/bin/sh
-exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
-EOF
-
-    # systemd unit
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service" << 'EOF'
+prepare() {
+    cat > stirling-pdf-server.service << 'EOF'
 [Unit]
 Description=Stirling-PDF Server
 After=network.target
@@ -48,16 +43,36 @@ Environment=JAVA_OPTS=-Xmx512m
 WantedBy=multi-user.target
 EOF
 
-    # sysusers
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf" << 'EOF'
+    cat > stirling-pdf-server.sysusers << 'EOF'
 u stirling-pdf - "Stirling-PDF Server" /var/lib/stirling-pdf-server -
 EOF
 
-    # tmpfiles
-    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf" << 'EOF'
+    cat > stirling-pdf-server.tmpfiles << 'EOF'
 d /var/lib/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
 d /var/log/stirling-pdf-server 0750 stirling-pdf stirling-pdf -
 EOF
+}
+
+package() {
+    # JAR
+    install -Dm644 "Stirling-PDF-with-login-${pkgver}.jar" \
+        "${pkgdir}/usr/share/stirling-pdf-server/stirling-pdf-server.jar"
+
+    # Wrapper script
+    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/stirling-pdf-server" << 'EOF'
+#!/bin/sh
+exec java $JAVA_OPTS -jar /usr/share/stirling-pdf-server/stirling-pdf-server.jar "$@"
+EOF
+
+    # systemd unit
+    install -Dm644 stirling-pdf-server.service \
+        "${pkgdir}/usr/lib/systemd/system/stirling-pdf-server.service"
+
+    # sysusers / tmpfiles
+    install -Dm644 stirling-pdf-server.sysusers \
+        "${pkgdir}/usr/lib/sysusers.d/stirling-pdf-server.conf"
+    install -Dm644 stirling-pdf-server.tmpfiles \
+        "${pkgdir}/usr/lib/tmpfiles.d/stirling-pdf-server.conf"
 
     # Default config stub
     install -dm755 "${pkgdir}/etc/stirling-pdf-server"
@@ -70,8 +85,6 @@ EOF
 
     # License
     install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" << 'EOF'
-MIT License with proprietary carve-outs (open-core).
-SPDX: MIT AND LicenseRef-Stirling-PDF-Proprietary
-See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
+MIT License — see https://github.com/Stirling-Tools/Stirling-PDF/blob/main/LICENSE
 EOF
 }

.github/config/.files.yaml

@@ -55,25 +55,6 @@ frontend: &frontend
   - scripts/type3_to_cff.py
   - scripts/update_type3_library.py
 
-# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
-# job on changes to any of these.
-tauri: &tauri
-  - frontend/src-tauri/**
-  - frontend/src/desktop/**
-  - frontend/tsconfig.desktop.json
-  - frontend/package.json
-  - frontend/package-lock.json
-  - frontend/vite.config.ts
-  - .github/workflows/tauri-build.yml
-
-# Files that affect the AI engine (Python tool models, fixers, tests). Gate
-# the engine validation job on changes to engine sources or to the Java
-# tool surfaces it generates models from.
-engine: &engine
-  - engine/**
-  - app/(common|core|proprietary)/src/main/java/**
-  - .github/workflows/ai-engine.yml
-
 licenses-frontend: &licenses-frontend
   - ".github/workflows/frontend-backend-licenses-update.yml"
   - "frontend/package.json"
@@ -82,23 +63,4 @@ licenses-frontend: &licenses-frontend
 
 licenses-backend: &licenses-backend
   - ".github/workflows/frontend-backend-licenses-update.yml"
-  - *build
-
-# Files that can affect premium / enterprise behaviour. Gate the enterprise
-# Playwright job on changes to any of these on PRs.
-proprietary: &proprietary
-  - app/proprietary/**
-  - frontend/src/proprietary/**
-  - frontend/src/core/tests/enterprise/**
-  - testing/compose/docker-compose-keycloak-oauth.yml
-  - testing/compose/docker-compose-keycloak-saml.yml
-  - testing/compose/keycloak-realm-oauth.json
-  - testing/compose/keycloak-realm-saml.json
-  - testing/compose/start-oauth-test.sh
-  - testing/compose/start-saml-test.sh
-  - testing/compose/validate-oauth-test.sh
-  - testing/compose/validate-saml-test.sh
-  - configs/settings.yml.template
-  - build.gradle
-  - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml
+  - *build

.github/dependabot.yml

@@ -13,150 +13,63 @@ updates:
       - "/app/proprietary"
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
     rebase-strategy: "auto"
 
   - package-ecosystem: "docker"
-    directories:
-      - "/" # Location of Dockerfile
-      - "/docker/backend"
-      - "/docker/embedded"
-      - "/docker/frontend"
-      - "/docker/base"
-      - "/docker/engine"
+    directory: "/" # Location of Dockerfile
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
     rebase-strategy: "auto"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
-    cooldown:
-      default-days: 7
     rebase-strategy: "auto"
 
   - package-ecosystem: npm
-    directories:
-      - /devTools
-      - /frontend
+    directory: /devTools
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/backend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/embedded
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: docker
+    directory: /docker/frontend
+    schedule:
+      interval: "weekly"
+    rebase-strategy: "auto"
+
+  - package-ecosystem: npm
+    directory: /frontend
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
     rebase-strategy: "auto"
-    groups:
-      embedpdf:
-        patterns:
-          - "@embedpdf/*"
-      mantine:
-        patterns:
-          - "@mantine/*"
-          - "postcss-preset-mantine"
-      mui:
-        patterns:
-          - "@mui/*"
-      tauri-js:
-        patterns:
-          - "@tauri-apps/*"
-      emotion:
-        patterns:
-          - "@emotion/*"
-      react:
-        patterns:
-          - "react"
-          - "react-dom"
-          - "@types/react"
-          - "@types/react-dom"
-      typescript-eslint:
-        patterns:
-          - "@typescript-eslint/*"
-          - "typescript-eslint"
-      eslint:
-        patterns:
-          - "eslint"
-          - "@eslint/*"
-      vite:
-        patterns:
-          - "vite"
-          - "vite-*"
-          - "@vitejs/*"
-      vitest:
-        patterns:
-          - "vitest"
-          - "@vitest/*"
-      testing-library:
-        patterns:
-          - "@testing-library/*"
-      i18next:
-        patterns:
-          - "i18next"
-          - "i18next-*"
-          - "react-i18next"
-      iconify:
-        patterns:
-          - "@iconify/*"
-          - "@iconify-json/*"
-      stripe:
-        patterns:
-          - "@stripe/*"
-      posthog:
-        patterns:
-          - "@posthog/*"
-          - "posthog-js"
-      supabase:
-        patterns:
-          - "@supabase/*"
-      dnd-kit:
-        patterns:
-          - "@dnd-kit/*"
-      tailwind:
-        patterns:
-          - "tailwindcss"
-          - "@tailwindcss/*"
-      postcss:
-        patterns:
-          - "postcss"
-          - "postcss-*"
-        exclude-patterns:
-          - "postcss-preset-mantine"
 
   - package-ecosystem: cargo
-    directories:
-      - /frontend/src-tauri
-      - /frontend/src-tauri/thumbnail-handler
-      - /frontend/src-tauri/provisioner
+    directory: /frontend/src-tauri
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
     rebase-strategy: "auto"
-    groups:
-      tauri:
-        patterns:
-          - "tauri"
-          - "tauri-build"
-          - "tauri-plugin-*"
-      serde:
-        patterns:
-          - "serde"
-          - "serde_*"
-      tracing:
-        patterns:
-          - "tracing"
-          - "tracing-*"
-      tokio:
-        patterns:
-          - "tokio"
-          - "tokio-*"
 
   - package-ecosystem: pip
     directory: /testing/cucumber
     schedule:
       interval: "weekly"
-    cooldown:
-      default-days: 7
     rebase-strategy: "auto"
+
+  - package-ecosystem: cargo
+    directory: /frontend/src-tauri/provisioner
+    schedule:
+      interval: daily

.github/labeler-config-srvaroa.yml

@@ -72,12 +72,6 @@ labels:
       - 'frontend/src-tauri/**'
       - 'frontend/src-tauri/.*'
 
-  - label: 'engine'
-    files:
-      - 'engine/**'
-      - 'engine/.*'
-      - 'engine/**/.*'
-
   - label: 'Java'
     files:
       - 'app/common/src/main/java/.*.java'

.github/release.yml

@@ -1,11 +1,4 @@
 changelog:
-  exclude:
-    labels:
-      - ignore-for-release
-      # engine: Python AI engine - not currently live / not yet shipped to users.
-      # Remove this entry once the engine is released.
-      - engine
-
   categories:
     - title: Breaking Changes
       labels:
@@ -13,22 +6,16 @@ changelog:
 
     - title: Bug Fixes
       labels:
-        - Bugfix
         - Bug
 
     - title: Enhancements
       labels:
         - enhancement
-        - Java
-        - Front End
-        - Back End
-        - Tauri
 
     - title: Minor Enhancements
       labels:
-        - chore
-        - style
-        - refactor
+        - Java
+        - Front End
 
     - title: Docker Updates
       labels:

.github/scripts/requirements_dev.txt

@@ -9,7 +9,7 @@
 # CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
     # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
     #   fonttools
 cffi==2.0.0 \
     --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@@ -101,274 +101,270 @@ cfgv==3.5.0 \
     --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
     --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
     # via pre-commit
-cssselect2==0.9.0 \
-    --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
-    --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
+cssselect2==0.8.0 \
+    --hash=sha256:46fc70ebc41ced7a32cd42d58b1884d72ade23d21e5a4eaaf022401c13f0e76e \
+    --hash=sha256:7674ffb954a3b46162392aee2a3a0aedb2e14ecf99fcc28644900f4e6e3e9d3a
     # via weasyprint
 distlib==0.4.0 \
     --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
     --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
     # via virtualenv
-filelock==3.29.0 \
-    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
-    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
-    # via
-    #   python-discovery
-    #   virtualenv
-fonttools==4.62.1 \
-    --hash=sha256:0aa72c43a601cfa9273bb1ae0518f1acadc01ee181a6fc60cd758d7fdadffc04 \
-    --hash=sha256:0b3ae47e8636156a9accff64c02c0924cbebad62854c4a6dbdc110cd5b4b341a \
-    --hash=sha256:12859ff0b47dd20f110804c3e0d0970f7b832f561630cd879969011541a464a9 \
-    --hash=sha256:149f7d84afca659d1a97e39a4778794a2f83bf344c5ee5134e09995086cc2392 \
-    --hash=sha256:1596aeaddf7f78e21e68293c011316a25267b3effdaccaf4d59bc9159d681b82 \
-    --hash=sha256:19177c8d96c7c36359266e571c5173bcee9157b59cfc8cb0153c5673dc5a3a7d \
-    --hash=sha256:1c5c25671ce8805e0d080e2ffdeca7f1e86778c5cbfbeae86d7f866d8830517b \
-    --hash=sha256:1eecc128c86c552fb963fe846ca4e011b1be053728f798185a1687502f6d398e \
-    --hash=sha256:268abb1cb221e66c014acc234e872b7870d8b5d4657a83a8f4205094c32d2416 \
-    --hash=sha256:2d850f66830a27b0d498ee05adb13a3781637b1826982cd7e2b3789ef0cc71ae \
-    --hash=sha256:2e7abd2b1e11736f58c1de27819e1955a53267c21732e78243fa2fa2e5c1e069 \
-    --hash=sha256:403d28ce06ebfc547fbcb0cb8b7f7cc2f7a2d3e1a67ba9a34b14632df9e080f9 \
-    --hash=sha256:40975849bac44fb0b9253d77420c6d8b523ac4dcdcefeff6e4d706838a5b80f7 \
-    --hash=sha256:486f32c8047ccd05652aba17e4a8819a3a9d78570eb8a0e3b4503142947880ed \
-    --hash=sha256:49a445d2f544ce4a69338694cad575ba97b9a75fff02720da0882d1a73f12800 \
-    --hash=sha256:59b372b4f0e113d3746b88985f1c796e7bf830dd54b28374cd85c2b8acd7583e \
-    --hash=sha256:5a648bde915fba9da05ae98856987ca91ba832949a9e2888b48c47ef8b96c5a9 \
-    --hash=sha256:5f37df1cac61d906e7b836abe356bc2f34c99d4477467755c216b72aa3dc748b \
-    --hash=sha256:6706d1cb1d5e6251a97ad3c1b9347505c5615c112e66047abbef0f8545fa30d1 \
-    --hash=sha256:68959f5fc58ed4599b44aad161c2837477d7f35f5f79402d97439974faebfebe \
-    --hash=sha256:6acb4109f8bee00fec985c8c7afb02299e35e9c94b57287f3ea542f28bd0b0a7 \
-    --hash=sha256:7487782e2113861f4ddcc07c3436450659e3caa5e470b27dc2177cade2d8e7fd \
-    --hash=sha256:7aa21ff53e28a9c2157acbc44e5b401149d3c9178107130e82d74ceb500e5056 \
-    --hash=sha256:7bca7a1c1faf235ffe25d4f2e555246b4750220b38de8261d94ebc5ce8a23c23 \
-    --hash=sha256:8d337fdd49a79b0d51c4da87bc38169d21c3abbf0c1aa9367eff5c6656fb6dae \
-    --hash=sha256:8f8fca95d3bb3208f59626a4b0ea6e526ee51f5a8ad5d91821c165903e8d9260 \
-    --hash=sha256:90365821debbd7db678809c7491ca4acd1e0779b9624cdc6ddaf1f31992bf974 \
-    --hash=sha256:92bb00a947e666169c99b43753c4305fc95a890a60ef3aeb2a6963e07902cc87 \
-    --hash=sha256:93c316e0f5301b2adbe6a5f658634307c096fd5aae60a5b3412e4f3e1728ab24 \
-    --hash=sha256:942b03094d7edbb99bdf1ae7e9090898cad7bf9030b3d21f33d7072dbcb51a53 \
-    --hash=sha256:9c125ffa00c3d9003cdaaf7f2c79e6e535628093e14b5de1dccb08859b680936 \
-    --hash=sha256:9dde91633f77fa576879a0c76b1d89de373cae751a98ddf0109d54e173b40f14 \
-    --hash=sha256:9e7863e10b3de72376280b515d35b14f5eeed639d1aa7824f4cf06779ec65e42 \
-    --hash=sha256:a24decd24d60744ee8b4679d38e88b8303d86772053afc29b19d23bb8207803c \
-    --hash=sha256:a5d8825e1140f04e6c99bb7d37a9e31c172f3bc208afbe02175339e699c710e1 \
-    --hash=sha256:aa69d10ed420d8121118e628ad47d86e4caa79ba37f968597b958f6cceab7eca \
-    --hash=sha256:ad5cca75776cd453b1b035b530e943334957ae152a36a88a320e779d61fc980c \
-    --hash=sha256:b4e0fcf265ad26e487c56cb12a42dffe7162de708762db951e1b3f755319507d \
-    --hash=sha256:b820fcb92d4655513d8402d5b219f94481c4443d825b4372c75a2072aa4b357a \
-    --hash=sha256:bd13b7999d59c5eb1c2b442eb2d0c427cb517a0b7a1f5798fc5c9e003f5ff782 \
-    --hash=sha256:bdfe592802ef939a0e33106ea4a318eeb17822c7ee168c290273cbd5fabd746c \
-    --hash=sha256:c05557a78f8fa514da0f869556eeda40887a8abc77c76ee3f74cf241778afd5a \
-    --hash=sha256:c22b1014017111c401469e3acc5433e6acf6ebcc6aa9efb538a533c800971c79 \
-    --hash=sha256:c9b9e288b4da2f64fd6180644221749de651703e8d0c16bd4b719533a3a7d6e3 \
-    --hash=sha256:d241cdc4a67b5431c6d7f115fdf63335222414995e3a1df1a41e1182acd4bcc7 \
-    --hash=sha256:e54c75fd6041f1122476776880f7c3c3295ffa31962dc6ebe2543c00dca58b5d \
-    --hash=sha256:e8514f4924375f77084e81467e63238b095abda5107620f49421c368a6017ed2 \
-    --hash=sha256:ee91628c08e76f77b533d65feb3fbe6d9dad699f95be51cf0d022db94089cdc4 \
-    --hash=sha256:ef46db46c9447103b8f3ff91e8ba009d5fe181b1920a83757a5762551e32bb68 \
-    --hash=sha256:fa1d16210b6b10a826d71bed68dd9ec24a9e218d5a5e2797f37c573e7ec215ca
+filelock==3.20.3 \
+    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
+    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+    # via virtualenv
+fonttools==4.61.1 \
+    --hash=sha256:0de30bfe7745c0d1ffa2b0b7048fb7123ad0d71107e10ee090fa0b16b9452e87 \
+    --hash=sha256:10d88e55330e092940584774ee5e8a6971b01fc2f4d3466a1d6c158230880796 \
+    --hash=sha256:11f35ad7805edba3aac1a3710d104592df59f4b957e30108ae0ba6c10b11dd75 \
+    --hash=sha256:15acc09befd16a0fb8a8f62bc147e1a82817542d72184acca9ce6e0aeda9fa6d \
+    --hash=sha256:17d2bf5d541add43822bcf0c43d7d847b160c9bb01d15d5007d84e2217aaa371 \
+    --hash=sha256:2180f14c141d2f0f3da43f3a81bc8aa4684860f6b0e6f9e165a4831f24e6a23b \
+    --hash=sha256:21e7c8d76f62ab13c9472ccf74515ca5b9a761d1bde3265152a6dc58700d895b \
+    --hash=sha256:41a7170d042e8c0024703ed13b71893519a1a6d6e18e933e3ec7507a2c26a4b2 \
+    --hash=sha256:41ed4b5ec103bd306bb68f81dc166e77409e5209443e5773cb4ed837bcc9b0d3 \
+    --hash=sha256:497c31ce314219888c0e2fce5ad9178ca83fe5230b01a5006726cdf3ac9f24d9 \
+    --hash=sha256:4c1b526c8d3f615a7b1867f38a9410849c8f4aef078535742198e942fba0e9bd \
+    --hash=sha256:4d7092bb38c53bbc78e9255a59158b150bcdc115a1e3b3ce0b5f267dc35dd63c \
+    --hash=sha256:4f5686e1fe5fce75d82d93c47a438a25bf0d1319d2843a926f741140b2b16e0c \
+    --hash=sha256:58b0ee0ab5b1fc9921eccfe11d1435added19d6494dde14e323f25ad2bc30c56 \
+    --hash=sha256:5ce02f38a754f207f2f06557523cd39a06438ba3aafc0639c477ac409fc64e37 \
+    --hash=sha256:5fade934607a523614726119164ff621e8c30e8fa1ffffbbd358662056ba69f0 \
+    --hash=sha256:5fe9fd43882620017add5eabb781ebfbc6998ee49b35bd7f8f79af1f9f99a958 \
+    --hash=sha256:64102ca87e84261419c3747a0d20f396eb024bdbeb04c2bfb37e2891f5fadcb5 \
+    --hash=sha256:664c5a68ec406f6b1547946683008576ef8b38275608e1cee6c061828171c118 \
+    --hash=sha256:6675329885c44657f826ef01d9e4fb33b9158e9d93c537d84ad8399539bc6f69 \
+    --hash=sha256:75c1a6dfac6abd407634420c93864a1e274ebc1c7531346d9254c0d8f6ca00f9 \
+    --hash=sha256:75da8f28eff26defba42c52986de97b22106cb8f26515b7c22443ebc9c2d3261 \
+    --hash=sha256:77efb033d8d7ff233385f30c62c7c79271c8885d5c9657d967ede124671bbdfb \
+    --hash=sha256:78a7d3ab09dc47ac1a363a493e6112d8cabed7ba7caad5f54dbe2f08676d1b47 \
+    --hash=sha256:7c7db70d57e5e1089a274cbb2b1fd635c9a24de809a231b154965d415d6c6d24 \
+    --hash=sha256:8c56c488ab471628ff3bfa80964372fc13504ece601e0d97a78ee74126b2045c \
+    --hash=sha256:91669ccac46bbc1d09e9273546181919064e8df73488ea087dcac3e2968df9ba \
+    --hash=sha256:9b666a475a65f4e839d3d10473fad6d47e0a9db14a2f4a224029c5bfde58ad2c \
+    --hash=sha256:9cfef3ab326780c04d6646f68d4b4742aae222e8b8ea1d627c74e38afcbc9d91 \
+    --hash=sha256:a13fc8aeb24bad755eea8f7f9d409438eb94e82cf86b08fe77a03fbc8f6a96b1 \
+    --hash=sha256:a75c301f96db737e1c5ed5fd7d77d9c34466de16095a266509e13da09751bd19 \
+    --hash=sha256:a76d4cb80f41ba94a6691264be76435e5f72f2cb3cab0b092a6212855f71c2f6 \
+    --hash=sha256:aed04cabe26f30c1647ef0e8fbb207516fd40fe9472e9439695f5c6998e60ac5 \
+    --hash=sha256:b148b56f5de675ee16d45e769e69f87623a4944f7443850bf9a9376e628a89d2 \
+    --hash=sha256:b501c862d4901792adaec7c25b1ecc749e2662543f68bb194c42ba18d6eec98d \
+    --hash=sha256:b846a1fcf8beadeb9ea4f44ec5bdde393e2f1569e17d700bfc49cd69bde75881 \
+    --hash=sha256:b931ae8f62db78861b0ff1ac017851764602288575d65b8e8ff1963fed419063 \
+    --hash=sha256:c33ab3ca9d3ccd581d58e989d67554e42d8d4ded94ab3ade3508455fe70e65f7 \
+    --hash=sha256:c6604b735bb12fef8e0efd5578c9fb5d3d8532d5001ea13a19cddf295673ee09 \
+    --hash=sha256:d8db08051fc9e7d8bc622f2112511b8107d8f27cd89e2f64ec45e9825e8288da \
+    --hash=sha256:d9203500f7c63545b4ce3799319fe4d9feb1a1b89b28d3cb5abd11b9dd64147e \
+    --hash=sha256:dc492779501fa723b04d0ab1f5be046797fee17d27700476edc7ee9ae535a61e \
+    --hash=sha256:e6bcdf33aec38d16508ce61fd81838f24c83c90a1d1b8c68982857038673d6b8 \
+    --hash=sha256:e76ce097e3c57c4bcb67c5aa24a0ecdbd9f74ea9219997a707a4061fbe2707aa \
+    --hash=sha256:eff1ac3cc66c2ac7cda1e64b4e2f3ffef474b7335f92fc3833fc632d595fcee6 \
+    --hash=sha256:f3cb4a569029b9f291f88aafc927dd53683757e640081ca8c412781ea144565e \
+    --hash=sha256:f79b168428351d11e10c5aeb61a74e1851ec221081299f4cf56036a95431c43a \
+    --hash=sha256:fa646ecec9528bef693415c79a86e733c70a4965dd938e9a226b0fc64c9d2e6c \
+    --hash=sha256:fe2efccb324948a11dd09d22136fe2ac8a97d6c1347cf0b58a911dcd529f66b7 \
+    --hash=sha256:fff4f534200a04b4a36e7ae3cb74493afe807b517a09e99cb4faa89a34ed6ecd
     # via weasyprint
-identify==2.6.19 \
-    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
-    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+identify==2.6.16 \
+    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
+    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
     # via pre-commit
 nodeenv==1.10.0 \
     --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
     --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
     # via pre-commit
-numpy==2.4.4 \
-    --hash=sha256:07077278157d02f65c43b1b26a3886bce886f95d20aabd11f87932750dfb14ed \
-    --hash=sha256:08f2e31ed5e6f04b118e49821397f12767934cfdd12a1ce86a058f91e004ee50 \
-    --hash=sha256:0aec54fd785890ecca25a6003fd9a5aed47ad607bbac5cd64f836ad8666f4959 \
-    --hash=sha256:0d35aea54ad1d420c812bfa0385c71cd7cc5bcf7c65fed95fc2cd02fe8c79827 \
-    --hash=sha256:0d4e437e295f18ec29bc79daf55e8a47a9113df44d66f702f02a293d93a2d6dd \
-    --hash=sha256:0dfd3f9d3adbe2920b68b5cd3d51444e13a10792ec7154cd0a2f6e74d4ab3233 \
-    --hash=sha256:1378871da56ca8943c2ba674530924bb8ca40cd228358a3b5f302ad60cf875fc \
-    --hash=sha256:15716cfef24d3a9762e3acdf87e27f58dc823d1348f765bbea6bef8c639bfa1b \
-    --hash=sha256:19710a9ca9992d7174e9c52f643d4272dcd1558c5f7af7f6f8190f633bd651a7 \
-    --hash=sha256:23cbfd4c17357c81021f21540da84ee282b9c8fba38a03b7b9d09ba6b951421e \
-    --hash=sha256:2483e4584a1cb3092da4470b38866634bafb223cbcd551ee047633fd2584599a \
-    --hash=sha256:27a8d92cd10f1382a67d7cf4db7ce18341b66438bdd9f691d7b0e48d104c2a9d \
-    --hash=sha256:28a650663f7314afc3e6ec620f44f333c386aad9f6fc472030865dc0ebb26ee3 \
-    --hash=sha256:2aa0613a5177c264ff5921051a5719d20095ea586ca88cc802c5c218d1c67d3e \
-    --hash=sha256:2c194dd721e54ecad9ad387c1d35e63dce5c4450c6dc7dd5611283dda239aabb \
-    --hash=sha256:2d19e6e2095506d1736b7d80595e0f252d76b89f5e715c35e06e937679ea7d7a \
-    --hash=sha256:2d390634c5182175533585cc89f3608a4682ccb173cc9bb940b2881c8d6f8fa0 \
-    --hash=sha256:30caa73029a225b2d40d9fae193e008e24b2026b7ee1a867b7ee8d96ca1a448e \
-    --hash=sha256:42c16925aa5a02362f986765f9ebabf20de75cdefdca827d14315c568dcab113 \
-    --hash=sha256:45dbed2ab436a9e826e302fcdcbe9133f9b0006e5af7168afb8963a6520da103 \
-    --hash=sha256:4636de7fd195197b7535f231b5de9e4b36d2c440b6e566d2e4e4746e6af0ca93 \
-    --hash=sha256:4a19d9dba1a76618dd86b164d608566f393f8ec6ac7c44f0cc879011c45e65af \
-    --hash=sha256:4bbc7f303d125971f60ec0aaad5e12c62d0d2c925f0ab1273debd0e4ba37aba5 \
-    --hash=sha256:4d6d57903571f86180eb98f8f0c839fa9ebbfb031356d87f1361be91e433f5b7 \
-    --hash=sha256:4e874c976154687c1f71715b034739b45c7711bec81db01914770373d125e392 \
-    --hash=sha256:51fc224f7ca4d92656d5a5eb315f12eb5fe2c97a66249aa7b5f562528a3be38c \
-    --hash=sha256:58c8b5929fcb8287cbd6f0a3fae19c6e03a5c48402ae792962ac465224a629a4 \
-    --hash=sha256:5a285b3b96f951841799528cd1f4f01cd70e7e0204b4abebac9463eecfcf2a40 \
-    --hash=sha256:5c70f1cc1c4efbe316a572e2d8b9b9cc44e89b95f79ca3331553fbb63716e2bf \
-    --hash=sha256:62d6b0f03b694173f9fcb1fb317f7222fd0b0b103e784c6549f5e53a27718c44 \
-    --hash=sha256:6a246d5914aa1c820c9443ddcee9c02bec3e203b0c080349533fae17727dfd1b \
-    --hash=sha256:6aa3236c78803afbcb255045fbef97a9e25a1f6c9888357d205ddc42f4d6eba5 \
-    --hash=sha256:6bbe4eb67390b0a0265a2c25458f6b90a409d5d069f1041e6aff1e27e3d9a79e \
-    --hash=sha256:715d1c092715954784bc79e1174fc2a90093dc4dc84ea15eb14dad8abdcdeb74 \
-    --hash=sha256:72944b19f2324114e9dc86a159787333b77874143efcf89a5167ef83cfee8af0 \
-    --hash=sha256:81f4a14bee47aec54f883e0cad2d73986640c1590eb9bfaaba7ad17394481e6e \
-    --hash=sha256:846300f379b5b12cc769334464656bc882e0735d27d9726568bc932fdc49d5ec \
-    --hash=sha256:86b6f55f5a352b48d7fbfd2dbc3d5b780b2d79f4d3c121f33eb6efb22e9a2015 \
-    --hash=sha256:874f200b2a981c647340f841730fc3a2b54c9d940566a3c4149099591e2c4c3d \
-    --hash=sha256:8a87ec22c87be071b6bdbd27920b129b94f2fc964358ce38f3822635a3e2e03d \
-    --hash=sha256:8b3b60bb7cba2c8c81837661c488637eee696f59a877788a396d33150c35d842 \
-    --hash=sha256:8e3ed142f2728df44263aaf5fb1f5b0b99f4070c553a0d7f033be65338329150 \
-    --hash=sha256:93e15038125dc1e5345d9b5b68aa7f996ec33b98118d18c6ca0d0b7d6198b7e8 \
-    --hash=sha256:989824e9faf85f96ec9c7761cd8d29c531ad857bfa1daa930cba85baaecf1a9a \
-    --hash=sha256:99d838547ace2c4aace6c4f76e879ddfe02bb58a80c1549928477862b7a6d6ed \
-    --hash=sha256:9b2aec6af35c113b05695ebb5749a787acd63cafc83086a05771d1e1cd1e555f \
-    --hash=sha256:9c585a1790d5436a5374bac930dad6ed244c046ed91b2b2a3634eb2971d21008 \
-    --hash=sha256:a7164afb23be6e37ad90b2f10426149fd75aee07ca55653d2aa41e66c4ef697e \
-    --hash=sha256:ac6b31e35612a26483e20750126d30d0941f949426974cace8e6b5c58a3657b0 \
-    --hash=sha256:ad2e2ef14e0b04e544ea2fa0a36463f847f113d314aa02e5b402fdf910ef309e \
-    --hash=sha256:b268594bccac7d7cf5844c7732e3f20c50921d94e36d7ec9b79e9857694b1b2f \
-    --hash=sha256:b5f0362dc928a6ecd9db58868fca5e48485205e3855957bdedea308f8672ea4a \
-    --hash=sha256:ba1f4fc670ed79f876f70082eff4f9583c15fb9a4b89d6188412de4d18ae2f40 \
-    --hash=sha256:ba203255017337d39f89bdd58417f03c4426f12beed0440cfd933cb15f8669c7 \
-    --hash=sha256:c901b15172510173f5cb310eae652908340f8dede90fff9e3bf6c0d8dfd92f83 \
-    --hash=sha256:c9b39d38a9bd2ae1becd7eac1303d031c5c110ad31f2b319c6e7d98b135c934d \
-    --hash=sha256:d2a8490669bfe99a233298348acc2d824d496dee0e66e31b66a6022c2ad74a5c \
-    --hash=sha256:dddbbd259598d7240b18c9d87c56a9d2fb3b02fe266f49a7c101532e78c1d871 \
-    --hash=sha256:df3775294accfdd75f32c74ae39fcba920c9a378a2fc18a12b6820aa8c1fb502 \
-    --hash=sha256:e44319a2953c738205bf3354537979eaa3998ed673395b964c1176083dd46252 \
-    --hash=sha256:e4a010c27ff6f210ff4c6ef34394cd61470d01014439b192ec22552ee867f2a8 \
-    --hash=sha256:e823b8b6edc81e747526f70f71a9c0a07ac4e7ad13020aa736bb7c9d67196115 \
-    --hash=sha256:e892aff75639bbef0d2a2cfd55535510df26ff92f63c92cd84ef8d4ba5a5557f \
-    --hash=sha256:eea7ac5d2dce4189771cedb559c738a71512768210dc4e4753b107a2048b3d0e \
-    --hash=sha256:ef4059d6e5152fa1a39f888e344c73fdc926e1b2dd58c771d67b0acfbf2aa67d \
-    --hash=sha256:f169b9a863d34f5d11b8698ead99febeaa17a13ca044961aa8e2662a6c7766a0 \
-    --hash=sha256:f2cf083b324a467e1ab358c105f6cad5ea950f50524668a80c486ff1db24e119 \
-    --hash=sha256:f8474c4241bc18b750be2abea9d7a9ec84f46ef861dbacf86a4f6e043401f79e \
-    --hash=sha256:f983334aea213c99992053ede6168500e5f086ce74fbc4acc3f2b00f5762e9db \
-    --hash=sha256:f9e75681b59ddaa5e659898085ae0eaea229d054f2ac0c7e563a62205a700121 \
-    --hash=sha256:fbc356aae7adf9e6336d336b9c8111d390a05df88f1805573ebb0807bd06fd1d \
-    --hash=sha256:fcfe2045fd2e8f3cb0ce9d4ba6dba6333b8fa05bb8a4939c908cd43322d14c7e
+numpy==2.4.1 \
+    --hash=sha256:0093e85df2960d7e4049664b26afc58b03236e967fb942354deef3208857a04c \
+    --hash=sha256:09aa8a87e45b55a1c2c205d42e2808849ece5c484b2aab11fecabec3841cafba \
+    --hash=sha256:0cce2a669e3c8ba02ee563c7835f92c153cf02edff1ae05e1823f1dde21b16a5 \
+    --hash=sha256:0e6e8f9d9ecf95399982019c01223dc130542960a12edfa8edd1122dfa66a8a8 \
+    --hash=sha256:0f118ce6b972080ba0758c6087c3617b5ba243d806268623dc34216d69099ba0 \
+    --hash=sha256:178de8f87948163d98a4c9ab5bee4ce6519ca918926ec8df195af582de28544d \
+    --hash=sha256:18e14c4d09d55eef39a6ab5b08406e84bc6869c1e34eef45564804f90b7e0574 \
+    --hash=sha256:2023ef86243690c2791fd6353e5b4848eedaa88ca8a2d129f462049f6d484696 \
+    --hash=sha256:20d4649c773f66cc2fc36f663e091f57c3b7655f936a4c681b4250855d1da8f5 \
+    --hash=sha256:2302dc0224c1cbc49bb94f7064f3f923a971bfae45c33870dcbff63a2a550505 \
+    --hash=sha256:26f0bcd9c79a00e339565b303badc74d3ea2bd6d52191eeca5f95936cad107d0 \
+    --hash=sha256:297c72b1b98100c2e8f873d5d35fb551fce7040ade83d67dd51d38c8d42a2162 \
+    --hash=sha256:2f44de05659b67d20499cbc96d49f2650769afcb398b79b324bb6e297bfe3844 \
+    --hash=sha256:2ffd257026eb1b34352e749d7cc1678b5eeec3e329ad8c9965a797e08ccba205 \
+    --hash=sha256:382ad67d99ef49024f11d1ce5dcb5ad8432446e4246a4b014418ba3a1175a1f4 \
+    --hash=sha256:3869ea1ee1a1edc16c29bbe3a2f2a4e515cc3a44d43903ad41e0cacdbaf733dc \
+    --hash=sha256:3d1a100e48cb266090a031397863ff8a30050ceefd798f686ff92c67a486753d \
+    --hash=sha256:423797bdab2eeefbe608d7c1ec7b2b4fd3c58d51460f1ee26c7500a1d9c9ee93 \
+    --hash=sha256:42d7dd5fa36d16d52a84f821eb96031836fd405ee6955dd732f2023724d0aa01 \
+    --hash=sha256:49e792ec351315e16da54b543db06ca8a86985ab682602d90c60ef4ff4db2a9c \
+    --hash=sha256:4e53170557d37ae404bf8d542ca5b7c629d6efa1117dac6a83e394142ea0a43f \
+    --hash=sha256:4f1b68ff47680c2925f8063402a693ede215f0257f02596b1318ecdfb1d79e33 \
+    --hash=sha256:4f9c360ecef085e5841c539a9a12b883dff005fbd7ce46722f5e9cef52634d82 \
+    --hash=sha256:529050522e983e00a6c1c6b67411083630de8b57f65e853d7b03d9281b8694d2 \
+    --hash=sha256:52b5f61bdb323b566b528899cc7db2ba5d1015bda7ea811a8bcf3c89c331fa42 \
+    --hash=sha256:538bf4ec353709c765ff75ae616c34d3c3dca1a68312727e8f2676ea644f8509 \
+    --hash=sha256:5adf01965456a664fc727ed69cc71848f28d063217c63e1a0e200a118d5eec9a \
+    --hash=sha256:5b55aa56165b17aaf15520beb9cbd33c9039810e0d9643dd4379e44294c7303e \
+    --hash=sha256:5d558123217a83b2d1ba316b986e9248a1ed1971ad495963d555ccd75dcb1556 \
+    --hash=sha256:5de60946f14ebe15e713a6f22850c2372fa72f4ff9a432ab44aa90edcadaa65a \
+    --hash=sha256:62fea415f83ad8fdb6c20840578e5fbaf5ddd65e0ec6c3c47eda0f69da172510 \
+    --hash=sha256:6436cffb4f2bf26c974344439439c95e152c9a527013f26b3577be6c2ca64295 \
+    --hash=sha256:6461de5113088b399d655d45c3897fa188766415d0f568f175ab071c8873bd73 \
+    --hash=sha256:69e7419c9012c4aaf695109564e3387f1259f001b4326dfa55907b098af082d3 \
+    --hash=sha256:71abbea030f2cfc3092a0ff9f8c8fdefdc5e0bf7d9d9c99663538bb0ecdac0b9 \
+    --hash=sha256:7211b95ca365519d3596a1d8688a95874cc94219d417504d9ecb2df99fa7bfa8 \
+    --hash=sha256:727c6c3275ddefa0dc078524a85e064c057b4f4e71ca5ca29a19163c607be745 \
+    --hash=sha256:79e9e06c4c2379db47f3f6fc7a8652e7498251789bf8ff5bd43bf478ef314ca2 \
+    --hash=sha256:7ad270f438cbdd402c364980317fb6b117d9ec5e226fff5b4148dd9aa9fc6e02 \
+    --hash=sha256:7d5d7999df434a038d75a748275cd6c0094b0ecdb0837342b332a82defc4dc4d \
+    --hash=sha256:8097529164c0f3e32bb89412a0905d9100bf434d9692d9fc275e18dcf53c9344 \
+    --hash=sha256:82c55962006156aeef1629b953fd359064aa47e4d82cfc8e67f0918f7da3344f \
+    --hash=sha256:8361ea4220d763e54cff2fbe7d8c93526b744f7cd9ddab47afeff7e14e8503be \
+    --hash=sha256:899d2c18024984814ac7e83f8f49d8e8180e2fbe1b2e252f2e7f1d06bea92425 \
+    --hash=sha256:8ad35f20be147a204e28b6a0575fbf3540c5e5f802634d4258d55b1ff5facce1 \
+    --hash=sha256:8f085da926c0d491ffff3096f91078cc97ea67e7e6b65e490bc8dcda65663be2 \
+    --hash=sha256:9171a42fcad32dcf3fa86f0a4faa5e9f8facefdb276f54b8b390d90447cff4e2 \
+    --hash=sha256:92a0e65272fd60bfa0d9278e0484c2f52fe03b97aedc02b357f33fe752c52ffb \
+    --hash=sha256:941c2a93313d030f219f3a71fd3d91a728b82979a5e8034eb2e60d394a2b83f9 \
+    --hash=sha256:98b35775e03ab7f868908b524fc0a84d38932d8daf7b7e1c3c3a1b6c7a2c9f15 \
+    --hash=sha256:a1ceafc5042451a858231588a104093474c6a5c57dcc724841f5c888d237d690 \
+    --hash=sha256:a73044b752f5d34d4232f25f18160a1cc418ea4507f5f11e299d8ac36875f8a0 \
+    --hash=sha256:a7870e8c5fc11aef57d6fea4b4085e537a3a60ad2cdd14322ed531fdca68d261 \
+    --hash=sha256:a92f227dbcdc9e4c3e193add1a189a9909947d4f8504c576f4a732fd0b54240a \
+    --hash=sha256:ac08c63cb7779b85e9d5318e6c3518b424bc1f364ac4cb2c6136f12e5ff2dccc \
+    --hash=sha256:b6bcf39112e956594b3331316d90c90c90fb961e39696bda97b89462f5f3943f \
+    --hash=sha256:c0faba4a331195bfa96f93dd9dfaa10b2c7aa8cda3a02b7fd635e588fe821bf5 \
+    --hash=sha256:ce9ce141a505053b3c7bce3216071f3bf5c182b8b28930f14cd24d43932cd2df \
+    --hash=sha256:cf6470d91d34bf669f61d515499859fa7a4c2f7c36434afb70e82df7217933f9 \
+    --hash=sha256:d3703409aac693fa82c0aee023a1ae06a6e9d065dba10f5e8e80f642f1e9d0a2 \
+    --hash=sha256:d3e3087f53e2b4428766b54932644d148613c5a595150533ae7f00dab2f319a8 \
+    --hash=sha256:d3f8f0df9f4b8be57b3bf74a1d087fec68f927a2fab68231fdb442bf2c12e426 \
+    --hash=sha256:d797454e37570cfd61143b73b8debd623c3c0952959adb817dd310a483d58a1b \
+    --hash=sha256:e1a27bb1b2dee45a2a53f5ca6ff2d1a7f135287883a1689e930d44d1ff296c87 \
+    --hash=sha256:e3bd2cb07841166420d2fa7146c96ce00cb3410664cbc1a6be028e456c4ee220 \
+    --hash=sha256:e7b6b5e28bbd47b7532698e5db2fe1db693d84b58c254e4389d99a27bb9b8f6b \
+    --hash=sha256:e867df947d427cdd7a60e3e271729090b0f0df80f5f10ab7dd436f40811699c3 \
+    --hash=sha256:ea66d2b41ca4a1630aae5507ee0a71647d3124d1741980138aa8f28f44dac36e \
+    --hash=sha256:edee228f76ee2dab4579fad6f51f6a305de09d444280109e0f75df247ff21501 \
+    --hash=sha256:f0a90aba7d521e6954670550e561a4cb925713bd944445dbe9e729b71f6cabee \
+    --hash=sha256:f93bc6892fe7b0663e5ffa83b61aab510aacffd58c16e012bb9352d489d90cb7 \
+    --hash=sha256:fb1461c99de4d040666ca0444057b06541e5642f800b71c56e6ea92d6a853a0c
     # via opencv-python-headless
-opencv-python-headless==4.13.0.92 \
-    --hash=sha256:0525a3d2c0b46c611e2130b5fdebc94cf404845d8fa64d2f3a3b679572a5bd22 \
-    --hash=sha256:0bd48544f77c68b2941392fcdf9bcd2b9cdf00e98cb8c29b2455d194763cf99e \
-    --hash=sha256:1a7d040ac656c11b8c38677cc8cccdc149f98535089dbe5b081e80a4e5903209 \
-    --hash=sha256:3e0a6f0a37994ec6ce5f59e936be21d5d6384a4556f2d2da9c2f9c5dc948394c \
-    --hash=sha256:5c8cfc8e87ed452b5cecb9419473ee5560a989859fe1d10d1ce11ae87b09a2cb \
-    --hash=sha256:77a82fe35ddcec0f62c15f2ba8a12ecc2ed4207c17b0902c7a3151ae29f37fb6 \
-    --hash=sha256:a7cf08e5b191f4ebb530791acc0825a7986e0d0dee2a3c491184bd8599848a4b \
-    --hash=sha256:eb60e36b237b1ebd40a912da5384b348df8ed534f6f644d8e0b4f103e272ba7d
-    # via -r .github/scripts/requirements_dev.in
+opencv-python-headless==4.13.0.90 \
+    --hash=sha256:0e0c8c9f620802fddc4fa7f471a1d263c7b0dca16cd9e7e2f996bb8bd2128c0c \
+    --hash=sha256:12a28674f215542c9bf93338de1b5bffd76996d32da9acb9e739fdb9c8bbd738 \
+    --hash=sha256:32255203040dc98803be96362e13f9e4bce20146898222d2e5c242f80de50da5 \
+    --hash=sha256:96060fc57a1abb1144b0b8129e2ff3bfcdd0ccd8e8bd05bd85256ff4ed587d3b \
+    --hash=sha256:dbc1f4625e5af3a80ebdbd84380227c0f445228588f2521b11af47710caca1ba \
+    --hash=sha256:e13790342591557050157713af17a7435ac1b50c65282715093c9297fa045d8f \
+    --hash=sha256:eba38bc255d0b7d1969c5bcc90a060ca2b61a3403b613872c750bfa5dfe9e03b \
+    --hash=sha256:f46b17ea0aa7e4124ca6ad71143f89233ae9557f61d2326bcdb34329a1ddf9bd
+    # via -r requirements_dev.in
 pdf2image==1.17.0 \
     --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
     --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
-    # via -r .github/scripts/requirements_dev.in
-pillow==12.2.0 \
-    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
-    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
-    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
-    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
-    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
-    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
-    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
-    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
-    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
-    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
-    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
-    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
-    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
-    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
-    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
-    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
-    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
-    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
-    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
-    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
-    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
-    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
-    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
-    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
-    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
-    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
-    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
-    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
-    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
-    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
-    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
-    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
-    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
-    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
-    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
-    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
-    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
-    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
-    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
-    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
-    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
-    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
-    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
-    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
-    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
-    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
-    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
-    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
-    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
-    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
-    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
-    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
-    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
-    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
-    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
-    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
-    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
-    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
-    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
-    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
-    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
-    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
-    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
-    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
-    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
-    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
-    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
-    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
-    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
-    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
-    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
-    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
-    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
-    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
-    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
-    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
-    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
-    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
-    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
-    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
-    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
-    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
-    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
-    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
-    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
-    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
-    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
-    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
-    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
-    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
-    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
+    # via -r requirements_dev.in
+pillow==12.1.1 \
+    --hash=sha256:02f84dfad02693676692746df05b89cf25597560db2857363a208e393429f5e9 \
+    --hash=sha256:0330d233c1a0ead844fc097a7d16c0abff4c12e856c0b325f231820fee1f39da \
+    --hash=sha256:03edcc34d688572014ff223c125a3f77fb08091e4607e7745002fc214070b35f \
+    --hash=sha256:097690ba1f2efdeb165a20469d59d8bb03c55fb6621eb2041a060ae8ea3e9642 \
+    --hash=sha256:178aa072084bd88ec759052feca8e56cbb14a60b39322b99a049e58090479713 \
+    --hash=sha256:18e5bddd742a44b7e6b1e773ab5db102bd7a94c32555ba656e76d319d19c3850 \
+    --hash=sha256:1a9b0ee305220b392e1124a764ee4265bd063e54a751a6b62eff69992f457fa9 \
+    --hash=sha256:1f1625b72740fdda5d77b4def688eb8fd6490975d06b909fd19f13f391e077e0 \
+    --hash=sha256:1f1be78ce9466a7ee64bfda57bdba0f7cc499d9794d518b854816c41bf0aa4e9 \
+    --hash=sha256:1f90cff8aa76835cba5769f0b3121a22bd4eb9e6884cfe338216e557a9a548b8 \
+    --hash=sha256:21329ec8c96c6e979cd0dfd29406c40c1d52521a90544463057d2aaa937d66a6 \
+    --hash=sha256:2815a87ab27848db0321fb78c7f0b2c8649dee134b7f2b80c6a45c6831d75ccd \
+    --hash=sha256:2c1fc0f2ca5f96a3c8407e41cca26a16e46b21060fe6d5b099d2cb01412222f5 \
+    --hash=sha256:2e0c664be47252947d870ac0d327fea7e63985a08794758aa8af5b6cb6ec0c9c \
+    --hash=sha256:339ffdcb7cbeaa08221cd401d517d4b1fe7a9ed5d400e4a8039719238620ca35 \
+    --hash=sha256:344cf1e3dab3be4b1fa08e449323d98a2a3f819ad20f4b22e77a0ede31f0faa1 \
+    --hash=sha256:36341d06738a9f66c8287cf8b876d24b18db9bd8740fa0672c74e259ad408cff \
+    --hash=sha256:365b10bb9417dd4498c0e3b128018c4a624dc11c7b97d8cc54effe3b096f4c38 \
+    --hash=sha256:3a5cbdcddad0af3da87cb16b60d23648bc3b51967eb07223e9fed77a82b457c4 \
+    --hash=sha256:417423db963cb4be8bac3fc1204fe61610f6abeed1580a7a2cbb2fbda20f12af \
+    --hash=sha256:42fc1f4677106188ad9a55562bbade416f8b55456f522430fadab3cef7cd4e60 \
+    --hash=sha256:44ce27545b6efcf0fdbdceb31c9a5bdea9333e664cda58a7e674bb74608b3986 \
+    --hash=sha256:472a8d7ded663e6162dafdf20015c486a7009483ca671cece7a9279b512fcb13 \
+    --hash=sha256:47b94983da0c642de92ced1702c5b6c292a84bd3a8e1d1702ff923f183594717 \
+    --hash=sha256:495c302af3aad1ca67420ddd5c7bd480c8867ad173528767d906428057a11f0e \
+    --hash=sha256:4ceb838d4bd9dab43e06c363cab2eebf63846d6a4aeaea283bbdfd8f1a8ed58b \
+    --hash=sha256:50480dcd74fa63b8e78235957d302d98d98d82ccbfac4c7e12108ba9ecbdba15 \
+    --hash=sha256:518a48c2aab7ce596d3bf79d0e275661b846e86e4d0e7dec34712c30fe07f02a \
+    --hash=sha256:559b38da23606e68681337ad74622c4dbba02254fc9cb4488a305dd5975c7eeb \
+    --hash=sha256:578510d88c6229d735855e1f278aa305270438d36a05031dfaae5067cc8eb04d \
+    --hash=sha256:597bd9c8419bc7c6af5604e55847789b69123bbe25d65cc6ad3012b4f3c98d8b \
+    --hash=sha256:5a8eb7ed8d4198bccbd07058416eeec51686b498e784eda166395a23eb99138e \
+    --hash=sha256:5c0dd1636633e7e6a0afe7bf6a51a14992b7f8e60de5789018ebbdfae55b040a \
+    --hash=sha256:5cb1785d97b0c3d1d1a16bc1d710c4a0049daefc4935f3a8f31f827f4d3d2e7f \
+    --hash=sha256:5d1f9575a12bed9e9eedd9a4972834b08c97a352bd17955ccdebfeca5913fa0a \
+    --hash=sha256:5d8c41325b382c07799a3682c1c258469ea2ff97103c53717b7893862d0c98ce \
+    --hash=sha256:5dae5f21afb91322f2ff791895ddd8889e5e947ff59f71b46041c8ce6db790bc \
+    --hash=sha256:600fd103672b925fe62ed08e0d874ea34d692474df6f4bf7ebe148b30f89f39f \
+    --hash=sha256:6408a7b064595afcab0a49393a413732a35788f2a5092fdc6266952ed67de586 \
+    --hash=sha256:652a2c9ccfb556235b2b501a3a7cf3742148cd22e04b5625c5fe057ea3e3191f \
+    --hash=sha256:665e1b916b043cef294bc54d47bf02d87e13f769bc4bc5fa225a24b3a6c5aca9 \
+    --hash=sha256:691ab2ac363b8217f7d31b3497108fb1f50faab2f75dfb03284ec2f217e87bf8 \
+    --hash=sha256:6c52f062424c523d6c4db85518774cc3d50f5539dd6eed32b8f6229b26f24d40 \
+    --hash=sha256:6c6db3b84c87d48d0088943bf33440e0c42370b99b1c2a7989216f7b42eede60 \
+    --hash=sha256:7311c0a0dcadb89b36b7025dfd8326ecfa36964e29913074d47382706e516a7c \
+    --hash=sha256:7aac39bcf8d4770d089588a2e1dd111cbaa42df5a94be3114222057d68336bd0 \
+    --hash=sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334 \
+    --hash=sha256:7e7976bf1910a8116b523b9f9f58bf410f3e8aa330cd9a2bb2953f9266ab49af \
+    --hash=sha256:8089c852a56c2966cf18835db62d9b34fef7ba74c726ad943928d494fa7f4735 \
+    --hash=sha256:86172b0831b82ce4f7877f280055892b31179e1576aa00d0df3bb1bbf8c3e524 \
+    --hash=sha256:89b54027a766529136a06cfebeecb3a04900397a3590fd252160b888479517bf \
+    --hash=sha256:89c7e895002bbe49cdc5426150377cbbc04767d7547ed145473f496dfa40408b \
+    --hash=sha256:8b7e5304e34942bf62e15184219a7b5ad4ff7f3bb5cca4d984f37df1a0e1aee2 \
+    --hash=sha256:8fd420ef0c52c88b5a035a0886f367748c72147b2b8f384c9d12656678dfdfa9 \
+    --hash=sha256:98edb152429ab62a1818039744d8fbb3ccab98a7c29fc3d5fcef158f3f1f68b7 \
+    --hash=sha256:99c1506ea77c11531d75e3a412832a13a71c7ebc8192ab9e4b2e355555920e3e \
+    --hash=sha256:9ad8fa5937ab05218e2b6a4cff30295ad35afd2f83ac592e68c0d871bb0fdbc4 \
+    --hash=sha256:9f51079765661884a486727f0729d29054242f74b46186026582b4e4769918e4 \
+    --hash=sha256:a003d7422449f6d1e3a34e3dd4110c22148336918ddbfc6a32581cd54b2e0b2b \
+    --hash=sha256:a0b1cd6232e2b618adcc54d9882e4e662a089d5768cd188f7c245b4c8c44a397 \
+    --hash=sha256:a285e3eb7a5a45a2ff504e31f4a8d1b12ef62e84e5411c6804a42197c1cf586c \
+    --hash=sha256:a37691702ed687799de29a518d63d4682d9016932db66d4e90c345831b02fb4e \
+    --hash=sha256:a550ae29b95c6dc13cf69e2c9dc5747f814c54eeb2e32d683e5e93af56caa029 \
+    --hash=sha256:ab174cd7d29a62dd139c44bf74b698039328f45cb03b4596c43473a46656b2f3 \
+    --hash=sha256:ab323b787d6e18b3d91a72fc99b1a2c28651e4358749842b8f8dfacd28ef2052 \
+    --hash=sha256:adebb5bee0f0af4909c30db0d890c773d1a92ffe83da908e2e9e720f8edf3984 \
+    --hash=sha256:aee2810642b2898bb187ced9b349e95d2a7272930796e022efaf12e99dccd293 \
+    --hash=sha256:af9a332e572978f0218686636610555ae3defd1633597be015ed50289a03c523 \
+    --hash=sha256:b574c51cf7d5d62e9be37ba446224b59a2da26dc4c1bb2ecbe936a4fb1a7cb7f \
+    --hash=sha256:b66e95d05ba806247aaa1561f080abc7975daf715c30780ff92a20e4ec546e1b \
+    --hash=sha256:b81b5e3511211631b3f672a595e3221252c90af017e399056d0faabb9538aa80 \
+    --hash=sha256:b957b71c6b2387610f556a7eb0828afbe40b4a98036fc0d2acfa5a44a0c2036f \
+    --hash=sha256:bb66b7cc26f50977108790e2456b7921e773f23db5630261102233eb355a3b79 \
+    --hash=sha256:c6008de247150668a705a6338156efb92334113421ceecf7438a12c9a12dab23 \
+    --hash=sha256:c7697918b5be27424e9ce568193efd13d925c4481dd364e43f5dff72d33e10f8 \
+    --hash=sha256:cb9bb857b2d057c6dfc72ac5f3b44836924ba15721882ef103cecb40d002d80e \
+    --hash=sha256:cc7d296b5ea4d29e6570dabeaed58d31c3fea35a633a69679fb03d7664f43fb3 \
+    --hash=sha256:d242e8ac078781f1de88bf823d70c1a9b3c7950a44cdf4b7c012e22ccbcd8e4e \
+    --hash=sha256:d2912fd8114fc5545aa3a4b5576512f64c55a03f3ebcca4c10194d593d43ea36 \
+    --hash=sha256:d470ab1178551dd17fdba0fef463359c41aaa613cdcd7ff8373f54be629f9f8f \
+    --hash=sha256:d4ce8e329c93845720cd2014659ca67eac35f6433fd3050393d85f3ecef0dad5 \
+    --hash=sha256:d6e4571eedf43af33d0fc233a382a76e849badbccdf1ac438841308652a08e1f \
+    --hash=sha256:e65498daf4b583091ccbb2556c7000abf0f3349fcd57ef7adc9a84a394ed29f6 \
+    --hash=sha256:e879bb6cd5c73848ef3b2b48b8af9ff08c5b71ecda8048b7dd22d8a33f60be32 \
+    --hash=sha256:e9e8064fb1cc019296958595f6db671fba95209e3ceb0c4734c9baf97de04b20 \
+    --hash=sha256:f7ed2c6543bad5a7d5530eb9e78c53132f93dfa44a28492db88b41cdab885202 \
+    --hash=sha256:f95c00d5d6700b2b890479664a06e754974848afaae5e21beb4d83c106923fd0 \
+    --hash=sha256:f975aa7ef9684ce7e2c18a3aa8f8e2106ce1e46b94ab713d156b2898811651d3 \
+    --hash=sha256:fbfa2a7c10cc2623f412753cddf391c7f971c52ca40a3f65dc5039b2939e8563 \
+    --hash=sha256:fc354a04072b765eccf2204f588a7a532c9511e8b9c7f900e1b64e3e33487090 \
+    --hash=sha256:fc44ef1f3de4f45b50ccf9136999d71abb99dca7706bc75d222ed350b9fd2289
     # via
-    #   -r .github/scripts/requirements_dev.in
+    #   -r requirements_dev.in
     #   pdf2image
     #   weasyprint
-platformdirs==4.9.6 \
-    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
-    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
-    # via
-    #   python-discovery
-    #   virtualenv
-pre-commit==4.6.0 \
-    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
-    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
-    # via -r .github/scripts/requirements_dev.in
+platformdirs==4.5.1 \
+    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
+    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
+    # via virtualenv
+pre-commit==4.5.1 \
+    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
+    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+    # via -r requirements_dev.in
 pycparser==3.0 \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
@@ -381,10 +377,6 @@ pyphen==0.17.2 \
     --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
     --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
     # via weasyprint
-python-discovery==1.2.2 \
-    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
-    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
-    # via virtualenv
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
     --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -466,22 +458,22 @@ tinycss2==1.5.1 \
     # via
     #   cssselect2
     #   weasyprint
-tinyhtml5==2.1.0 \
-    --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
-    --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
+tinyhtml5==2.0.0 \
+    --hash=sha256:086f998833da24c300c414d9fe81d9b368fd04cb9d2596a008421cbc705fcfcc \
+    --hash=sha256:13683277c5b176d070f82d099d977194b7a1e26815b016114f581a74bbfbf47e
     # via weasyprint
 unoserver==3.6 \
     --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
     --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
-    # via -r .github/scripts/requirements_dev.in
-virtualenv==21.2.4 \
-    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
-    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+    # via -r requirements_dev.in
+virtualenv==20.36.1 \
+    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
+    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
     # via pre-commit
-weasyprint==68.1 \
-    --hash=sha256:4dc3ba63c68bbbce3e9617cb2226251c372f5ee90a8a484503b1c099da9cf5be \
-    --hash=sha256:d3b752049b453a5c95edb27ce78d69e9319af5a34f257fa0f4c738c701b4184e
-    # via -r .github/scripts/requirements_dev.in
+weasyprint==68.0 \
+    --hash=sha256:447f40898b747cb44ac31a5d493d512e7441fd56e13f63744c099383bbf9cda9 \
+    --hash=sha256:c2cb40c71b50837c5971f00171c9e4078e8c9912dd7c217f3e90e068f11e8aa1
+    # via -r requirements_dev.in
 webencodings==0.5.1 \
     --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
     --hash=sha256:b36a1c245f2d304965eb4e0a82848379241dc04b865afcc4aab16748587e1923
@@ -489,27 +481,27 @@ webencodings==0.5.1 \
     #   cssselect2
     #   tinycss2
     #   tinyhtml5
-zopfli==0.4.1 \
-    --hash=sha256:02086247dd12fda929f9bfe8b3962b6bcdbfc8c82e99255aebcf367867cf0760 \
-    --hash=sha256:07a5cdc5d1aaa6c288c5d9f5a5383042ba743641abf8e2fd898dcad622d8a38e \
-    --hash=sha256:27823dc1161a4031d1c25925fd45d9868ec0cbc7692341830a7dcfa25063662c \
-    --hash=sha256:2f992ac7d83cbddd889e1813ace576cbc91a05d5d7a0a21b366e2e5f492e7707 \
-    --hash=sha256:4238d4d746d1095e29c9125490985e0c12ffd3654f54a24af551e2391e936d54 \
-    --hash=sha256:5a4c22b6161f47f5bd34637dbaee6735abd287cd64e0d1ce28ef1871bf625f4b \
-    --hash=sha256:84a31ba9edc921b1d3a4449929394a993888f32d70de3a3617800c428a947b9b \
-    --hash=sha256:a899eca405662a23ae75054affa3517a060362eae1185d3d791c86a50153c4dd \
-    --hash=sha256:a93c2ecafff372de6c0aa2212eff18a75f6c71a100372fee7b4b129cc0b6f9a7 \
-    --hash=sha256:cb136a74d14a4ecfae29cb0fdecece58a6c115abc9a74c12bc6ac62e80f229d7 \
-    --hash=sha256:d7bcee1b189d64ec33d1e05cfa1b6a1268c29329c382f6ca1bd6245b04925c57 \
-    --hash=sha256:fdfb7ce9f5de37a5b2f75dd2642fd7717956ef2a72e0387302a36d382440db07
+zopfli==0.4.0 \
+    --hash=sha256:03181d48e719fcb6cf8340189c61e8f9883d8bbbdf76bf5212a74457f7d083c1 \
+    --hash=sha256:18b5f1570f64d4988482e4466f10ef5f2a30f687c19ad62a64560f2152dc89eb \
+    --hash=sha256:25e4863b8dc30e5d5309f87c106b0b7d3da4ed0e340b8a52b36d4471e797589f \
+    --hash=sha256:7d66337be6d5613dec55213e9ac28f378c41e2cc04fbad4a10748e4df774ca85 \
+    --hash=sha256:9097e8e1dfdb7f5aea5464e469946857e80502b6d29ba1b232450916bd4a74d1 \
+    --hash=sha256:a8ee992b2549e090cd3f0178bf606dd41a29e0613a04cdf5054224662c72dce6 \
+    --hash=sha256:b72a010d205d00b2855acc2302772067362f9ab5a012e3550662aec60d28e6b3 \
+    --hash=sha256:b8bdb41fbfdc4738b7bdc09ed7c1e951579fae192391a5e694d59bb186cdbec7 \
+    --hash=sha256:c3ba02a9a6ca90481d2b2f68bab038b310d63a1e3b5ae305e95a6599787ed941 \
+    --hash=sha256:d1b98ad47c434ef213444a03ef2f826eeec100144d64f6a57504b9893d3931ce \
+    --hash=sha256:f67d04280065e24cb9a4174cb6b3d1f763687f8cb2963aa135ad8f57c6995f5a \
+    --hash=sha256:f94e4dd7d76b4fe9f5d9229372be20d7f786164eea5152d1af1c34298c3d5975
     # via fonttools
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==26.0.1 \
-    --hash=sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b \
-    --hash=sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8
-    # via -r .github/scripts/requirements_dev.in
-setuptools==82.0.1 \
-    --hash=sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9 \
-    --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb
-    # via -r .github/scripts/requirements_dev.in
+pip==26.0 \
+    --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
+    --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
+    # via -r requirements_dev.in
+setuptools==80.10.2 \
+    --hash=sha256:8b0e9d10c784bf7d262c4e5ec5d4ec94127ce206e8738f29a437945fbc219b70 \
+    --hash=sha256:95b30ddfb717250edb492926c92b5221f7ef3fbcc2b07579bcd4a27da21d0173
+    # via -r requirements_dev.in

.github/scripts/requirements_pre_commit.txt

@@ -12,34 +12,26 @@ distlib==0.4.0 \
     --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
     --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
     # via virtualenv
-filelock==3.29.0 \
-    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
-    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
-    # via
-    #   python-discovery
-    #   virtualenv
-identify==2.6.19 \
-    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
-    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+filelock==3.20.3 \
+    --hash=sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1 \
+    --hash=sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1
+    # via virtualenv
+identify==2.6.16 \
+    --hash=sha256:391ee4d77741d994189522896270b787aed8670389bfd60f326d677d64a6dfb0 \
+    --hash=sha256:846857203b5511bbe94d5a352a48ef2359532bc8f6727b5544077a0dcfb24980
     # via pre-commit
 nodeenv==1.10.0 \
     --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
     --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
     # via pre-commit
-platformdirs==4.9.6 \
-    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
-    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
-    # via
-    #   python-discovery
-    #   virtualenv
-pre-commit==4.6.0 \
-    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
-    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
-    # via -r .github/scripts/requirements_pre_commit.in
-python-discovery==1.2.2 \
-    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
-    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+platformdirs==4.5.1 \
+    --hash=sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda \
+    --hash=sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31
     # via virtualenv
+pre-commit==4.5.1 \
+    --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77 \
+    --hash=sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61
+    # via -r .github/scripts/requirements_pre_commit.in
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
     --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
@@ -115,7 +107,7 @@ pyyaml==6.0.3 \
     --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
     --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
     # via pre-commit
-virtualenv==21.2.4 \
-    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
-    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+virtualenv==20.36.1 \
+    --hash=sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f \
+    --hash=sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba
     # via pre-commit

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -35,13 +35,13 @@ jobs:
       pr_ref: ${{ steps.resolve.outputs.ref }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
       - name: Resolve PR info
         id: resolve
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { owner, repo } = context.repo;
@@ -111,7 +111,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -132,7 +132,7 @@ jobs:
 
       - name: Add deployment started comment
         id: deployment-started
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -180,7 +180,7 @@ jobs:
           fetch-depth: 0 # Fetch full history for commit hash detection
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Get version number
         id: versionNumber
@@ -189,7 +189,7 @@ jobs:
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
@@ -226,7 +226,7 @@ jobs:
 
       - name: Build and push V2 image
         if: steps.check-image.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/embedded/Dockerfile
@@ -309,7 +309,7 @@ jobs:
 
       - name: Post V2 deployment URL to PR
         if: success()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -359,7 +359,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -376,7 +376,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Clean up V2 deployment comments
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -70,7 +70,7 @@ jobs:
       enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -88,7 +88,7 @@ jobs:
 
       - name: Get PR data
         id: get-pr
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const prNumber = context.eventName === 'workflow_dispatch'
@@ -154,7 +154,7 @@ jobs:
       - name: Add 'in_progress' reaction to comment
         if: github.event_name == 'issue_comment'
         id: add-eyes-reaction
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -183,7 +183,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -212,7 +212,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
@@ -233,16 +233,16 @@ jobs:
           STIRLING_PDF_DESKTOP_UI: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push PR-specific image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/embedded/Dockerfile
@@ -257,7 +257,7 @@ jobs:
 
       - name: Build and push engine image
         if: needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: ./engine
           file: ./engine/Dockerfile
@@ -383,7 +383,7 @@ jobs:
 
       - name: Add success reaction to comment
         if: success() && github.event_name == 'issue_comment'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -418,7 +418,7 @@ jobs:
 
       - name: Add failure reaction to comment
         if: failure() && github.event_name == 'issue_comment'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -438,7 +438,7 @@ jobs:
 
       - name: Post deployment URL to PR
         if: success()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -474,7 +474,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -489,7 +489,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Apply label commands
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |

.github/workflows/PR-Demo-cleanup.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -39,7 +39,7 @@ jobs:
 
       - name: Remove 'pr-deployed' label if present
         id: remove-label-comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |

.github/workflows/ai-engine.yml

@@ -1,15 +1,9 @@
 name: AI Engine CI
 
-# Validates the Python AI engine: regenerates tool models, runs fixers,
-# lint, type-check, and tests. Called from build.yml on PRs and merge_group;
-# also runs directly on push to main as a post-merge safety net.
 on:
-  workflow_call:
   push:
     branches: [main]
-
-permissions:
-  contents: read
+  pull_request:
 
 jobs:
   engine:
@@ -18,16 +12,11 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@v4
         with:
           enable-cache: true
 
@@ -38,7 +27,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
@@ -71,7 +60,7 @@ jobs:
       - name: Comment on fixer failures
         if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
         continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7
         with:
           script: |
             const marker = '<!-- engine-check -->';

.github/workflows/ai_pr_title_review.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -158,7 +158,7 @@ jobs:
 
       - name: Post comment on PR if needed
         if: steps.actor.outputs.is_repo_dev == 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         continue-on-error: true
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}

.github/workflows/aur-publish.yml

@@ -26,7 +26,7 @@ jobs:
       jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
         with:
           egress-policy: audit
 
@@ -70,59 +70,59 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@v2
         with:
           egress-policy: audit
 
       - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4
 
-      - name: Update stirling-pdf-desktop PKGBUILD
+      - name: Update stirling-pdf-bin PKGBUILD
         env:
           VERSION: ${{ needs.get-release-info.outputs.version }}
           DEB_SHA: ${{ needs.get-release-info.outputs.deb_sha256 }}
         run: |
-          PKGBUILD=".github/aur/stirling-pdf-desktop/PKGBUILD"
+          PKGBUILD=".github/aur/stirling-pdf-bin/PKGBUILD"
           sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
           sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
           sed -i "s/'PLACEHOLDER_DEB_SHA256'/'${DEB_SHA}'/" "$PKGBUILD"
 
-      # Disabled until we sort out the server packaging story.
-      # The third-party stirling-pdf-bin on AUR currently covers a similar use case.
-      # - name: Update stirling-pdf-server-bin PKGBUILD
-      #   env:
-      #     VERSION: ${{ needs.get-release-info.outputs.version }}
-      #     JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-      #   run: |
-      #     PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
-      #     sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
-      #     sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
-      #     sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
-
-      - name: Show updated PKGBUILD (for dry-run visibility)
+      - name: Update stirling-pdf-server-bin PKGBUILD
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
         run: |
-          echo "--- stirling-pdf-desktop PKGBUILD ---"
-          cat .github/aur/stirling-pdf-desktop/PKGBUILD
+          PKGBUILD=".github/aur/stirling-pdf-server-bin/PKGBUILD"
+          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" "$PKGBUILD"
+          sed -i "s/^pkgrel=.*/pkgrel=1/" "$PKGBUILD"
+          sed -i "s/'PLACEHOLDER_JAR_SHA256'/'${JAR_SHA}'/" "$PKGBUILD"
 
-      - name: Publish stirling-pdf-desktop to AUR
+      - name: Show updated PKGBUILDs (for dry-run visibility)
+        run: |
+          echo "--- stirling-pdf-bin PKGBUILD ---"
+          cat .github/aur/stirling-pdf-bin/PKGBUILD
+          echo ""
+          echo "--- stirling-pdf-server-bin PKGBUILD ---"
+          cat .github/aur/stirling-pdf-server-bin/PKGBUILD
+
+      - name: Publish stirling-pdf-bin to AUR
         if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@v4.1.3
+        uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
         with:
-          pkgname: stirling-pdf-desktop
-          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
+          pkgname: stirling-pdf-bin
+          pkgbuild: .github/aur/stirling-pdf-bin/PKGBUILD
           commit_username: Stirling PDF Inc
           commit_email: contact@stirlingpdf.com
           ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
           commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
 
-      # Disabled until we sort out the server packaging story.
-      # - name: Publish stirling-pdf-server-bin to AUR
-      #   if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-      #   uses: KSXGitHub/github-actions-deploy-aur@2ac5a4c1d7035885d46b10e3193393be8460b6f1 # v4.1.1
-      #   with:
-      #     pkgname: stirling-pdf-server-bin
-      #     pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
-      #     commit_username: Stirling PDF Inc
-      #     commit_email: contact@stirlingpdf.com
-      #     ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      #     commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"
+      - name: Publish stirling-pdf-server-bin to AUR
+        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
+        uses: KSXGitHub/github-actions-deploy-aur@v4.1.1
+        with:
+          pkgname: stirling-pdf-server-bin
+          pkgbuild: .github/aur/stirling-pdf-server-bin/PKGBUILD
+          commit_username: Stirling PDF Inc
+          commit_email: contact@stirlingpdf.com
+          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          commit_message: "Update to v${{ needs.get-release-info.outputs.version }}"

.github/workflows/auto-labelerV2.yml

@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/backend-build.yml

@@ -1,175 +0,0 @@
-name: Backend build, format check, and coverage
-
-# Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
-# posts Jacoco coverage to PRs.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  actions: read
-  security-events: write
-  pull-requests: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        jdk-version: [25]
-        spring-security: [true, false]
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK ${{ matrix.jdk-version }}
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: ${{ matrix.jdk-version }}
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check Java formatting (Spotless)
-        if: matrix.jdk-version == 25 && matrix.spring-security == false
-        id: spotless-check
-        run: task backend:format:check
-        continue-on-error: true
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: Comment on Java formatting failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const body = [
-              marker,
-              '### Java Formatting Check Failed',
-              '',
-              'Your code has formatting issues. Run the following command to fix them:',
-              '',
-              '```bash',
-              'task backend:format',
-              '```',
-              '',
-              'Then commit and push the changes.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if Java formatting issues found
-        if: steps.spotless-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Java Formatting Check Failed"
-          echo "============================================"
-          echo ""
-          echo "Your code has formatting issues."
-          echo "Run the following command to fix them:"
-          echo ""
-          echo "  task backend:format"
-          echo ""
-          echo "Then commit and push the changes."
-          echo "============================================"
-          exit 1
-
-      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
-        run: task backend:build:ci
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
-
-      - name: Check Test Reports Exist
-        if: always()
-        run: |
-          declare -a dirs=(
-            "app/core/build/reports/tests/"
-            "app/core/build/test-results/"
-            "app/common/build/reports/tests/"
-            "app/common/build/test-results/"
-            "app/proprietary/build/reports/tests/"
-            "app/proprietary/build/test-results/"
-          )
-          for dir in "${dirs[@]}"; do
-            if [ ! -d "$dir" ]; then
-              echo "Missing $dir"
-              exit 1
-            fi
-          done
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
-          path: |
-            app/**/build/reports/jacoco/test
-            app/**/build/reports/tests/
-            app/**/build/test-results/
-            app/**/build/reports/problems/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
-        # The action only supports the pull_request event (it posts a PR comment),
-        # so skip it for merge_group runs and workflow_dispatch.
-        if: github.event_name == 'pull_request'
-        id: jacoco
-        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
-        with:
-          paths: |
-            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
-          token: ${{ secrets.GITHUB_TOKEN }}
-          min-coverage-overall: 10
-          min-coverage-changed-files: 0
-          comment-type: summary

.github/workflows/build-enterprise.yml

@@ -1,272 +0,0 @@
-name: Enterprise E2E (Playwright)
-
-# Enterprise Playwright suite — exercises premium-key gated features (audit,
-# teams, analytics) plus full OAuth + SAML logins via the Keycloak compose
-# stacks under testing/compose. Slow and secret-gated, so it runs in three
-# situations:
-#
-#   - PRs that touch proprietary / premium / SSO compose / enterprise tests
-#     (driven by build.yml via workflow_call, path-filtered against
-#     .github/config/.files.yaml `proprietary`),
-#   - every push to main (post-merge safety net),
-#   - on a nightly cron schedule (catches Keycloak image drift, license
-#     expiry, upstream proprietary changes),
-#   - manual workflow_dispatch.
-#
-# Auto-skipped when secrets.PREMIUM_KEY_ENTERPRISE is missing (forks, dependabot).
-
-on:
-  workflow_call:
-  push:
-    branches: ["main"]
-  schedule:
-    - cron: "0 4 * * *"
-  workflow_dispatch:
-
-# No `concurrency:` block here on purpose. When this workflow is called via
-# workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
-# resolve to the *caller's* values, producing the same group key as build.yml
-# and causing the workflow_call instantiation to self-cancel — the job
-# silently fails to spawn while `${{ needs.X.result }}` still reports
-# `failure`. Standalone runs (push-to-main, nightly cron, dispatch) don't
-# overlap often enough to need explicit concurrency control.
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e-enterprise:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
-      PREMIUM_ENABLED: "true"
-      SYSTEM_ENABLEANALYTICS: "false"
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (needed for playwright's vite preview webServer)
-        # Enterprise tests target :8080 (Spring Boot's bundled frontend), but
-        # playwright's webServer config still launches `vite preview --port 5173`
-        # before any test run, which needs dist/ to exist. VITE_BUILD_FOR_PREVIEW
-        # forces absolute asset paths so vite preview can serve deep SPA routes.
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-
-      - name: Resolve kubernetes.docker.internal to localhost
-        # The compose stacks set KC_HOSTNAME=kubernetes.docker.internal so
-        # Keycloak issues redirect URIs against that host. Docker Desktop
-        # auto-resolves it; GHA runners don't. Map it to 127.0.0.1 so the
-        # browser-driven OAuth flow lands back on Stirling-PDF correctly.
-        run: |
-          echo "127.0.0.1 kubernetes.docker.internal" | sudo tee -a /etc/hosts
-
-      # Helper function used by all phases — boots `:stirling-pdf:bootRun`
-      # with the React frontend baked in (-PbuildWithFrontend=true) so the
-      # SPA serves on :8080 and OAuth/SAML callbacks land on the same host
-      # that the browser is interacting with.
-      - name: Define helpers
-        run: |
-          {
-            echo 'wait_for_backend() {'
-            echo '  start=$SECONDS'
-            echo '  for i in $(seq 1 300); do'
-            echo '    if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then'
-            echo '      echo "Backend up after $((SECONDS - start))s"; return 0'
-            echo '    fi; sleep 2'
-            echo '  done'
-            echo '  tail -200 /tmp/backend.log || true; return 1'
-            echo '}'
-            echo 'stop_backend() {'
-            echo '  if [ -f /tmp/backend.pid ]; then'
-            echo '    kill "$(cat /tmp/backend.pid)" 2>/dev/null || true'
-            echo '    rm -f /tmp/backend.pid'
-            echo '  fi'
-            echo '  pkill -f "gradlew :stirling-pdf:bootRun" 2>/dev/null || true'
-            echo '  for i in $(seq 1 30); do'
-            echo '    curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1 || return 0'
-            echo '    sleep 1'
-            echo '  done'
-            echo '}'
-          } > /tmp/helpers.sh
-          chmod +x /tmp/helpers.sh
-
-      # ───────── OAuth round-trip ─────────
-      - name: Bring up Keycloak (OAuth realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-oauth.yml up -d --no-deps keycloak-oauth-db keycloak-oauth
-      - name: Wait for Keycloak (OAuth) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            bash validate-oauth-test.sh 2>/dev/null && exit 0 || true
-            # validate script also pings stirling on :8080 — accept just the
-            # keycloak realm as our gate here, stirling boots in the next step
-            curl -fsS http://localhost:9080/realms/stirling-oauth >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-oauth.yml logs --tail=200 keycloak-oauth
-          exit 1
-      - name: Boot Stirling-PDF (frontend baked in, OAuth env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_OAUTH2_ENABLED: "true"
-          SECURITY_OAUTH2_AUTOCREATEUSER: "true"
-          # Keycloak issues redirect URIs against KC_HOSTNAME, which the
-          # compose default sets to kubernetes.docker.internal. Match here
-          # (resolves to localhost via /etc/hosts mapping above).
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_ISSUER: "http://kubernetes.docker.internal:9080/realms/stirling-oauth"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTID: "stirling-pdf-client"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTSECRET: "test-client-secret-change-in-production"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_USEASUSERNAME: "email"
-          SECURITY_OAUTH2_CLIENT_KEYCLOAK_SCOPES: "openid,profile,email"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise OAuth Playwright tests
-        id: oauth-tests
-        run: task e2e:enterprise -- --grep "OAuth"
-      - name: Stop backend + tear down OAuth Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-oauth.yml down -v)
-
-      # ───────── SAML round-trip ─────────
-      - name: Bring up Keycloak (SAML realm)
-        working-directory: testing/compose
-        run: docker compose -f docker-compose-keycloak-saml.yml up -d --no-deps keycloak-saml-db keycloak-saml
-      - name: Wait for Keycloak (SAML) ready
-        working-directory: testing/compose
-        run: |
-          for i in $(seq 1 60); do
-            curl -fsS http://localhost:9080/realms/stirling-saml >/dev/null 2>&1 && exit 0
-            sleep 5
-          done
-          docker compose -f docker-compose-keycloak-saml.yml logs --tail=200 keycloak-saml
-          exit 1
-      - name: Generate SAML SP certs + fetch Keycloak IdP cert
-        # The .pem/.crt/.key files are gitignored (test-only certs); the
-        # docker-based start-saml-test.sh generates them at runtime, so do
-        # the same in CI before bootRun reads them.
-        working-directory: testing/compose
-        run: |
-          openssl req -x509 -newkey rsa:2048 \
-            -keyout saml-private-key.key \
-            -out saml-public-cert.crt \
-            -days 3650 -nodes \
-            -subj "/CN=stirling-pdf-saml-sp" >/dev/null 2>&1
-          # Fetch Keycloak's SAML signing cert from the realm descriptor
-          CERT_BODY=$(curl -sf http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor \
-            | awk 'BEGIN{RS="<[^>]*X509Certificate>|</[^>]*X509Certificate>"} NR==2{gsub(/[[:space:]]+/,""); print; exit}')
-          {
-            echo "-----BEGIN CERTIFICATE-----"
-            echo "$CERT_BODY"
-            echo "-----END CERTIFICATE-----"
-          } > keycloak-saml-cert.pem
-          test -s saml-private-key.key
-          test -s saml-public-cert.crt
-          test -s keycloak-saml-cert.pem
-          echo "✓ SAML certs prepared"
-      - name: Boot Stirling-PDF (frontend baked in, SAML env)
-        env:
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-          SECURITY_SAML2_ENABLED: "true"
-          SECURITY_SAML2_AUTOCREATEUSER: "true"
-          SECURITY_SAML2_PROVIDER: "keycloak"
-          SECURITY_SAML2_REGISTRATIONID: "keycloak"
-          SECURITY_SAML2_IDP_ISSUER: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_ENTITYID: "http://localhost:9080/realms/stirling-saml"
-          SECURITY_SAML2_IDP_METADATAURI: "http://localhost:9080/realms/stirling-saml/protocol/saml/descriptor"
-          SECURITY_SAML2_IDPSINGLELOGINURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDPSINGLELOGOUTURL: "http://localhost:9080/realms/stirling-saml/protocol/saml"
-          SECURITY_SAML2_IDP_CERT: "${{ github.workspace }}/testing/compose/keycloak-saml-cert.pem"
-          SECURITY_SAML2_PRIVATEKEY: "${{ github.workspace }}/testing/compose/saml-private-key.key"
-          SECURITY_SAML2_SP_CERT: "${{ github.workspace }}/testing/compose/saml-public-cert.crt"
-          # Realm registers the SP entity as the metadata URL — see
-          # keycloak-realm-saml.json `clientId`. Match it here so Keycloak
-          # accepts the AuthnRequest issuer.
-          SECURITY_SAML2_SP_ENTITYID: "http://localhost:8080/saml2/service-provider-metadata/keycloak"
-          SECURITY_SAML2_SP_ACS: "http://localhost:8080/login/saml2/sso/keycloak"
-          SECURITY_SAML2_SP_SLS: "http://localhost:8080/logout/saml2/slo"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise SAML Playwright tests
-        id: saml-tests
-        run: task e2e:enterprise -- --grep "SAML"
-      - name: Stop backend + tear down SAML Keycloak
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-          (cd testing/compose && docker compose -f docker-compose-keycloak-saml.yml down -v)
-
-      # ───────── License-gated feature tests (no IdP needed) ─────────
-      - name: Wipe DB so InitialSecuritySetup re-runs with admin/adminadmin
-        # Earlier phases (OAuth, SAML) create the default admin/stirling user.
-        # InitialSecuritySetup only honours SECURITY_INITIALLOGIN_* when the
-        # admin user doesn't already exist, so the persisted DB has to be
-        # cleared between phases for the feature env vars to take effect.
-        run: |
-          rm -f app/core/configs/stirling-pdf-DB*.mv.db
-          rm -rf app/core/configs/backup
-      - name: Boot Stirling-PDF (frontend baked in, premium only)
-        env:
-          SECURITY_INITIALLOGIN_USERNAME: admin
-          SECURITY_INITIALLOGIN_PASSWORD: adminadmin
-          SECURITY_ENABLELOGIN: "true"
-          SECURITY_LOGINMETHOD: "all"
-        run: |
-          source /tmp/helpers.sh
-          nohup ./gradlew :stirling-pdf:bootRun -PbuildWithFrontend=true > /tmp/backend.log 2>&1 &
-          echo $! > /tmp/backend.pid
-          wait_for_backend
-      - name: Run enterprise feature Playwright tests
-        id: feature-tests
-        run: task e2e:enterprise -- --grep "Enterprise license"
-      - name: Print backend log on failure
-        if: failure()
-        run: |
-          echo "::group::Enterprise backend log"
-          tail -500 /tmp/backend.log || true
-          echo "::endgroup::"
-      - name: Stop backend (final)
-        if: always()
-        run: |
-          source /tmp/helpers.sh
-          stop_backend
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7

.github/workflows/build.yml

@@ -1,18 +1,8 @@
 name: Build and Test Workflow
 
-# Top-level PR / merge-queue gate. Detects which paths changed and dispatches
-# to the dedicated reusable workflows under .github/workflows/. Each child
-# workflow keeps its own setup/teardown so this file stays a routing layer.
-#
-# The final `all-checks-passed` job is the single status check that branch
-# protection should require — it succeeds only if every required upstream
-# job either succeeded or was legitimately skipped by its path filter.
-
 on:
   pull_request:
     branches: ["main"]
-  merge_group:
-    branches: ["main"]
   workflow_dispatch:
 
 # cancel in-progress jobs if a new job is triggered
@@ -41,12 +31,9 @@ jobs:
       openapi: ${{ steps.changes.outputs.openapi }}
       frontend: ${{ steps.changes.outputs.frontend }}
       docker-base: ${{ steps.changes.outputs.docker-base }}
-      tauri: ${{ steps.changes.outputs.tauri }}
-      engine: ${{ steps.changes.outputs.engine }}
-      proprietary: ${{ steps.changes.outputs.proprietary }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
       - name: Checkout repository
@@ -59,174 +46,619 @@ jobs:
           filters: .github/config/.files.yaml
 
   build:
-    needs: [files-changed]
+    runs-on: ubuntu-latest
     permissions:
       actions: read
-      contents: read
       security-events: write
       pull-requests: write
-    uses: ./.github/workflows/backend-build.yml
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk-version: [21, 25]
+        spring-security: [true, false]
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK ${{ matrix.jdk-version }}
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: ${{ matrix.jdk-version }}
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Check Java formatting (Spotless)
+        if: matrix.jdk-version == 25 && matrix.spring-security == false
+        id: spotless-check
+        run: task backend:format:check
+        continue-on-error: true
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: Comment on Java formatting failure
+        if: steps.spotless-check.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const marker = '<!-- java-formatting-check -->';
+            const body = [
+              marker,
+              '### Java Formatting Check Failed',
+              '',
+              'Your code has formatting issues. Run the following command to fix them:',
+              '',
+              '```bash',
+              'task backend:format',
+              '```',
+              '',
+              'Then commit and push the changes.',
+            ].join('\n');
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if Java formatting issues found
+        if: steps.spotless-check.outcome == 'failure'
+        run: |
+          echo "============================================"
+          echo "  Java Formatting Check Failed"
+          echo "============================================"
+          echo ""
+          echo "Your code has formatting issues."
+          echo "Run the following command to fix them:"
+          echo ""
+          echo "  task backend:format"
+          echo ""
+          echo "Then commit and push the changes."
+          echo "============================================"
+          exit 1
+
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
+        run: task backend:build:ci
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
+
+      - name: Check Test Reports Exist
+        if: always()
+        run: |
+          declare -a dirs=(
+            "app/core/build/reports/tests/"
+            "app/core/build/test-results/"
+            "app/common/build/reports/tests/"
+            "app/common/build/test-results/"
+            "app/proprietary/build/reports/tests/"
+            "app/proprietary/build/test-results/"
+          )
+          for dir in "${dirs[@]}"; do
+            if [ ! -d "$dir" ]; then
+              echo "Missing $dir"
+              exit 1
+            fi
+          done
+
+      - name: Upload Test Reports
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
+          path: |
+            app/**/build/reports/jacoco/test
+            app/**/build/reports/tests/
+            app/**/build/test-results/
+            app/**/build/reports/problems/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn
+
+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
+        id: jacoco
+        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
+        with:
+          paths: |
+            ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
+          token: ${{ secrets.GITHUB_TOKEN }}
+          min-coverage-overall: 10
+          min-coverage-changed-files: 0
+          comment-type: summary
 
   check-generateOpenApiDocs:
     if: needs.files-changed.outputs.openapi == 'true'
     needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-openapi.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Generate OpenAPI documentation
+        run: task backend:swagger
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: true
+
+      - name: Upload OpenAPI Documentation
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: openapi-docs
+          path: ./SwaggerDoc.json
 
   frontend-validation:
     if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
+    needs: files-changed
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
-    uses: ./.github/workflows/frontend-validation.yml
-    secrets: inherit
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Quality-check frontend
+        id: frontend-check
+        run: task frontend:check:all
+        continue-on-error: true
+      - name: Comment on frontend check failure
+        if: steps.frontend-check.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const marker = '<!-- frontend-check -->';
+            const body = [
+              marker,
+              '### Frontend Check Failed',
+              '',
+              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
+              '',
+              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
+            ].join('\n');
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+      - name: Fail if frontend check failed
+        if: steps.frontend-check.outcome == 'failure'
+        run: |
+          echo "============================================"
+          echo "  Frontend Check Failed"
+          echo "============================================"
+          echo ""
+          echo "There are issues with your frontend code that"
+          echo "will need to be fixed before they can be merged in."
+          echo ""
+          echo "Run 'task frontend:fix' to auto-fix what can be"
+          echo "fixed automatically, then run 'task frontend:check:all'"
+          echo "to see what still needs fixing manually."
+          echo "============================================"
+          exit 1
+      - name: Upload frontend build artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: frontend-build
+          path: frontend/dist/
+          retention-days: 3
 
   playwright-e2e:
     if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-stubbed.yml
-    secrets: inherit
-
-  playwright-e2e-live:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/e2e-live.yml
-    secrets: inherit
-
-  playwright-e2e-enterprise:
-    if: needs.files-changed.outputs.proprietary == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/build-enterprise.yml
-    secrets: inherit
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Install Playwright (chromium only)
+        run: task frontend:test:e2e:install -- chromium
+      - name: Run E2E tests (chromium)
+        run: task frontend:test:e2e -- --project=chromium
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: playwright-report-pr-${{ github.run_id }}
+          path: frontend/playwright-report/
+          retention-days: 7
 
   check-licence:
     if: needs.files-changed.outputs.build == 'true'
     needs: [files-changed, build]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/check-licence.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Check licenses for compatibility
+        run: task backend:licenses:check
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: FAILED - check the licenses for compatibility
+        if: failure()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: dependencies-without-allowed-license.json
+          path: build/reports/dependency-license/dependencies-without-allowed-license.json
+          retention-days: 3
 
   docker-compose-tests:
     if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
+    needs: files-changed
+    # if: github.event_name == 'push' && github.ref == 'refs/heads/main' ||
+    #     (github.event_name == 'pull_request' &&
+    #     contains(github.event.pull_request.labels.*.name, 'licenses') == false &&
+    #     (
+    #       contains(github.event.pull_request.labels.*.name, 'Front End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Java') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Back End') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Security') ||
+    #       contains(github.event.pull_request.labels.*.name, 'API') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Docker') ||
+    #       contains(github.event.pull_request.labels.*.name, 'Test')
+    #     )
+    #     )
+
+    runs-on: ubuntu-latest
     permissions:
       actions: write
       contents: read
       checks: write
-    uses: ./.github/workflows/docker-compose-tests.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
+      - name: Expose GitHub runtime for Buildx cache
+        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
+
+      - name: Install Docker Compose
+        run: |
+          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo chmod +x /usr/local/bin/docker-compose
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./testing/cucumber/requirements.txt
+
+      - name: Pip requirements
+        run: |
+          pip install --require-hashes -r ./testing/cucumber/requirements.txt
+          pip install behave-html-formatter
+
+      - name: Run Docker Compose Tests
+        run: |
+          chmod +x ./testing/test_webpages.sh
+          chmod +x ./testing/test.sh
+          chmod +x ./testing/test_disabledEndpoints.sh
+          ./testing/test.sh
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DOCKER_BASE_CHANGED: ${{ needs.files-changed.outputs.docker-base }}
+
+      - name: Upload Cucumber Report
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: cucumber-report
+          path: testing/cucumber/report.html
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Upload Test Reports
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: docker-compose-test-reports
+          path: testing/reports/
+          retention-days: 7
+          if-no-files-found: warn
+
+      - name: Cucumber Test Report
+        if: always()
+        uses: dorny/test-reporter@b082adf0eced0765477756c2a610396589b8c637 # v2.5.0
+        with:
+          name: Cucumber Tests
+          path: testing/cucumber/junit/*.xml
+          reporter: java-junit
+          fail-on-error: false
 
   test-build-docker-images:
     if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
     needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
-    permissions:
-      contents: read
-      packages: read
-    uses: ./.github/workflows/test-build-docker.yml
-    secrets: inherit
-    with:
-      docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
-
-  tauri-build:
-    if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    secrets: inherit
-
-  ai-engine:
-    if: needs.files-changed.outputs.engine == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/ai-engine.yml
-    secrets: inherit
-
-  pre-commit:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/pre_commit.yml
-    secrets: inherit
-
-  dependency-review:
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/dependency-review.yml
-    secrets: inherit
-
-  # Single status check that branch protection should mark as required.
-  # Succeeds when every upstream job is either `success` or `skipped` (path-
-  # gated jobs that didn't apply this run). Any `failure` or `cancelled`
-  # result fails the gate. `if: always()` ensures the gate evaluates even
-  # when an upstream job fails.
-  all-checks-passed:
-    name: All checks passed
-    if: always()
-    needs:
-      - files-changed
-      - build
-      - check-generateOpenApiDocs
-      - frontend-validation
-      - playwright-e2e
-      - playwright-e2e-live
-      - playwright-e2e-enterprise
-      - check-licence
-      - docker-compose-tests
-      - test-build-docker-images
-      - tauri-build
-      - ai-engine
-      - pre-commit
-      - dependency-review
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - docker-rev: docker/embedded/Dockerfile
+            artifact-suffix: Dockerfile
+            cache-scope: stirling-pdf-latest
+          - docker-rev: docker/embedded/Dockerfile.ultra-lite
+            artifact-suffix: Dockerfile.ultra-lite
+            cache-scope: stirling-pdf-ultra-lite
+          - docker-rev: docker/embedded/Dockerfile.fat
+            artifact-suffix: Dockerfile.fat
+            cache-scope: stirling-pdf-fat
     steps:
-      - name: Verify every required job passed (or was legitimately skipped)
-        env:
-          RESULTS: |
-            files-changed=${{ needs.files-changed.result }}
-            build=${{ needs.build.result }}
-            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
-            frontend-validation=${{ needs.frontend-validation.result }}
-            playwright-e2e=${{ needs.playwright-e2e.result }}
-            playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
-            playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}
-            check-licence=${{ needs.check-licence.result }}
-            docker-compose-tests=${{ needs.docker-compose-tests.result }}
-            test-build-docker-images=${{ needs.test-build-docker-images.result }}
-            tauri-build=${{ needs.tauri-build.result }}
-            ai-engine=${{ needs.ai-engine.result }}
-            pre-commit=${{ needs.pre-commit.result }}
-            dependency-review=${{ needs.dependency-review.result }}
+      - name: Harden Runner
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
+
+      - name: Free disk space on runner
         run: |
-          ok=true
-          while IFS='=' read -r name result; do
-            [ -z "$name" ] && continue
-            case "$result" in
-              success|skipped) printf '  %-30s %s\n' "$name" "$result" ;;
-              *)               printf '✗ %-30s %s\n' "$name" "$result"; ok=false ;;
-            esac
-          done <<< "$RESULTS"
-          if [ "$ok" != "true" ]; then
-            echo ""
-            echo "One or more required checks failed or were cancelled."
-            exit 1
+          echo "Disk space before cleanup:" && df -h
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
+          docker system prune -af || true
+          echo "Disk space after cleanup:" && df -h
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Cache Gradle dependency artifacts
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            ~/.gradle/wrapper
+            ~/.gradle/caches/modules-2/files-2.1
+            ~/.gradle/caches/modules-2/metadata-2.*
+          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+        with:
+          gradle-version: 9.3.1
+          cache-disabled: true
+
+      - name: Install Task
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Build application
+        run: task backend:build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Build base image locally (PR base change only)
+        if: github.event_name == 'pull_request' && needs.files-changed.outputs.docker-base == 'true'
+        run: |
+          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
+
+      - name: Set base image and platform for this build
+        id: build-params
+        run: |
+          if [ "${{ github.event_name }}" == "pull_request" ] && [ "${{ needs.files-changed.outputs.docker-base }}" == "true" ]; then
+            echo "base_image=stirling-pdf-base:pr-test" >> $GITHUB_OUTPUT
+            echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+          else
+            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> $GITHUB_OUTPUT
+            echo "platforms=linux/amd64,linux/arm64/v8" >> $GITHUB_OUTPUT
           fi
-          echo ""
-          echo "All required checks passed."
+
+      - name: Build ${{ matrix.docker-rev }}
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          builder: ${{ steps.buildx.outputs.name }}
+          context: .
+          file: ./${{ matrix.docker-rev }}
+          push: false
+          cache-from: type=gha,scope=${{ matrix.cache-scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
+          platforms: ${{ steps.build-params.outputs.platforms }}
+          build-args: |
+            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
+          provenance: true
+          sbom: true
+
+      - name: Upload Reports
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: reports-docker-${{ matrix.artifact-suffix }}
+          path: |
+            build/reports/tests/
+            build/test-results/
+            build/reports/problems/
+          retention-days: 3
+          if-no-files-found: warn

.github/workflows/check-licence.yml

@@ -1,59 +0,0 @@
-name: License compatibility check
-
-# Reusable workflow called from build.yml when build.gradle / module gradle
-# files change. Verifies all transitive dependencies use a permitted license.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-licence:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Check licenses for compatibility
-        run: task backend:licenses:check
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-
-      - name: FAILED - check the licenses for compatibility
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: dependencies-without-allowed-license.json
-          path: build/reports/dependency-license/dependencies-without-allowed-license.json
-          retention-days: 3

.github/workflows/check-openapi.yml

@@ -1,59 +0,0 @@
-name: Generate OpenAPI documentation
-
-# Reusable workflow called from build.yml when backend Java sources change.
-# Generates SwaggerDoc.json so we know the doc still builds against the
-# current code.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  check-generate-openapi-docs:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Generate OpenAPI documentation
-        run: task backend:swagger
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Upload OpenAPI Documentation
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: openapi-docs
-          path: ./SwaggerDoc.json

.github/workflows/check_toml.yml

@@ -27,7 +27,7 @@ jobs:
       pull-requests: write # Allow writing to pull requests
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -43,7 +43,7 @@ jobs:
 
       - name: Get PR data
         id: get-pr-data
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -87,7 +87,7 @@ jobs:
 
       - name: Determine reference file
         id: determine-file
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -201,8 +201,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install Python dependencies
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Run Python script to check files
         id: run-check
@@ -240,7 +239,7 @@ jobs:
 
       - name: Post comment on PR
         if: env.SCRIPT_OUTPUT != ''
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |

.github/workflows/dependency-review.yml

@@ -1,10 +1,13 @@
-name: Dependency Review
-
-# Reusable workflow called from build.yml. Scans dependency manifest files
-# changing in a PR for known-vulnerable packages, using the rules in
-# .github/config/dependency-review-config.yml.
-on:
-  workflow_call:
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: "Dependency Review"
+on: [pull_request]
 
 permissions:
   contents: read
@@ -14,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
       - name: "Checkout Repository"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
         with:
           config-file: "./.github/config/dependency-review-config.yml"

.github/workflows/deploy-on-v2-commit.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Get commit hashes for frontend and backend
         id: commit-hashes
@@ -85,14 +85,14 @@ jobs:
           fi
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push frontend image
         if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/frontend/Dockerfile
@@ -107,7 +107,7 @@ jobs:
 
       - name: Build and push backend image
         if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/backend/Dockerfile

.github/workflows/docker-compose-tests.yml

@@ -1,116 +0,0 @@
-name: Docker Compose Cucumber tests
-
-# Reusable workflow called from build.yml when project / docker / testing
-# sources change. Boots the docker-compose stack and runs the cucumber
-# scenarios in testing/cucumber.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-
-permissions:
-  contents: read
-
-jobs:
-  docker-compose-tests:
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-      contents: read
-      checks: write
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
-      - name: Expose GitHub runtime for Buildx cache
-        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
-
-      - name: Install Docker Compose
-        run: |
-          sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
-          sudo chmod +x /usr/local/bin/docker-compose
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-          cache: "pip" # caching pip dependencies
-          cache-dependency-path: ./testing/cucumber/requirements.txt
-
-      - name: Pip requirements
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
-
-      - name: Run Docker Compose Tests
-        run: |
-          chmod +x ./testing/test_webpages.sh
-          chmod +x ./testing/test.sh
-          chmod +x ./testing/test_disabledEndpoints.sh
-          ./testing/test.sh
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-
-      - name: Upload Cucumber Report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cucumber-report
-          path: testing/cucumber/report.html
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload Test Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docker-compose-test-reports
-          path: testing/reports/
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Cucumber Test Report
-        if: always()
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: Cucumber Tests
-          path: testing/cucumber/junit/*.xml
-          reporter: java-junit
-          fail-on-error: false

.github/workflows/e2e-live.yml

@@ -1,64 +0,0 @@
-name: Playwright E2E (live backend)
-
-# Reusable workflow called from build.yml. Live-backend Playwright suite —
-# boots Spring Boot and runs auth + real tool round-trips against the live
-# server.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e-live:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-      - name: Run live E2E tests (chromium)
-        id: live-tests
-        run: task e2e:live
-      - name: Print backend log on failure
-        if: failure() && steps.live-tests.conclusion == 'failure'
-        run: |
-          echo "::group::Spring Boot backend log (last 500 lines)"
-          tail -500 .test-state/playwright/backend.log || echo "no backend log found"
-          echo "::endgroup::"
-      - name: Upload backend log
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: backend-log-live-${{ github.run_id }}
-          path: .test-state/playwright/backend.log
-          retention-days: 7
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-live-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7

.github/workflows/e2e-stubbed.yml

@@ -1,44 +0,0 @@
-name: Playwright E2E (stubbed)
-
-# Reusable workflow called from build.yml. Backend-free Playwright suite —
-# fast, no Spring Boot required. Runs against the `stubbed` project which
-# mocks API responses in the browser.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright-e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Install Playwright (chromium only)
-        run: task e2e:install -- chromium
-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-      - name: Run stubbed E2E tests (chromium)
-        run: task e2e:stubbed -- --workers=3
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/playwright-report/
-          retention-days: 7

.github/workflows/frontend-backend-licenses-update.yml

@@ -7,9 +7,6 @@ on:
   pull_request:
     branches:
       - main
-  merge_group:
-    branches:
-      - main
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
@@ -28,7 +25,7 @@ jobs:
       licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -52,7 +49,7 @@ jobs:
       repository-projects: write # Required for enabling automerge
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -80,7 +77,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
           cache: "npm"
@@ -139,7 +136,7 @@ jobs:
       # PR Event: Check licenses and comment on PR
       - name: Delete previous license check comments
         if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -192,7 +189,7 @@ jobs:
 
       - name: Comment on PR - License Check Results
         if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -277,7 +274,7 @@ jobs:
       - name: Create Pull Request (Push only)
         id: cpr
         if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ steps.setup-bot.outputs.token }}
           commit-message: "Update Frontend 3rd Party Licenses"
@@ -316,7 +313,7 @@ jobs:
       repository-projects: write # Required for enabling automerge
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -341,7 +338,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
@@ -369,7 +366,7 @@ jobs:
 
       - name: Upload artifact on license issues
         if: env.LICENSE_WARNINGS_EXIST == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: backend-dependencies-without-allowed-license.json
           path: build/reports/dependency-license/dependencies-without-allowed-license.json
@@ -382,7 +379,7 @@ jobs:
 
       - name: Delete previous backend license check comments
         if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -412,7 +409,7 @@ jobs:
 
       - name: Comment on PR - Backend License Check Results
         if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.setup-bot.outputs.token }}
           script: |
@@ -495,7 +492,7 @@ jobs:
       - name: Create Pull Request (push only)
         if: github.event_name == 'push' && env.CHANGES_DETECTED == 'true'
         id: cpr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ steps.setup-bot.outputs.token }}
           commit-message: "Update Backend 3rd Party Licenses"

.github/workflows/frontend-validation.yml

@@ -1,113 +0,0 @@
-name: Frontend lint, type-check, and build
-
-# Reusable workflow called from build.yml when frontend / testing sources
-# change. Runs the consolidated `task frontend:check:all` (lint, types,
-# unit tests, build) and uploads the dist artifact for downstream jobs.
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  frontend-validation:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Quality-check frontend
-        id: frontend-check
-        run: task frontend:check:all
-        continue-on-error: true
-      - name: Comment on frontend check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.frontend-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const body = [
-              marker,
-              '### Frontend Check Failed',
-              '',
-              'There are issues with your frontend code that will need to be fixed before they can be merged in.',
-              '',
-              'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-      - name: Fail if frontend check failed
-        if: steps.frontend-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Frontend Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your frontend code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task frontend:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task frontend:check:all'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
-      - name: Remove frontend check comment on success
-        if: steps.frontend-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- frontend-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-      - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-build
-          path: frontend/dist/
-          retention-days: 3

.github/workflows/manage-label.yml

@@ -15,7 +15,7 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/multiOSReleases.yml

@@ -44,7 +44,7 @@ jobs:
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -57,7 +57,7 @@ jobs:
           distribution: "temurin"
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -67,7 +67,7 @@ jobs:
             gradle-${{ runner.os }}-
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
@@ -90,21 +90,21 @@ jobs:
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             case "${{ github.event.inputs.platform }}" in
               "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
               *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                 ;;
             esac
           else
             # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
           fi
 
   build-jars:
@@ -127,7 +127,7 @@ jobs:
             file_suffix: "-server"
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -140,13 +140,13 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -173,7 +173,7 @@ jobs:
           cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
 
       - name: Upload JAR artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: jar${{ matrix.variant.file_suffix }}
           path: ./jar-dist/*.jar
@@ -188,10 +188,9 @@ jobs:
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
       WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
           allowed-endpoints: >
@@ -208,7 +207,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -218,23 +217,7 @@ jobs:
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
           toolchain: stable
-          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      # x86_64 JDK is set up first so the aarch64 step below can leave its
-      # JAVA_HOME as the active one. The macOS universal JRE build needs
-      # jmods from both arches; the x64 path is captured into the env
-      # before the second setup-java overwrites JAVA_HOME.
-      - name: Set up x86_64 JDK 25 (macOS universal JRE)
-        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-          architecture: "x64"
-
-      - name: Capture x86_64 JAVA_HOME
-        if: matrix.platform == 'macos-15'
-        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
       - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -243,30 +226,20 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
-      # Build the universal JRE before desktop:prepare so the jlink:runtime
-      # task short-circuits on its `test -d runtime/jre` status check.
-      - name: Build universal macOS JRE
-        if: matrix.platform == 'macos-15'
-        env:
-          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:jlink:universal-mac
-
       - name: Prepare desktop build
+        run: task desktop:prepare
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare
 
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
@@ -347,7 +320,7 @@ jobs:
           }
 
       - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -368,7 +341,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -436,7 +409,9 @@ jobs:
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json
 
       - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: matrix.platform == 'ubuntu-22.04'
+        env:
+          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
         run: |
           echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
           gpg --list-secret-keys --keyid-format=long
@@ -454,7 +429,7 @@ jobs:
           fi
 
       - name: Build Tauri app
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
+        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -468,8 +443,7 @@ jobs:
           #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
           #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
           # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or V2-master, when secret is present.
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
+          SIGN: "1"
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
           SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -486,7 +460,7 @@ jobs:
           args: ${{ matrix.args }}
 
       - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: always() && matrix.platform == 'ubuntu-22.04'
         env:
           RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
         run: |
@@ -583,7 +557,7 @@ jobs:
             # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
             # are not the user-facing installer - the MSI contains the signed inner exe.
             find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
             find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
             find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
           else
@@ -594,7 +568,7 @@ jobs:
 
       - name: Upload build artifacts
         if: always() && steps.digicert-setup.conclusion != 'failure'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Stirling-PDF-${{ matrix.name }}
           path: ./dist/*
@@ -608,7 +582,7 @@ jobs:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -640,7 +614,7 @@ jobs:
         run: ls -R ./artifacts
 
       - name: Upload binaries to Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true

.github/workflows/nightly.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: "22"
           cache: "npm"
@@ -35,14 +35,14 @@ jobs:
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install all Playwright browsers
-        run: task e2e:install
+        run: task frontend:test:e2e:install
 
       - name: Run E2E tests (all browsers)
-        run: task e2e:cross-browser
+        run: task frontend:test:e2e
 
       - name: Upload Playwright report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: playwright-nightly-${{ github.run_id }}
           path: frontend/playwright-report/

.github/workflows/package-managers.yml

@@ -1,8 +1,8 @@
 name: Update Package Manager Manifests
 
 on:
-  release:
-    types: [ released ]
+  # release:
+  #   types: [released]
   workflow_dispatch:
     inputs:
       version:
@@ -22,13 +22,14 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.info.outputs.version }}
-      dmg_sha256: ${{ steps.hashes.outputs.dmg_sha256 }}
+      dmg_arm64_sha256: ${{ steps.hashes.outputs.dmg_arm64_sha256 }}
+      dmg_x86_64_sha256: ${{ steps.hashes.outputs.dmg_x86_64_sha256 }}
       msi_sha256: ${{ steps.hashes.outputs.msi_sha256 }}
       deb_sha256: ${{ steps.hashes.outputs.deb_sha256 }}
       jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@v2
         with:
           egress-policy: audit
 
@@ -62,94 +63,135 @@ jobs:
             sha256sum "$file" | awk '{print $1}'
           }
 
-          DMG_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-universal.dmg")
+          DMG_ARM64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-aarch64.dmg")
+          DMG_X64_SHA=$(download_sha256 "${BASE}/Stirling-PDF-macos-x86_64.dmg")
           MSI_SHA=$(download_sha256 "${BASE}/Stirling-PDF-windows-x86_64.msi")
           DEB_SHA=$(download_sha256 "${BASE}/Stirling-PDF-linux-x86_64.deb")
           JAR_SHA=$(download_sha256 "${BASE}/Stirling-PDF-with-login.jar")
 
-          echo "dmg_sha256=$DMG_SHA" >> "$GITHUB_OUTPUT"
-          echo "msi_sha256=$MSI_SHA" >> "$GITHUB_OUTPUT"
-          echo "deb_sha256=$DEB_SHA" >> "$GITHUB_OUTPUT"
-          echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
+          echo "dmg_arm64_sha256=$DMG_ARM64_SHA" >> "$GITHUB_OUTPUT"
+          echo "dmg_x86_64_sha256=$DMG_X64_SHA"  >> "$GITHUB_OUTPUT"
+          echo "msi_sha256=$MSI_SHA"              >> "$GITHUB_OUTPUT"
+          echo "deb_sha256=$DEB_SHA"              >> "$GITHUB_OUTPUT"
+          echo "jar_sha256=$JAR_SHA"              >> "$GITHUB_OUTPUT"
 
-  update-homebrew-and-scoop:
+  update-homebrew:
     needs: get-release-info
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@v2
         with:
           egress-policy: audit
 
-      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Checkout homebrew tap
+        uses: actions/checkout@v4
         with:
           repository: Stirling-Tools/homebrew-stirling-pdf
           token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          path: tap
+          path: homebrew-tap
 
-      # Stirling-PDF now ships a single universal DMG, so the Cask should
-      # have one sha256 line rather than separate on_arm/on_intel blocks.
-      # We rewrite every `sha256 "..."` in the Cask to the same value so
-      # the workflow keeps working through the Cask migration: pre-migration
-      # both arch blocks get the universal SHA (still correct, since both
-      # would resolve to the same DMG), post-migration the lone sha256 line
-      # is updated.
-      - name: Update Homebrew cask (Casks/stirling-pdf.rb)
+      - name: Update cask (stirling-pdf.rb)
         env:
           VERSION: ${{ needs.get-release-info.outputs.version }}
-          DMG_SHA: ${{ needs.get-release-info.outputs.dmg_sha256 }}
+          ARM64_SHA: ${{ needs.get-release-info.outputs.dmg_arm64_sha256 }}
+          X64_SHA: ${{ needs.get-release-info.outputs.dmg_x86_64_sha256 }}
         run: |
-          CASK="tap/Casks/stirling-pdf.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$CASK"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${DMG_SHA}\"/g" "$CASK"
+          CASK="homebrew-tap/Casks/stirling-pdf.rb"
+          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$CASK"
+          # Update ARM64 sha256 (line following on_arm block)
+          awk -v arm="$ARM64_SHA" -v x64="$X64_SHA" '
+            /on_arm/     { in_arm=1 }
+            /on_intel/   { in_arm=0; in_intel=1 }
+            /end/        { in_arm=0; in_intel=0 }
+            in_arm  && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" arm "\"") }
+            in_intel && /sha256/ { sub(/sha256 ".*"/, "sha256 \"" x64 "\"") }
+            { print }
+          ' "$CASK" > tmp && mv tmp "$CASK"
 
-      - name: Update Homebrew formula (Formula/stirling-pdf-server.rb)
+      - name: Update formula (stirling-pdf-server.rb)
         env:
           VERSION: ${{ needs.get-release-info.outputs.version }}
           JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
         run: |
-          FORMULA="tap/Formula/stirling-pdf-server.rb"
-          sed -i "s/version \"[^\"]*\"/version \"${VERSION}\"/" "$FORMULA"
-          sed -i "s/sha256 \"[^\"]*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
+          FORMULA="homebrew-tap/Formula/stirling-pdf-server.rb"
+          sed -i "s/version \".*\"/version \"${VERSION}\"/" "$FORMULA"
+          sed -i "s/sha256 \".*\"/sha256 \"${JAR_SHA}\"/" "$FORMULA"
 
-      - name: Update Scoop stirling-pdf.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf.json"
-          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
-            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Update Scoop stirling-pdf-server.json
-        env:
-          VERSION: ${{ needs.get-release-info.outputs.version }}
-          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
-        run: |
-          MANIFEST="tap/scoop/stirling-pdf-server.json"
-          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
-            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
-            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
-
-      - name: Show tap diff (for dry-run visibility)
-        working-directory: tap
+      - name: Show homebrew tap diff (for dry-run visibility)
+        working-directory: homebrew-tap
         run: |
           echo "--- diff --stat ---"
           git diff --stat
           echo "--- full diff ---"
           git diff
 
-      - name: Commit and push all tap updates
+      - name: Commit and push homebrew tap updates
         if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        working-directory: tap
+        working-directory: homebrew-tap
         run: |
           git config user.name  "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb scoop/stirling-pdf.json scoop/stirling-pdf-server.json
+          git add Casks/stirling-pdf.rb Formula/stirling-pdf-server.rb
+          git diff --cached --quiet && echo "No changes" && exit 0
+          git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
+          git push
+
+  update-scoop:
+    needs: get-release-info
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Checkout Scoop bucket (shared with Homebrew tap)
+        uses: actions/checkout@v4
+        with:
+          repository: Stirling-Tools/homebrew-stirling-pdf
+          token: ${{ secrets.SCOOP_BUCKET_TOKEN }}
+          path: scoop-bucket
+
+      - name: Update stirling-pdf.json
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          MSI_SHA: ${{ needs.get-release-info.outputs.msi_sha256 }}
+        run: |
+          MANIFEST="scoop-bucket/scoop/stirling-pdf.json"
+          jq --arg v "$VERSION" --arg h "$MSI_SHA" \
+            '.version = $v | .architecture["64bit"].url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-windows-x86_64.msi" | .architecture["64bit"].hash = $h' \
+            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
+
+      - name: Update stirling-pdf-server.json
+        env:
+          VERSION: ${{ needs.get-release-info.outputs.version }}
+          JAR_SHA: ${{ needs.get-release-info.outputs.jar_sha256 }}
+        run: |
+          MANIFEST="scoop-bucket/scoop/stirling-pdf-server.json"
+          jq --arg v "$VERSION" --arg h "$JAR_SHA" \
+            '.version = $v | .url = "https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v\($v)/Stirling-PDF-with-login.jar" | .hash = $h' \
+            "$MANIFEST" > tmp.json && mv tmp.json "$MANIFEST"
+
+      - name: Show Scoop bucket diff (for dry-run visibility)
+        working-directory: scoop-bucket
+        run: |
+          echo "--- diff --stat ---"
+          git diff --stat
+          echo "--- full diff ---"
+          git diff
+
+      - name: Commit and push Scoop bucket updates
+        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
+        working-directory: scoop-bucket
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add scoop/stirling-pdf.json scoop/stirling-pdf-server.json
           git diff --cached --quiet && echo "No changes" && exit 0
           git commit -m "chore: bump Stirling-PDF to v${{ needs.get-release-info.outputs.version }}"
           git push

.github/workflows/pre_commit.yml

@@ -1,11 +1,10 @@
 name: Pre-commit
 
-# Runs `pre-commit run` for ruff / codespell / gitleaks / EOF / trailing-ws.
-# Called from build.yml on PRs and merge_group; also runnable on demand via
-# workflow_dispatch for manual local-equivalent linting.
 on:
-  workflow_call:
   workflow_dispatch:
+  pull_request:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -19,7 +18,7 @@ jobs:
       PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/push-docker-base.yml

@@ -43,20 +43,20 @@ jobs:
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -64,10 +64,10 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Convert repository owner to lowercase
         id: repoowner
@@ -85,7 +85,7 @@ jobs:
 
       - name: Build and push base image
         id: build-push-base
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: docker/base
@@ -100,7 +100,7 @@ jobs:
           sbom: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         with:
           cosign-release: "v2.4.1"
 

.github/workflows/push-docker.yml

@@ -2,22 +2,6 @@ name: Push Docker Image with VersionNumber
 
 on:
   workflow_dispatch:
-    inputs:
-      build_main_app:
-        description: "Build & push the main Stirling-PDF image (latest, fat, ultra-lite)."
-        required: false
-        type: boolean
-        default: true
-      build_unoserver:
-        description: "Build & push the standalone stirling-unoserver image."
-        required: false
-        type: boolean
-        default: true
-      force_unoserver_rebuild:
-        description: "Rebuild stirling-unoserver even if its source hash is unchanged."
-        required: false
-        type: boolean
-        default: false
   push:
     branches:
       - master
@@ -47,13 +31,9 @@ jobs:
     permissions:
       packages: write
       id-token: write
-    # On push events these stay 'true'; on workflow_dispatch they follow the inputs.
-    env:
-      RUN_MAIN_APP: ${{ github.event_name != 'workflow_dispatch' || inputs.build_main_app }}
-      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -66,7 +46,7 @@ jobs:
           distribution: "temurin"
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -76,13 +56,13 @@ jobs:
             gradle-${{ runner.os }}-
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
@@ -96,24 +76,24 @@ jobs:
 
       - name: Install cosign
         if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
         with:
           cosign-release: "v2.4.1"
 
       - name: Install cosign
         if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
         with:
           cosign-release: "v2.4.1"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -128,7 +108,6 @@ jobs:
 
       - name: Generate tags for latest
         id: meta
-        if: env.RUN_MAIN_APP == 'true'
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: |
@@ -143,9 +122,7 @@ jobs:
 
       - name: Build and push Unified Dockerfile (latest variant)
         id: build-push-latest
-        # Empty-tag guard: build-push-action errors when asked to push with no tags.
-        if: env.RUN_MAIN_APP == 'true' && steps.meta.outputs.tags != ''
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -163,7 +140,7 @@ jobs:
           sbom: true
 
       - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         env:
           DIGEST: ${{ steps.build-push-latest.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
@@ -179,7 +156,7 @@ jobs:
       - name: Generate tags for latest-fat
         id: meta-fat
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -192,8 +169,8 @@ jobs:
 
       - name: Build and push Unified Dockerfile (fat variant)
         id: build-push-fat
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-fat.outputs.tags != ''
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -209,7 +186,7 @@ jobs:
           sbom: true
 
       - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         env:
           DIGEST: ${{ steps.build-push-fat.outputs.digest }}
           TAGS: ${{ steps.meta-fat.outputs.tags }}
@@ -223,7 +200,7 @@ jobs:
       - name: Generate tags for ultra-lite
         id: meta-lite
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -236,8 +213,8 @@ jobs:
 
       - name: Build and push Unified Dockerfile (ultra-lite variant)
         id: build-push-lite
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain' && steps.meta-lite.outputs.tags != ''
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -253,7 +230,7 @@ jobs:
           sbom: true
 
       - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
+        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
         env:
           DIGEST: ${{ steps.build-push-lite.outputs.digest }}
           TAGS: ${{ steps.meta-lite.outputs.tags }}
@@ -263,136 +240,3 @@ jobs:
           echo "$TAGS" | tr ',' '\n' | while read -r tag; do
             cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
           done
-
-      # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
-      # only when the version is new. main/testMain: republish :alpha only
-      # when the source hash differs from the published image's annotation.
-      - name: Read unoserver image version
-        id: unoserverVersion
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          version=$(tr -d '[:space:]' < docker/unoserver/VERSION)
-          if [ -z "$version" ]; then
-            echo "docker/unoserver/VERSION is empty"; exit 1
-          fi
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver image version (from file): ${version}"
-
-      - name: Compute unoserver image source hash
-        id: unoserverHash
-        if: env.RUN_UNOSERVER == 'true'
-        run: |
-          set -eu
-          hash=$(cat \
-            docker/unoserver/Dockerfile \
-            docker/unoserver/entrypoint.sh \
-            docker/unoserver/healthcheck.sh \
-            docker/unoserver/VERSION \
-            | sha256sum | cut -d' ' -f1)
-          echo "hash=${hash}" >> "$GITHUB_OUTPUT"
-          echo "Unoserver source hash: ${hash}"
-
-      - name: Decide whether to publish unoserver image
-        id: unoserverDecision
-        if: env.RUN_UNOSERVER == 'true'
-        env:
-          UNOSERVER_VERSION: ${{ steps.unoserverVersion.outputs.version }}
-          UNOSERVER_HASH: ${{ steps.unoserverHash.outputs.hash }}
-          UNOSERVER_IMAGE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-unoserver
-          UNOSERVER_HASH_ANNOTATION: org.stirlingpdf.unoserver-source-hash
-          FORCE_REBUILD: ${{ inputs.force_unoserver_rebuild }}
-          GH_REF: ${{ github.ref }}
-          EVENT_NAME: ${{ github.event_name }}
-        run: |
-          set -eu
-          mode="skip"
-          tags=""
-
-          read_published_hash() {
-            local ref="$1"
-            docker buildx imagetools inspect "$ref" --raw 2>/dev/null \
-              | jq -r --arg key "$UNOSERVER_HASH_ANNOTATION" \
-                  '.annotations[$key] // empty' \
-              2>/dev/null || true
-          }
-
-          # Manual dispatch from any branch routes to the :alpha publish path.
-          EFFECTIVE_REF="$GH_REF"
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            EFFECTIVE_REF="refs/heads/testMain"
-          fi
-
-          case "$EFFECTIVE_REF" in
-            refs/heads/master|refs/heads/V2-master)
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — building stable regardless"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              elif docker manifest inspect "${UNOSERVER_IMAGE}:${UNOSERVER_VERSION}" >/dev/null 2>&1; then
-                echo "stirling-unoserver:${UNOSERVER_VERSION} already on GHCR — skipping"
-              else
-                echo "stirling-unoserver:${UNOSERVER_VERSION} is new — will publish"
-                mode="stable"
-                tags="${UNOSERVER_IMAGE}:${UNOSERVER_VERSION},${UNOSERVER_IMAGE}:latest"
-              fi
-              ;;
-            refs/heads/main|refs/heads/testMain)
-              published_hash=$(read_published_hash "${UNOSERVER_IMAGE}:alpha")
-              if [ "${FORCE_REBUILD}" = "true" ]; then
-                echo "force_unoserver_rebuild=true — rebuilding :alpha regardless"
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              elif [ -n "$published_hash" ] && [ "$published_hash" = "$UNOSERVER_HASH" ]; then
-                echo "Published :alpha source hash matches (${published_hash}) — skipping"
-              else
-                if [ -z "$published_hash" ]; then
-                  echo ":alpha has no source-hash annotation (first publish or pre-tracking image) — will publish"
-                else
-                  echo "Source hash changed (was ${published_hash}, now ${UNOSERVER_HASH}) — will publish"
-                fi
-                mode="alpha"
-                tags="${UNOSERVER_IMAGE}:alpha"
-              fi
-              ;;
-            *)
-              echo "Branch ${GH_REF} does not publish unoserver image"
-              ;;
-          esac
-          echo "mode=${mode}" >> "$GITHUB_OUTPUT"
-          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push unoserver image
-        id: build-push-unoserver
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode != 'skip'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          tags: ${{ steps.unoserverDecision.outputs.tags }}
-          # Manifest annotation read by the decision step above to detect drift.
-          annotations: |
-            index:org.stirlingpdf.unoserver-source-hash=${{ steps.unoserverHash.outputs.hash }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign unoserver image
-        if: env.RUN_UNOSERVER == 'true' && steps.unoserverDecision.outputs.mode == 'stable'
-        env:
-          DIGEST: ${{ steps.build-push-unoserver.outputs.digest }}
-          TAGS: ${{ steps.unoserverDecision.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
-            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-              cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-            done
-          else
-            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping unoserver image signing"
-          fi

.github/workflows/rollback-latest.yml

@@ -18,7 +18,7 @@ jobs:
       packages: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -26,13 +26,13 @@ jobs:
         uses: imjasonh/setup-crane@31b88afe9de28ae0ffa220711af4b60be9435f6e # v0.4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/scorecards.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -67,7 +67,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -75,6 +75,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
+        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
         with:
           sarif_file: results.sarif

.github/workflows/stale.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -40,7 +40,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 

.github/workflows/sync_files_v2.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -57,8 +57,7 @@ jobs:
           cache: "pip" # caching pip dependencies
 
       - name: Install Python dependencies
-        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
+        run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
 
       - name: Sync translation TOML files
         run: |
@@ -84,7 +83,7 @@ jobs:
 
       - name: Create Pull Request
         if: always()
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ steps.setup-bot.outputs.token }}
           commit-message: Update files

.github/workflows/tauri-build.yml

@@ -1,17 +1,6 @@
 name: Build Tauri Applications
 
-# Multi-OS Tauri desktop bundle build matrix (Windows / macOS universal /
-# Linux). Called from build.yml on PRs that touch desktop sources (gated
-# via the `tauri` filter in .github/config/.files.yaml). Also runnable
-# on demand via workflow_dispatch with a per-platform selector.
 on:
-  workflow_call:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)."
-        required: false
-        type: string
-        default: "all"
   workflow_dispatch:
     inputs:
       platform:
@@ -24,6 +13,17 @@ on:
           - windows
           - macos
           - linux
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize, ready_for_review]
+    paths:
+      - "frontend/src-tauri/**"
+      - "frontend/src/desktop/**"
+      - "frontend/tsconfig.desktop.json"
+      - "frontend/package.json"
+      - "frontend/package-lock.json"
+      - "frontend/vite.config.ts"
+      - ".github/workflows/tauri-build.yml"
 
 permissions:
   contents: read
@@ -37,7 +37,7 @@ jobs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -45,17 +45,25 @@ jobs:
         id: set-matrix
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          PLATFORM: ${{ inputs.platform }}
         run: |
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
-          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'
+          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
+          MACOS_ARM='{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"}'
+          MACOS_INTEL='{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}'
+          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'
 
+          # Resolve requested platform (non-dispatch events always build all)
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            PLATFORM="${{ github.event.inputs.platform }}"
+          else
+            PLATFORM="all"
+          fi
+
+          # Build candidate list
           case "$PLATFORM" in
             windows) ENTRIES=("$WINDOWS") ;;
-            macos)   ENTRIES=("$MACOS") ;;
+            macos)   ENTRIES=("$MACOS_ARM" "$MACOS_INTEL") ;;
             linux)   ENTRIES=("$LINUX") ;;
-            *)       ENTRIES=("$WINDOWS" "$MACOS" "$LINUX") ;;
+            *)       ENTRIES=("$WINDOWS" "$MACOS_ARM" "$MACOS_INTEL" "$LINUX") ;;
           esac
 
           # Drop macOS entries when Apple certificate secret is unavailable
@@ -81,10 +89,9 @@ jobs:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
       WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -98,7 +105,7 @@ jobs:
           sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: "npm"
@@ -108,19 +115,7 @@ jobs:
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
           toolchain: stable
-          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up x86_64 JDK 25 (macOS universal JRE)
-        if: matrix.platform == 'macos-15'
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-          architecture: "x64"
-
-      - name: Capture x86_64 JAVA_HOME
-        if: matrix.platform == 'macos-15'
-        run: echo "X64_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
+          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
       - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -129,28 +124,19 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
       - name: Setup Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-
-      - name: Build universal macOS JRE
-        if: matrix.platform == 'macos-15'
-        env:
-          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:jlink:universal-mac
-
       - name: Prepare desktop build
+        run: task desktop:prepare
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare
 
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
@@ -231,7 +217,7 @@ jobs:
           }
 
       - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -252,7 +238,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && env.APPLE_CERTIFICATE != ''
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -263,12 +249,8 @@ jobs:
           echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
           echo "Certificate imported successfully."
 
-      - name: Sign JPDFium dylibs inside bootJar (macOS only)
-        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
-        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
-
       - name: Check DMG creation dependencies (macOS only)
-        if: matrix.platform == 'macos-15'
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         run: |
           echo "🔍 Checking DMG creation dependencies on ${{ matrix.platform }}..."
           echo "hdiutil version: $(hdiutil --version || echo 'NOT FOUND')"
@@ -311,7 +293,9 @@ jobs:
           EOF
 
       - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'ubuntu-22.04'
+        env:
+          RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
         run: |
           echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
           gpg --list-secret-keys --keyid-format=long
@@ -329,7 +313,7 @@ jobs:
           fi
 
       - name: Build Tauri app
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
+        uses: tauri-apps/tauri-action@51a9f1156b33df106d827c3a78f8f894946c5faa # v0.5.25
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -343,8 +327,7 @@ jobs:
           #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
           #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
           # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign when secret is present AND ref is main (skips PRs from forks/Dependabot).
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
+          SIGN: "1"
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
           SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -357,35 +340,10 @@ jobs:
         with:
           projectPath: ./frontend
           tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
-
-      # AppImage is decoupled so its linuxdeploy run gets a fresh process
-      # (rpm scratch state torn down) and its failure can't tank deb/rpm.
-      - name: Build Tauri app (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
-        continue-on-error: true
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
-          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }} # gitleaks:allow
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: --bundles appimage
+          args: ${{ matrix.args }}
 
       - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
+        if: always() && matrix.platform == 'ubuntu-22.04'
         env:
           RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
         run: |
@@ -395,7 +353,7 @@ jobs:
           fi
 
       - name: Verify notarization (macOS only)
-        if: matrix.platform == 'macos-15'
+        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
         run: |
           echo "🔍 Verifying notarization status..."
           cd ./frontend/src-tauri/target
@@ -420,7 +378,7 @@ jobs:
             # Only ship the MSI installer. The loose exe and WiX toolset exes
             # are not the user-facing installer - the MSI contains the signed inner exe.
             find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
             find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
           else
             find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
@@ -494,7 +452,7 @@ jobs:
           }
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Stirling-PDF-${{ matrix.name }}
           path: ./dist/*
@@ -513,7 +471,7 @@ jobs:
               echo "❌ No Windows executable found"
               exit 1
             fi
-          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
+          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
             echo "Checking for macOS artifacts..."
             find . -name "*.dmg" | head -5
             if [ $(find . -name "*.dmg" | wc -l) -eq 0 ]; then
@@ -555,12 +513,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
       - name: Post/Update PR Comment with Download Links
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const owner = context.repo.owner;
@@ -578,7 +536,8 @@ jobs:
             // Map of expected artifact names to display info
             const artifactMap = {
               'Stirling-PDF-windows-x86_64': { icon: '🪟', platform: 'Windows x64', files: '.exe, .msi' },
-              'Stirling-PDF-macos-universal': { icon: '🍎', platform: 'macOS Universal', files: '.dmg' },
+              'Stirling-PDF-macos-aarch64': { icon: '🍎', platform: 'macOS ARM64', files: '.dmg' },
+              'Stirling-PDF-macos-x86_64': { icon: '🍎', platform: 'macOS Intel', files: '.dmg' },
               'Stirling-PDF-linux-x86_64': { icon: '🐧', platform: 'Linux x64', files: '.deb, .rpm, .AppImage' }
             };
 
@@ -646,7 +605,7 @@ jobs:
     if: always()
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/test-build-docker.yml

@@ -1,217 +0,0 @@
-name: Build Docker images (PR test)
-
-# Reusable workflow called from build.yml on PRs to verify the three
-# embedded Dockerfiles (default, ultra-lite, fat) still build cleanly,
-# optionally against a freshly-built base image when the PR touches the
-# base Dockerfile.
-on:
-  workflow_call:
-    inputs:
-      docker-base-changed:
-        description: "Whether the docker base image changed (forwarded from files-changed)."
-        required: false
-        type: string
-        default: "false"
-
-permissions:
-  contents: read
-
-jobs:
-  # TODO: extract a pre-matrix `prepare` job that runs once and produces
-  # shared artifacts for the three matrix entries below to consume:
-  #   1. `task backend:build` — currently runs 3× in parallel with
-  #      identical env (DISABLE_ADDITIONAL_FEATURES=true,
-  #      STIRLING_PDF_DESKTOP_UI=false). Build once, upload the JAR as an
-  #      artifact, matrix entries download.
-  #   2. The base-image `docker build` (gated on docker-base-changed) —
-  #      currently runs 3× in parallel against the same Dockerfile and
-  #      context. Build once, `docker save` to an artifact, matrix entries
-  #      `docker load` before the embedded build.
-  # Saves ~2 full backend builds + 2 base-image builds per PR that touches
-  # docker. May also be reusable from backend-build.yml's jdk-25 +
-  # spring-security=true matrix entry if `task backend:build` and
-  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
-  test-build-docker-images:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-            cache-scope: stirling-pdf-latest
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-            cache-scope: stirling-pdf-ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
-            cache-scope: stirling-pdf-fat
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
-      - name: Build application
-        run: task backend:build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-          STIRLING_PDF_DESKTOP_UI: false
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Build base image locally (PR base change only)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
-
-      - name: Set base image and platform for this build
-        id: build-params
-        # Pass workflow inputs through env vars rather than expanding `${{ }}`
-        # directly into the shell — defense-in-depth against template injection
-        # if any upstream provider of these values ever becomes less trusted.
-        # GITHUB_EVENT_NAME is already provided by the runner.
-        env:
-          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-        run: |
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$DOCKER_BASE_CHANGED" = "true" ]; then
-            echo "base_image=stirling-pdf-base:pr-test" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
-          else
-            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
-            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Build ${{ matrix.docker-rev }}
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          cache-from: type=gha,scope=${{ matrix.cache-scope }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      - name: Upload Reports
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
-          path: |
-            build/reports/tests/
-            build/test-results/
-            build/reports/problems/
-          retention-days: 3
-          if-no-files-found: warn
-
-  test-build-unoserver-image:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Build docker/unoserver/Dockerfile
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          cache-from: type=gha,scope=stirling-unoserver
-          cache-to: type=gha,mode=max,scope=stirling-unoserver
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Smoke test the built image
-        run: |
-          set -eu
-          docker run -d --name unoserver-smoke \
-            -e UNOSERVER_RECYCLE_INTERVAL_SECONDS=0 \
-            stirling-unoserver:pr-test
-          deadline=$((SECONDS + 60))
-          while [ $SECONDS -lt $deadline ]; do
-            status=$(docker inspect -f '{{.State.Health.Status}}' unoserver-smoke 2>/dev/null || echo "starting")
-            if [ "$status" = "healthy" ]; then
-              echo "unoserver became healthy"
-              docker logs unoserver-smoke | tail -30
-              docker rm -f unoserver-smoke
-              exit 0
-            fi
-            sleep 3
-          done
-          echo "unoserver did not become healthy in time"
-          docker logs unoserver-smoke || true
-          docker rm -f unoserver-smoke || true
-          exit 1

.github/workflows/testdriver.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -39,7 +39,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
         with:
           gradle-version: 9.3.1
 
@@ -52,7 +52,7 @@ jobs:
           DISABLE_ADDITIONAL_FEATURES: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Get version number
         id: versionNumber
@@ -61,13 +61,13 @@ jobs:
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
       - name: Build and push test image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
           file: ./docker/embedded/Dockerfile
@@ -131,7 +131,7 @@ jobs:
       frontend: ${{ steps.changes.outputs.frontend }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -150,14 +150,14 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
@@ -186,7 +186,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.gitignore

@@ -32,7 +32,6 @@ exampleYmlFiles/stirling/
 /testing/cucumber/junit/
 /testing/cucumber/report.html
 /testing/.failed_tests
-/.test-state/
 SwaggerDoc.json
 
 # Runtime storage for uploaded files and user data (not Java source code)
@@ -51,7 +50,6 @@ app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
 app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
-app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
@@ -165,6 +163,9 @@ __pycache__/
 *.pyo
 
 # Virtual environments
+.env*
+!.env*.example
+!engine/.env
 .venv*
 env*/
 venv*/
@@ -172,9 +173,6 @@ ENV/
 env.bak/
 venv.bak/
 
-# Env files (secrets / local overrides). Subproject .gitignore files whitelist any committed defaults.
-.env*
-
 # VS Code
 /.vscode/**/*
 !/.vscode/settings.json
@@ -265,11 +263,5 @@ docs/type3/signatures/
 # Type3 sample PDFs (development only)
 **/type3/samples/
 
-**/application-dev-local.properties
-
 # Claude
 .claude/
-
-# Playwright MCP screenshots / traces
-.playwright-mcp/
-*.playwright-mcp.png

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.11
+    rev: v0.14.14
     hooks:
       - id: ruff
         args:
@@ -12,7 +12,7 @@ repos:
         files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
         exclude: (split_photos.py)
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.1
     hooks:
       - id: codespell
         args:
@@ -35,7 +35,7 @@ repos:
         files: ^.*(\.js|\.java|\.py|\.yml)$
         exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
   - repo: https://github.com/pappasam/toml-sort
-    rev: v0.24.4
+    rev: v0.24.3
     hooks:
       - id: toml-sort-fix
         files: frontend/public/locales/.*\.toml$

.taskfiles/backend.yml

@@ -1,48 +1,19 @@
 version: '3'
 
-# Gradle invocation strategy:
-#   - Linux/macOS: `./gradlew` runs the POSIX shell wrapper natively.
-#   - Windows:     `cmd /c ".\gradlew.bat ..."` invokes the .bat wrapper through
-#                  cmd.exe so it inherits the user's Windows-side `JAVA_HOME`
-#                  and PATH. Routing through `bash gradlew` on Windows ends up
-#                  under WSL or Git-Bash, neither of which inherits
-#                  Adoptium/Temurin's default Windows-only Java env - gradlew
-#                  then errors with "JAVA_HOME is not set and no 'java' command
-#                  could be found".
-#
-#                  The entire `.\gradlew.bat ...` payload is double-quoted so
-#                  the leading `.\` survives mvdan/sh's POSIX backslash
-#                  stripping; cmd.exe also requires `.\` (not bare `gradlew.bat`)
-#                  because modern Windows excludes cwd from cmd's search path.
-
 tasks:
   dev:
     desc: "Start backend dev server"
     ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
     cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: cmd /c gradlew.bat :stirling-pdf:bootRun
         platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
-        platforms: [linux, darwin]
-
-  dev:bundled:
-    desc: "Clean + bootRun with frontend bundled into the backend (single :8080 server)"
-    ignore_error: true
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean bootRun -PbuildWithFrontend=true"
-        platforms: [windows]
-      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
+      - cmd: ./gradlew :stirling-pdf:bootRun
         platforms: [linux, darwin]
 
   build:
     desc: "Full backend build"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build"
+      - cmd: cmd /c gradlew.bat clean build
         platforms: [windows]
       - cmd: ./gradlew clean build
         platforms: [linux, darwin]
@@ -50,7 +21,7 @@ tasks:
   build:fast:
     desc: "Build without tests"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build -x test"
+      - cmd: cmd /c gradlew.bat clean build -x test
         platforms: [windows]
       - cmd: ./gradlew clean build -x test
         platforms: [linux, darwin]
@@ -58,7 +29,7 @@ tasks:
   build:ci:
     desc: "Build for CI (formatting checked separately)"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat build -PnoSpotless"
+      - cmd: cmd /c gradlew.bat build -PnoSpotless
         platforms: [windows]
       - cmd: ./gradlew build -PnoSpotless
         platforms: [linux, darwin]
@@ -66,7 +37,7 @@ tasks:
   test:
     desc: "Run backend tests"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat test"
+      - cmd: cmd /c gradlew.bat test
         platforms: [windows]
       - cmd: ./gradlew test
         platforms: [linux, darwin]
@@ -74,7 +45,7 @@ tasks:
   format:
     desc: "Auto-fix code formatting"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessApply"
+      - cmd: cmd /c gradlew.bat spotlessApply
         platforms: [windows]
       - cmd: ./gradlew spotlessApply
         platforms: [linux, darwin]
@@ -82,7 +53,7 @@ tasks:
   format:check:
     desc: "Check code formatting"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessCheck"
+      - cmd: cmd /c gradlew.bat spotlessCheck
         platforms: [windows]
       - cmd: ./gradlew spotlessCheck
         platforms: [linux, darwin]
@@ -95,7 +66,7 @@ tasks:
   swagger:
     desc: "Generate OpenAPI docs"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
+      - cmd: cmd /c gradlew.bat :stirling-pdf:copySwaggerDoc
         platforms: [windows]
       - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
         platforms: [linux, darwin]
@@ -116,7 +87,7 @@ tasks:
     desc: "Print project version"
     silent: true
     cmds:
-      - cmd: cmd /c ".\gradlew.bat printVersion --quiet" | tail -1
+      - cmd: cmd /c gradlew.bat printVersion --quiet | tail -1
         platforms: [windows]
       - cmd: ./gradlew printVersion --quiet | tail -1
         platforms: [linux, darwin]
@@ -124,7 +95,7 @@ tasks:
   licenses:check:
     desc: "Check dependency licenses"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense --no-parallel"
+      - cmd: cmd /c gradlew.bat checkLicense --no-parallel
         platforms: [windows]
       - cmd: ./gradlew checkLicense --no-parallel
         platforms: [linux, darwin]
@@ -132,7 +103,7 @@ tasks:
   licenses:generate:
     desc: "Check and generate dependency license report"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense generateLicenseReport --no-parallel"
+      - cmd: cmd /c gradlew.bat checkLicense generateLicenseReport --no-parallel
         platforms: [windows]
       - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
         platforms: [linux, darwin]
@@ -140,7 +111,7 @@ tasks:
   clean:
     desc: "Clean build artifacts"
     cmds:
-      - cmd: cmd /c ".\gradlew.bat clean"
+      - cmd: cmd /c gradlew.bat clean
         platforms: [windows]
       - cmd: ./gradlew clean
         platforms: [linux, darwin]

.taskfiles/desktop.yml

@@ -3,30 +3,10 @@ version: '3'
 vars:
   JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
 
-  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
-  JPDFIUM_PLATFORMS:
-    sh: |
-      if [ -n "${JPDFIUM_PLATFORMS:-}" ]; then
-          echo "$JPDFIUM_PLATFORMS"
-      else
-          case "{{OS}}-{{ARCH}}" in
-              darwin-arm64)  echo "darwin-arm64";;
-              darwin-amd64)  echo "darwin-x64";;
-              linux-amd64)   echo "linux-x64";;
-              linux-arm64)   echo "linux-arm64";;
-              windows-amd64) echo "windows-x64";;
-              *)             echo "all";;
-          esac
-      fi
-
 tasks:
   prepare:
     desc: "Prepare desktop build dependencies"
-    deps:
-      - jlink
-      - task: ":frontend:prepare"
-        vars: { MODE: desktop }
-      - provisioner
+    deps: [jlink, ":frontend:prepare:desktop", provisioner]
 
   provisioner:
     desc: "Build installer provisioner"
@@ -87,16 +67,15 @@ tasks:
     deps: [jlink:jar, jlink:runtime]
 
   jlink:jar:
-    desc: "Build backend JAR for Tauri bundling (host-OS natives only by default)"
+    desc: "Build backend JAR for Tauri bundling"
     run: once
     dir: ..
     env:
       DISABLE_ADDITIONAL_FEATURES: "true"
     cmds:
-      - echo "Building bootJar with JPDFium natives for {{.JPDFIUM_PLATFORMS}}"
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
+      - cmd: cmd /c gradlew.bat bootJar --no-daemon
         platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
+      - cmd: ./gradlew bootJar --no-daemon
         platforms: [linux, darwin]
       - mkdir -p frontend/src-tauri/libs
       - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
@@ -113,7 +92,7 @@ tasks:
         jlink
         --add-modules {{.JLINK_MODULES}}
         --strip-debug
-        --compress=zip-6
+        --compress=2
         --no-header-files
         --no-man-pages
         --output src-tauri/runtime/jre
@@ -124,18 +103,3 @@ tasks:
     desc: "Remove JLink runtime and bundled JARs"
     cmds:
       - rm -rf src-tauri/libs src-tauri/runtime
-
-  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
-  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
-  # jlink under Rosetta on Apple Silicon, so it is opt-in and not part of
-  # the default desktop:build flow. Requires AARCH64_JAVA_HOME and
-  # X64_JAVA_HOME to point at matching JDK installations with jmods/.
-  jlink:universal-mac:
-    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
-    deps: [jlink:jar]
-    platforms: [darwin]
-    env:
-      JLINK_MODULES: "{{.JLINK_MODULES}}"
-      OUTPUT_DIR: src-tauri/runtime/jre
-    cmds:
-      - scripts/build-universal-mac-jre.sh

.taskfiles/docker.yml

@@ -55,9 +55,3 @@ tasks:
     desc: "Tail docker compose logs"
     cmds:
       - docker compose -f {{.COMPOSE_DIR}}/docker-compose.yml logs -f
-
-  test:
-    desc: "Run full Docker integration test suite (builds all variants and tests them)"
-    ignore_error: true
-    cmds:
-      - bash testing/test.sh {{.CLI_ARGS}}

.taskfiles/e2e.yml

@@ -1,204 +0,0 @@
-version: '3'
-
-tasks:
-  install:
-    desc: "Install Playwright browsers"
-    dir: frontend
-    deps: [ ':frontend:install' ]
-    cmds:
-      - npx playwright install {{.CLI_ARGS}} --with-deps
-
-  stubbed:
-    desc: "Run stubbed E2E tests"
-    dir: frontend
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed {{.CLI_ARGS}}
-
-  live:
-    desc: "Run live E2E tests"
-    summary: |
-      Auto-spawns a Spring Boot backend with isolated state under
-      .test-state/playwright/ (purged on every run) so the suite doesn't
-      touch your local DB, settings.yml, backups or customFiles. The
-      backend is stopped automatically when the runner exits.
-
-      Pass extra Playwright flags via -- :
-        task e2e:live -- --headed --grep merge
-    deps:
-      - live:backend
-      - live:runner
-
-  live:backend:
-    internal: true
-    ignore_error: true
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    env:
-      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
-      # Suppress the analytics opt-in modal that fires on first admin login.
-      # It renders a Mantine overlay that intercepts pointer events and blocks
-      # FirstLoginSlide from rendering, so the bootstrap spec times out waiting
-      # for the password-change prompt.
-      SYSTEM_ENABLEANALYTICS: "false"
-      # NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
-      # The live-setup project's bootstrap spec performs the real first-login
-      # flow against the backend's default admin/stirling user, exercising the
-      # forced-password-change UI and leaving the DB at admin/adminadmin for
-      # the rest of the live suite. This is both real coverage of the first-
-      # login flow and a stronger seed than env-var-driven user creation.
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) doesn't
-      # support `&` + `$!` + `wait` reliably (gradle was never actually
-      # backgrounded, so `$!` recorded a stale PID and the runner saw an
-      # immediate "backend died"). Real bash backgrounds gradle properly and
-      # gives us a stable PID to clean up.
-      - |
-        bash -c '
-          set -e
-          rm -rf "{{.BASE_DIR}}"
-          mkdir -p "{{.BASE_DIR}}"
-          # Background gradle and record its PID so the runner can clean up
-          # the exact process tree (wrapper + forked Spring Boot JVM) without
-          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
-          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
-          # synchronised.
-          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
-          GRADLE_PID=$!
-          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
-          wait $GRADLE_PID
-        '
-
-  live:runner:
-    internal: true
-    deps: [ ':frontend:prepare' ]
-    dir: frontend
-    vars:
-      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    cmds:
-      # Wrapped in `bash -c` because Task's embedded shell (mvdan/sh) only
-      # supports `EXIT`/`ERR` in `trap`, not `INT`/`TERM`. CLI_ARGS are
-      # passed positionally so quoted args like --grep "foo bar" survive.
-      - |
-        bash -c '
-          set +e
-          # bootRun forks a separate Spring Boot JVM as a child of the gradle
-          # wrapper; killing only the wrapper leaves that JVM orphaned holding
-          # :8080. Walk the recorded PID'"'"'s process tree via pgrep so we kill
-          # every descendant, then lsof as a last-resort backstop.
-          kill_tree() {
-            local pid=$1
-            for child in $(pgrep -P "$pid" 2>/dev/null); do
-              kill_tree "$child"
-            done
-            kill "$pid" 2>/dev/null || true
-          }
-          cleanup() {
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              echo "Stopping backend..."
-              kill_tree "$(cat "{{.BASE_DIR}}/backend.pid")"
-              sleep 1
-              lsof -ti:8080 2>/dev/null | xargs kill 2>/dev/null || true
-              echo "Backend stopped"
-            fi
-          }
-          # Trap so cleanup runs on every exit path: tests pass, tests fail,
-          # backend never starts, user Ctrl-Cs. Without this the gradle JVM
-          # is left orphaned holding :8080 whenever the wait loop times out.
-          trap cleanup EXIT INT TERM
-
-          echo "Waiting for backend on :8080 (up to 10min; first compile can be slow)..."
-          WAITED=0
-          while [ $WAITED -lt 600 ]; do
-            if curl -sf http://localhost:8080/api/v1/info/status 2>/dev/null | grep -q UP; then
-              echo "Backend ready, starting Playwright"
-              break
-            fi
-            # Bail early if the backend already died: no point waiting 10min.
-            if [ -f "{{.BASE_DIR}}/backend.pid" ]; then
-              BACKEND_PID=$(cat "{{.BASE_DIR}}/backend.pid")
-              if ! kill -0 "$BACKEND_PID" 2>/dev/null; then
-                echo "Backend process exited before becoming ready; last 100 log lines:"
-                tail -100 "{{.BASE_DIR}}/backend.log" 2>/dev/null || true
-                exit 1
-              fi
-            fi
-            sleep 2
-            WAITED=$((WAITED + 2))
-          done
-          if [ $WAITED -ge 600 ]; then
-            echo "Backend did not become ready within 10min, aborting"
-            exit 1
-          fi
-
-          npx playwright test --project=live "$@"
-        ' bash {{.CLI_ARGS}}
-
-  enterprise:
-    desc: "Run enterprise E2E tests"
-    summary: |
-      Requires an already-running keycloak compose stack on :8080. Bring one
-      up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    dir: frontend
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=enterprise {{.CLI_ARGS}}
-
-  cross-browser:
-    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend
-    deps: [ ':frontend:prepare' ]
-    cmds:
-      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
-
-  check:
-    desc: "Run all E2E tests not requiring Docker"
-    cmds:
-      - task: stubbed
-      - task: live
-
-  check:all:
-    desc: "Run all E2E tests"
-    summary: |
-      Includes the enterprise project, which requires a keycloak compose
-      stack on :8080. Bring one up first with:
-        task e2e:oauth:up
-        task e2e:saml:up
-    cmds:
-      - task: stubbed
-      - task: live
-      - task: enterprise
-
-  oauth:up:
-    desc: "Start the OAuth keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:oauth:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:oauth:up -- --auto --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-oauth-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  oauth:down:
-    desc: "Stop the OAuth keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-oauth.yml down -v
-
-  saml:up:
-    desc: "Start the SAML keycloak test environment"
-    summary: |
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:saml:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:saml:up -- --auto --with-storage --nobuild --language sv-SE
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-saml-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  saml:down:
-    desc: "Stop the SAML keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v

.taskfiles/engine.yml

@@ -28,24 +28,20 @@ tasks:
     deps: [prepare]
     ignore_error: true
     dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port 5001
 
   dev:
     desc: "Start engine dev server with hot reload"
     deps: [prepare]
     ignore_error: true
     dir: src
-    vars:
-      PORT: '{{.PORT | default "5001"}}'
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --reload
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port 5001 --reload
 
   lint:
     desc: "Run linting"
@@ -86,9 +82,8 @@ tasks:
   fix:
     desc: "Auto-fix lint + format"
     cmds:
-      - task: format  # Can auto-fix some things that `lint:fix` can't like line length violations
       - task: lint:fix
-      - task: format  # Ensure that after lint fixing that the code is still formatted correctly
+      - task: format
 
   check:
     desc: "Full engine quality gate"

.taskfiles/frontend.yml

@@ -15,21 +15,47 @@ tasks:
       CI: '{{ .CI | default "false" }}'
 
   prepare:env:
-    internal: true
-    run: when_changed
+    desc: "Generate .env from example if missing"
+    run: once
     deps: [install]
-    vars:
-      MODE: '{{.MODE | default ""}}'
     cmds:
-      - npx tsx scripts/setup-env.ts{{if .MODE}} --{{.MODE}}{{end}}
+      - npx tsx scripts/setup-env.ts
     sources:
       - scripts/setup-env.ts
+      - config/.env.example
     generates:
-      - .env.local
-      - .env{{if .MODE}}.{{.MODE}}{{end}}.local
+      - .env
+
+  prepare:env:saas:
+    desc: "Generate .env and .env.saas from examples if missing"
+    run: once
+    deps: [install]
+    cmds:
+      - npx tsx scripts/setup-env.ts --saas
+    sources:
+      - scripts/setup-env.ts
+      - config/.env.example
+      - config/.env.saas.example
+    generates:
+      - .env
+      - .env.saas
+
+  prepare:env:desktop:
+    desc: "Generate .env and .env.desktop from examples if missing"
+    run: once
+    deps: [install]
+    cmds:
+      - npx tsx scripts/setup-env.ts --desktop
+    sources:
+      - scripts/setup-env.ts
+      - config/.env.example
+      - config/.env.desktop.example
+    generates:
+      - .env
+      - .env.desktop
 
   prepare:icons:
-    internal: true
+    desc: "Generate icon bundle from source references"
     run: once
     deps: [install]
     cmds:
@@ -37,75 +63,64 @@ tasks:
 
   prepare:
     desc: "Set up dev environment"
-    run: when_changed
-    vars:
-      MODE: '{{.MODE | default ""}}'
-    deps:
-      - task: prepare:env
-        vars: { MODE: '{{.MODE}}' }
-      - prepare:icons
+    run: once
+    deps: [prepare:env, prepare:icons]
+
+  prepare:saas:
+    desc: "Prepare for SaaS mode"
+    run: once
+    deps: [prepare:env:saas, prepare:icons]
+
+  prepare:desktop:
+    desc: "Prepare for desktop mode"
+    run: once
+    deps: [prepare:env:desktop, prepare:icons]
 
   # ============================================================
   # Development
   # ============================================================
 
-  dev:_run:
-    internal: true
-    ignore_error: true
-    vars:
-      MODE: '{{.MODE}}'
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      OPEN: '{{.OPEN | default ""}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-    cmds:
-      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
-
   dev:
     desc: "Start frontend dev server"
+    deps: [prepare]
+    ignore_error: true
     cmds:
-      - task: dev:proprietary
-        vars: { PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - npx vite
 
   dev:core:
     desc: "Start frontend dev server in core mode"
     deps: [prepare]
+    ignore_error: true
     cmds:
-      - task: dev:_run
-        vars: { MODE: core, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - npx vite --mode core
 
   dev:proprietary:
     desc: "Start frontend dev server in proprietary mode"
     deps: [prepare]
+    ignore_error: true
     cmds:
-      - task: dev:_run
-        vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - npx vite --mode proprietary
 
   dev:saas:
     desc: "Start frontend dev server in SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
+    deps: [prepare:saas]
+    ignore_error: true
     cmds:
-      - task: dev:_run
-        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - npx vite --mode saas
 
   dev:desktop:
     desc: "Start frontend dev server in desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
+    deps: [prepare:desktop]
+    ignore_error: true
     cmds:
-      - task: dev:_run
-        vars: { MODE: desktop, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - npx vite --mode desktop
 
   dev:prototypes:
     desc: "Start frontend dev server in prototypes mode"
     deps: [prepare]
+    ignore_error: true
     cmds:
-      - task: dev:_run
-        vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - npx vite --mode prototypes
 
   # ============================================================
   # Build
@@ -131,17 +146,13 @@ tasks:
 
   build:saas:
     desc: "Build for SaaS mode"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
+    deps: [prepare:saas]
     cmds:
       - npx vite build --mode saas
 
   build:desktop:
     desc: "Build for desktop mode"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
+    deps: [prepare:desktop]
     cmds:
       - npx vite build --mode desktop
 
@@ -205,17 +216,13 @@ tasks:
 
   typecheck:saas:
     desc: "Typecheck SaaS build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: saas }
+    deps: [prepare:saas]
     cmds:
       - npx tsc --noEmit --project src/saas/tsconfig.json
 
   typecheck:desktop:
     desc: "Typecheck desktop build variant"
-    deps:
-      - task: prepare
-        vars: { MODE: desktop }
+    deps: [prepare:desktop]
     cmds:
       - npx tsc --noEmit --project src/desktop/tsconfig.json
 
@@ -239,7 +246,6 @@ tasks:
       - task: typecheck:saas
       - task: typecheck:desktop
       - task: typecheck:scripts
-      - task: typecheck:prototypes
 
   # ============================================================
   # Quality Gate
@@ -284,6 +290,18 @@ tasks:
     cmds:
       - npx vitest --coverage
 
+  test:e2e:
+    desc: "Run E2E tests"
+    deps: [prepare]
+    cmds:
+      - npx playwright test {{.CLI_ARGS}}
+
+  test:e2e:install:
+    desc: "Install E2E test browsers"
+    deps: [install]
+    cmds:
+      - npx playwright install {{.CLI_ARGS}} --with-deps
+
   # ============================================================
   # Code Generation
   # ============================================================

AGENTS.md

@@ -6,8 +6,6 @@ This file provides guidance to AI Agents when working with code in this reposito
 
 This project uses [Task](https://taskfile.dev/) as a unified command runner. All build, dev, test, lint, and docker commands can be run from the repo root via `task <command>`. Run `task --list` to see all available commands.
 
-Task `desc:` fields should describe **what** the task does, not **how** it does it. Keep them generic and stable: don't reference implementation details like aliases, internal helpers, mode flags, or which other task delegates to which. The description is for users picking a command from `task --list`, not a changelog of refactors.
-
 ### Quick Reference
 - `task install` — install all dependencies
 - `task dev` — start backend + frontend concurrently
@@ -45,86 +43,15 @@ After modifying any files in the project, you must run the relevant `task check`
 ### Security Mode Development
 Set `DOCKER_ENABLE_SECURITY=true` environment variable to enable security features during development. This is required for testing the full version locally.
 
-### Python Development (AI Engine)
+### Python Development
+Development for the AI engine happens in the `engine/` folder. The frontend calls the Python via Java as a proxy.
 
-The engine is a Python reasoning service for Stirling: it plans and interprets work, but it does not own durable state, and it does not execute Stirling PDF operations directly. Keep the service narrow: typed contracts in, typed contracts out, with AI only where it adds reasoning value. The frontend calls the Python engine via Java as a proxy.
-
-#### Python Commands
-All engine commands run from the repo root using Task:
-- `task engine:check` — run all checks (typecheck + lint + format-check + test)
-- `task engine:fix` — auto-fix lint + formatting
-- `task engine:install` — install Python dependencies via uv
-- `task engine:dev` — start FastAPI with hot reload (localhost:5001)
-- `task engine:test` — run pytest
-- `task engine:lint` — run ruff linting
-- `task engine:typecheck` — run pyright
-- `task engine:format` — format code with ruff
-- `task engine:tool-models` — generate `tool_models.py` from the Java OpenAPI spec
-
-The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
-
-#### Python Code Style
-- Keep `task engine:check` passing.
-- Use modern Python when it improves clarity.
-- Prefer explicit names to cleverness.
-- Avoid nested functions and nested classes unless the language construct requires them.
-- Prefer composition to inheritance when combining concepts.
-- Avoid speculative abstractions. Add a layer only when it removes real duplication or clarifies lifecycle.
-- Add comments sparingly and only when they explain non-obvious intent.
-
-#### Python Typing and Models
-- Deserialize into Pydantic models as early as possible.
-- Serialize from Pydantic models as late as possible.
-- Do not pass raw `dict[str, Any]` or `dict[str, object]` across important boundaries when a typed model can exist instead.
-- Avoid `Any` wherever possible.
-- Avoid `cast()` wherever possible (reconsider the structure first).
-- All shared models should subclass `stirling.models.ApiModel` so the service behaves consistently.
-- Do not use string literals for any type annotations, including `cast()`.
-
-#### Python Configuration
-- Keep application-owned configuration in `stirling.config`.
-- Only add `STIRLING_*` environment variables that the engine itself truly owns.
-- Do not mirror third-party provider environment variables unless the engine is actually interpreting them.
-- Let `pydantic-ai` own provider authentication configuration when possible.
-
-#### Python Architecture
-
-**Package roles:**
-- `stirling.contracts`: request/response models and shared typed workflow contracts. If a shape crosses a module or service boundary, it probably belongs here.
-- `stirling.models`: shared model primitives and generated tool models.
-- `stirling.agents`: reasoning modules for individual capabilities.
-- `stirling.api`: HTTP layer, dependency access, and app startup wiring.
-- `stirling.services`: shared runtime and non-AI infrastructure.
-- `stirling.config`: application-owned settings.
-
-**Source of truth:**
-- `stirling.models.tool_models` is the source of truth for operation IDs and parameter models.
-- Do not duplicate operation lists if they can be derived from `tool_models.OPERATIONS`.
-- Do not hand-maintain parallel parameter schemas when the generated tool models already define them.
-- If a tool ID must match a parameter model, validate that relationship explicitly in code.
-
-**Boundaries:**
-- Keep the API layer thin. Route modules should bind requests, resolve dependencies, and call agents or services. They should not contain business logic.
-- Keep agents focused on one reasoning domain. They should not own FastAPI routing, persistence, or execution of Stirling operations.
-- Build long-lived runtime objects centrally at startup when possible rather than reconstructing heavy AI objects per request.
-- If an agent delegates to another agent, the delegated agent should remain the source of truth for its own domain output.
-
-#### Python AI Usage
-- The system must work with any AI, including self-hosted models. We require that the models support structured outputs, but should minimise model-specific code beyond that.
-- Use AI for reasoning-heavy outputs, not deterministic glue.
-- Do not ask the model to invent data that Python can derive safely.
-- Do not fabricate fallback user-facing copy in code to hide incomplete model output.
-- AI output schemas should be impossible to instantiate incorrectly.
-  - Do not require the model to keep separate structures in sync. For example, instead of generating two lists which must be the same length, generate one list of a model containing the same data.
-  - Prefer Python to derive deterministic follow-up structure from a valid AI result.
-- Use `NativeOutput(...)` for structured model outputs.
-- Use `ToolOutput(...)` when the model should select and call delegate functions.
-
-#### Python Testing
-- Test contracts directly.
-- Test agents directly where behaviour matters.
-- Test API routes as thin integration points.
-- Prefer dependency overrides or startup-state seams to monkeypatching random globals.
+- Follow the engine-specific guidance in [engine/AGENTS.md](engine/AGENTS.md) for Python architecture, code style, and AI usage.
+- Use Task commands from the repo root:
+  - `task engine:check` — lint, type-check, test
+  - `task engine:fix` — auto-fix linting and formatting
+  - `task engine:install` — install dependencies
+- The project structure is defined in `engine/pyproject.toml`. Any new dependencies should be listed there, followed by running `task engine:install`.
 
 ### Frontend Development
 - **Frontend dev server**: `task frontend:dev` — requires backend on localhost:8080
@@ -138,14 +65,12 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
   - **Development**: `task desktop:dev` for desktop dev mode
 
 #### Environment Variables
-- All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/.env` — core, proprietary, and shared vars
-  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
-- These files are committed to Git and must not contain private keys
-- Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
-- Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
-- `task frontend:prepare` creates empty `.local` override files on first run; pass `MODE=saas` or `MODE=desktop` to also create the mode-specific `.local` file
+- All `VITE_*` variables must be declared in the appropriate example file:
+  - `frontend/config/.env.example` — core, proprietary, and shared vars
+  - `frontend/config/.env.saas.example` — SaaS-only vars
+  - `frontend/config/.env.desktop.example` — desktop (Tauri)-only vars
+- Never use `|| 'hardcoded-fallback'` inline — put defaults in the example files
+- `task frontend:prepare` / `prepare:saas` / `prepare:desktop` auto-create the env files from examples on first run, and error if any required keys are missing
 - Prepare runs automatically as a dependency of all `dev*`, `build*`, and `desktop*` tasks
 - See `frontend/README.md#environment-variables` for full documentation
 
@@ -183,26 +108,26 @@ Use this pattern for desktop-specific or proprietary-specific features WITHOUT r
 **Example - Desktop-specific footer:**
 
 ```typescript
-// core/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (stub)
-interface WorkbenchBarFooterExtensionsProps {
+// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
+interface RightRailFooterExtensionsProps {
   className?: string;
 }
 
-export function WorkbenchBarFooterExtensions(_props: WorkbenchBarFooterExtensionsProps) {
+export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
   return null; // Stub - does nothing in web builds
 }
 ```
 
 ```tsx
-// desktop/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (real implementation)
+// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
 import { Box } from '@mantine/core';
 import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';
 
-interface WorkbenchBarFooterExtensionsProps {
+interface RightRailFooterExtensionsProps {
   className?: string;
 }
 
-export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterExtensionsProps) {
+export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
   return (
     <Box className={className}>
       <BackendHealthIndicator />
@@ -212,15 +137,15 @@ export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterEx
 ```
 
 ```tsx
-// core/components/shared/WorkbenchBar.tsx (usage - works in ALL builds)
-import { WorkbenchBarFooterExtensions } from '@app/components/workbenchBar/WorkbenchBarFooterExtensions';
+// core/components/shared/RightRail.tsx (usage - works in ALL builds)
+import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';
 
-export function WorkbenchBar() {
+export function RightRail() {
   return (
     <div>
       {/* In web builds: renders nothing (stub returns null) */}
       {/* In desktop builds: renders BackendHealthIndicator */}
-      <WorkbenchBarFooterExtensions className="workbench-bar-footer" />
+      <RightRailFooterExtensions className="right-rail-footer" />
     </div>
   );
 }
@@ -431,7 +356,7 @@ The frontend is organized with a clear separation of concerns:
 
 ## Important Notes
 
-- **Java Version**: Requires JDK 25.
+- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
 - **Lombok**: Used extensively - ensure IDE plugin is installed
 - **File Persistence**:
   - **Backend**: Designed to be stateless - files are processed in memory/temp locations only

DeveloperGuide.md

@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:
 
 **Backend:**
-- Spring Boot (requires JDK 25)
+- Spring Boot (Java 21+, JDK 25 recommended)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -45,7 +45,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
-- Java JDK 25
+- Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
 - [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
@@ -61,7 +61,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
    cd Stirling-PDF
    ```
 
-2. Install Docker and JDK 25 if not already installed.
+2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.
 
 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
    1. Only VSCode

LICENSE

@@ -6,8 +6,6 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "app/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
 * All content that resides under the "frontend/src/proprietary/" directory of this repository,

Taskfile.yml

@@ -2,10 +2,6 @@ version: '3'
 
 output: prefixed
 
-vars:
-  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts/find-free-port.ps1
-  FIND_FREE_PORT_SH: bash scripts/find-free-port.sh
-
 includes:
   backend:
     taskfile: .taskfiles/backend.yml
@@ -22,9 +18,6 @@ includes:
   desktop:
     taskfile: .taskfiles/desktop.yml
     dir: frontend
-  e2e:
-    taskfile: .taskfiles/e2e.yml
-    dir: .
 
 tasks:
   # ============================================================
@@ -42,43 +35,17 @@ tasks:
   # ============================================================
 
   dev:
-    desc: "Start backend + frontend concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
+    desc: "Start backend + frontend concurrently"
     deps:
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-      - task: frontend:dev
-        vars:
-          PORT: '{{.FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          OPEN: "true"
+      - backend:dev
+      - frontend:dev
 
   dev:all:
-    desc: "Start backend + frontend + engine concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-      ENGINE_PORT: '{{index (splitList "\n" .PORTS) 2}}'
+    desc: "Start backend + frontend + engine concurrently"
     deps:
-      - task: engine:dev
-        vars:
-          PORT: '{{.ENGINE_PORT}}'
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-      - task: frontend:dev:prototypes
-        vars:
-          PORT: '{{.FRONTEND_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          OPEN: "true"
+      - backend:dev
+      - frontend:dev:prototypes
+      - engine:dev
 
   # ============================================================
   # Build

app/common/build.gradle

@@ -29,55 +29,26 @@ spotless {
     }
 }
 dependencies {
-    api 'com.google.guava:guava:33.6.0-jre'
+    api 'com.google.guava:guava:33.5.0-jre'
     api 'org.springframework.boot:spring-boot-starter-webmvc'
     api 'org.springframework.boot:spring-boot-starter-aspectj'
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
     api 'org.apache.commons:commons-lang3:3.20.0'
-    api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor
+    api 'com.drewnoakes:metadata-extractor:2.19.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
     api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
     api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.5.8' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.2"
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
     api 'org.simplejavamail:simple-java-mail:8.12.6'
     api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
     api 'jakarta.mail:jakarta.mail-api:2.1.5'
     runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
-
-    // Tabula table extraction — used by the shared PDF parser and directly by downstream modules.
-    // api-scoped so downstream modules (core, proprietary) retain it on their compile classpath.
-    api ('technology.tabula:tabula:1.0.5') {
-        exclude group: 'org.slf4j', module: 'slf4j-simple'
-        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
-        exclude group: 'com.google.code.gson', module: 'gson'
-    }
-
-    api 'com.stirling:jpdfium:1.0.0'
-
-    // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
-    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
-    def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
-    def jpdfiumPlatforms = jpdfiumPlatformsProp == 'all'
-            ? jpdfiumAllPlatforms
-            : jpdfiumPlatformsProp.split(',').collect { it.trim() }.findAll { it }
-    def jpdfiumInvalid = jpdfiumPlatforms.findAll { !jpdfiumAllPlatforms.contains(it) }
-    if (jpdfiumInvalid) {
-        throw new GradleException("Unknown jpdfiumPlatforms value(s): ${jpdfiumInvalid.join(', ')}. " +
-                "Valid: ${jpdfiumAllPlatforms.join(', ')} or 'all'.")
-    }
-    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
-    jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.0"
-    }
-
-    // ArchUnit: enforces module dependency direction (see ArchitectureTest)
-    testImplementation 'com.tngtech.archunit:archunit-junit5:1.4.2'
 }

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -68,36 +68,6 @@ public class EndpointConfiguration {
         return endpoint.startsWith("/") ? endpoint.substring(1) : endpoint;
     }
 
-    /**
-     * Translate a full request URI like {@code /api/v1/general/remove-pages} into the endpoint key
-     * used by this configuration ({@code remove-pages}). Convert endpoints are a special case -
-     * {@code /api/v1/convert/pdf/img} is registered as {@code pdf-to-img}. Returns {@code null} if
-     * the URI is not an {@code /api/v1/<group>/<endpoint>} path.
-     */
-    public static String endpointKeyForUri(String uri) {
-        if (uri == null || !uri.contains("/api/v1")) {
-            return null;
-        }
-        String[] parts = uri.split("/");
-        if (parts.length <= 4) {
-            return null;
-        }
-        if ("convert".equals(parts[3]) && parts.length > 5) {
-            return parts[4] + "-to-" + parts[5];
-        }
-        return parts[4];
-    }
-
-    /**
-     * Convenience wrapper around {@link #isEndpointEnabled(String)} that accepts a full request URI
-     * and translates it to the endpoint key. Falls back to treating the URI itself as a key for
-     * non-{@code /api/v1/...} paths so callers can pass arbitrary URIs.
-     */
-    public boolean isEndpointEnabledForUri(String uri) {
-        String key = endpointKeyForUri(uri);
-        return isEndpointEnabled(key != null ? key : uri);
-    }
-
     public void enableEndpoint(String endpoint) {
         String normalized = normalizeEndpoint(endpoint);
         endpointStatuses.put(normalized, true);

app/common/src/main/java/stirling/software/SPDF/pdf/parser/CompositeTableParser.java

@@ -1,73 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.context.annotation.Primary;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
- * LineAlignmentTableParser}. The first parser returning a result above {@link
- * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
- */
-@Service
-@Primary
-@RequiredArgsConstructor
-@Slf4j
-public class CompositeTableParser implements TableParser {
-
-    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
-    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
-
-    private final TabulaTableParser tabulaParser;
-    private final LineAlignmentTableParser lineAlignmentParser;
-
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        // Step 1: Tabula lattice mode (ruled/bordered tables).
-        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
-        if (!latticeResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using Tabula lattice ({} table(s))",
-                    rawPage.pageNumber(),
-                    latticeResults.size());
-            return latticeResults;
-        }
-
-        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
-        // parseStream is not on the TableParser interface — this intentionally couples to the
-        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
-        List<TableFragment> streamResults =
-                filterConfident(tabulaParser.parseStream(document, rawPage));
-        if (!streamResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using Tabula stream ({} table(s))",
-                    rawPage.pageNumber(),
-                    streamResults.size());
-            return streamResults;
-        }
-
-        // Step 3: Geometry-based line-alignment fallback.
-        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
-        if (!lineResults.isEmpty()) {
-            log.debug(
-                    "Page {}: using LineAlignment ({} table(s))",
-                    rawPage.pageNumber(),
-                    lineResults.size());
-            return lineResults;
-        }
-
-        return List.of();
-    }
-
-    private List<TableFragment> filterConfident(List<TableFragment> tables) {
-        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParser.java

@@ -1,528 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.TreeMap;
-import java.util.regex.Pattern;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Fallback {@link TableParser} for borderless financial tables using text geometry.
- *
- * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
- * positions, groups vertically proximate anchor lines into table candidates, then scores each group
- * on column consistency and anchor density (confidence ceiling 0.85).
- */
-@Service
-@Slf4j
-public class LineAlignmentTableParser implements TableParser {
-
-    /** Width in points of each column position bucket. */
-    static final float COLUMN_BUCKET_PT = 5f;
-
-    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
-    private static final int COLUMN_MATCH_BUCKETS = 2;
-
-    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
-    private static final float MAX_GAP_FACTOR = 2.5f;
-
-    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
-    static final int MIN_TABLE_ROWS = 3;
-
-    /** Minimum confirmed column positions to form a valid table. */
-    static final int MIN_COLUMNS = 2;
-
-    /**
-     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
-     * rows).
-     */
-    private static final double COLUMN_MIN_FREQUENCY = 0.40;
-
-    /**
-     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
-     * percent, nil dashes.
-     */
-    private static final Pattern NUMERIC =
-            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
-
-    /**
-     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
-     * column-gap logic).
-     */
-    static final float ROW_MERGE_TOLERANCE_PT = 2f;
-
-    // ── public API ───────────────────────────────────────────────────────────────────────────────
-
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        List<RawLine> lines = rawPage.lines();
-        if (lines.size() < MIN_TABLE_ROWS) return List.of();
-
-        float modalSpacing = computeModalSpacing(lines);
-        List<TokenizedLine> tokenized =
-                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
-
-        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
-
-        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
-
-        List<Float> columnGrid = buildColumnGrid(anchors);
-        if (columnGrid.size() < MIN_COLUMNS) {
-            log.debug(
-                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
-                    rawPage.pageNumber(),
-                    MIN_COLUMNS);
-            return List.of();
-        }
-
-        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
-
-        List<TableFragment> results = new ArrayList<>();
-        for (int i = 0; i < groups.size(); i++) {
-            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
-                    .ifPresent(results::add);
-        }
-
-        log.debug(
-                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
-                rawPage.pageNumber(),
-                results.size(),
-                anchors.size(),
-                columnGrid.size());
-        return results;
-    }
-
-    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
-
-    /**
-     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
-     * split by LineBuilder.
-     */
-    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
-        if (tokenized.size() < 2) return tokenized;
-
-        List<TokenizedLine> result = new ArrayList<>();
-        int i = 0;
-
-        while (i < tokenized.size()) {
-            float baseY = tokenized.get(i).line().bounds().y();
-            int j = i + 1;
-            while (j < tokenized.size()
-                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
-                            <= ROW_MERGE_TOLERANCE_PT) {
-                j++;
-            }
-
-            if (j == i + 1) {
-                result.add(tokenized.get(i));
-            } else {
-                result.add(mergeGroup(tokenized.subList(i, j)));
-            }
-            i = j;
-        }
-
-        return result;
-    }
-
-    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
-        List<TextFragment> mergedFragments =
-                group.stream()
-                        .flatMap(tl -> tl.line().fragments().stream())
-                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
-                        .toList();
-
-        Bounds mergedBounds =
-                group.stream()
-                        .map(tl -> tl.line().bounds())
-                        .reduce(Bounds::merge)
-                        .orElse(group.get(0).line().bounds());
-
-        RawLine mergedLine =
-                new RawLine(
-                        group.get(0).line().lineId(),
-                        mergedFragments,
-                        mergedBounds,
-                        group.get(0).line().pageNumber());
-
-        return tokenize(mergedLine);
-    }
-
-    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
-     * fragment.
-     */
-    TokenizedLine tokenize(RawLine line) {
-        List<LineToken> tokens = new ArrayList<>();
-        for (TextFragment frag : line.fragments()) {
-            tokens.addAll(tokensFromFragment(frag));
-        }
-        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
-        return new TokenizedLine(line, tokens, numeric);
-    }
-
-    private List<LineToken> tokensFromFragment(TextFragment frag) {
-        String raw = frag.text();
-        if (raw == null || raw.isBlank()) return List.of();
-
-        float fragX = frag.bounds().x();
-        float fragWidth = frag.bounds().width();
-        int rawLen = raw.length();
-
-        List<LineToken> result = new ArrayList<>();
-        int offset = 0;
-        for (String part : raw.split("\\s+")) {
-            if (part.isEmpty()) {
-                offset++;
-                continue;
-            }
-            int idx = raw.indexOf(part, offset);
-            if (idx < 0) idx = offset;
-
-            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
-            float tokenRight =
-                    rawLen > 0
-                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
-                            : fragX + fragWidth;
-
-            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
-            offset = idx + part.length();
-        }
-        return result;
-    }
-
-    // ── column grid ──────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
-     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
-     */
-    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
-        // bucket → set of line indices that contributed a numeric token to that bucket
-        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
-        for (int i = 0; i < anchors.size(); i++) {
-            for (LineToken t : anchors.get(i).numeric()) {
-                int bucket = bucket(t.right());
-                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
-            }
-        }
-
-        int minHits =
-                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
-
-        // Confirmed buckets → average right-edge for that bucket
-        TreeMap<Integer, Float> confirmed = new TreeMap<>();
-        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
-            // Count distinct lines
-            long distinctLines = entry.getValue().stream().distinct().count();
-            if (distinctLines >= minHits) {
-                double avg =
-                        entry.getValue().stream()
-                                .distinct() // weight each line equally regardless of token count
-                                .mapToDouble(
-                                        lineIdx ->
-                                                avgRightEdgeForBucket(
-                                                        anchors, lineIdx, entry.getKey()))
-                                .average()
-                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
-                confirmed.put(entry.getKey(), (float) avg);
-            }
-        }
-
-        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
-    }
-
-    /**
-     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
-     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
-     */
-    private double avgRightEdgeForBucket(
-            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
-        return anchors.get(lineIdx).numeric().stream()
-                .filter(t -> bucket(t.right()) == targetBucket)
-                .mapToDouble(LineToken::right)
-                .average()
-                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
-    }
-
-    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
-     * MAX_GAP_FACTOR × modal spacing splits groups.
-     */
-    private List<List<TokenizedLine>> groupRows(
-            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
-        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
-
-        List<List<TokenizedLine>> groups = new ArrayList<>();
-        List<TokenizedLine> current = new ArrayList<>();
-
-        for (int i = 0; i < all.size(); i++) {
-            TokenizedLine tl = all.get(i);
-            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
-
-            if (current.isEmpty()) {
-                if (fits) current.add(tl);
-                continue;
-            }
-
-            float gap =
-                    tl.line().bounds().y()
-                            - current.get(current.size() - 1).line().bounds().bottom();
-
-            if (gap > maxGap) {
-                groups.add(current);
-                current = new ArrayList<>();
-                if (fits) current.add(tl);
-                continue;
-            }
-
-            if (fits) {
-                current.add(tl);
-            } else if (!tl.line().text().isBlank()) {
-                // Include non-anchor lines (labels) only if they have text and are within
-                // proximity.
-                current.add(tl);
-            }
-        }
-
-        if (!current.isEmpty()) groups.add(current);
-
-        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
-    }
-
-    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
-        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
-                >= MIN_TABLE_ROWS;
-    }
-
-    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
-    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
-        if (tl.numeric().isEmpty()) return false;
-        long matches =
-                tl.numeric().stream()
-                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
-                        .count();
-        return (double) matches / tl.numeric().size() >= 0.60;
-    }
-
-    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
-        if (tl.numeric().isEmpty()) return false;
-        long hits =
-                tl.numeric().stream()
-                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
-                        .count();
-        return (double) hits / tl.numeric().size() < 0.60;
-    }
-
-    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
-
-    private Optional<TableFragment> buildFragment(
-            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
-
-        long anchorCount =
-                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
-        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
-
-        List<String> warnings = new ArrayList<>();
-        List<List<String>> rawRows = new ArrayList<>();
-        List<TableRow> rows = new ArrayList<>();
-
-        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
-            TokenizedLine tl = group.get(rowIdx);
-            List<String> rawRow = buildRawRow(tl, columnGrid);
-            rawRows.add(Collections.unmodifiableList(rawRow));
-            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
-        }
-
-        // Column count = 1 label column + confirmed numeric columns
-        int colCount = columnGrid.size() + 1;
-        Bounds bounds = computeGroupBounds(group);
-        float confidence = computeConfidence(group, columnGrid, warnings);
-
-        return Optional.of(
-                new TableFragment(
-                        "tbl-la-p" + pageNumber + "-" + tableIndex,
-                        pageNumber,
-                        bounds,
-                        List.of(),
-                        Collections.unmodifiableList(rows),
-                        Collections.unmodifiableList(rawRows),
-                        colCount,
-                        confidence,
-                        Collections.unmodifiableList(warnings),
-                        null));
-    }
-
-    /**
-     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
-     */
-    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
-        String[] cells = new String[columnGrid.size() + 1];
-        Arrays.fill(cells, "");
-
-        // Separate label tokens (those not landing in any confirmed column) from column tokens.
-        List<String> labelParts = new ArrayList<>();
-        for (LineToken token : tl.all()) {
-            int col = nearestColumnIndex(token.right(), columnGrid);
-            if (col >= 0 && token.numeric()) {
-                int cellIdx = col + 1;
-                cells[cellIdx] =
-                        cells[cellIdx].isEmpty()
-                                ? token.text()
-                                : cells[cellIdx] + " " + token.text();
-            } else {
-                labelParts.add(token.text());
-            }
-        }
-        cells[0] = String.join(" ", labelParts).trim();
-        return Arrays.asList(cells);
-    }
-
-    private TableRow buildTableRow(
-            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
-        List<TableCell> cells = new ArrayList<>(rawRow.size());
-
-        // Label cell: use the line's full bounds as an approximation.
-        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
-
-        for (int col = 0; col < columnGrid.size(); col++) {
-            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
-            float right = columnGrid.get(col);
-            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
-            Bounds cellBounds =
-                    new Bounds(
-                            left,
-                            tl.line().bounds().y(),
-                            right - left,
-                            tl.line().bounds().height());
-            cells.add(TableCell.of(col + 1, text, cellBounds));
-        }
-        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
-    }
-
-    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
-
-    /**
-     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
-     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
-     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
-     */
-    private float computeConfidence(
-            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
-        float score = 0.70f;
-
-        long anchorCount =
-                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
-        long totalRows = group.size();
-
-        // More columns
-        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
-        score += extraCols * 0.05f;
-
-        // More anchor rows
-        if (anchorCount >= 5) score += 0.05f;
-        if (anchorCount >= 8) score += 0.05f;
-
-        // Inconsistent column matching
-        long inconsistent =
-                group.stream()
-                        .filter(TokenizedLine::isAnchor)
-                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
-                        .count();
-        if (inconsistent > anchorCount * 0.30) {
-            score -= 0.15f;
-            warnings.add(
-                    "Column match inconsistent on "
-                            + inconsistent
-                            + "/"
-                            + anchorCount
-                            + " anchor rows");
-        }
-
-        // Label-heavy
-        long nonAnchor = totalRows - anchorCount;
-        if (nonAnchor > anchorCount) {
-            score -= 0.10f;
-            warnings.add(
-                    "Non-anchor rows ("
-                            + nonAnchor
-                            + ") outnumber anchor rows ("
-                            + anchorCount
-                            + ")");
-        }
-
-        return Math.max(0f, Math.min(0.85f, score));
-    }
-
-    // ── utility ──────────────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
-     * #COLUMN_MATCH_BUCKETS} buckets.
-     */
-    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
-        int nearest = -1;
-        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
-        for (int i = 0; i < grid.size(); i++) {
-            float dist = Math.abs(rightEdge - grid.get(i));
-            if (dist < minDist) {
-                minDist = dist;
-                nearest = i;
-            }
-        }
-        return nearest;
-    }
-
-    private Bounds computeGroupBounds(List<TokenizedLine> group) {
-        return group.stream()
-                .map(tl -> tl.line().bounds())
-                .reduce(Bounds::merge)
-                .orElse(new Bounds(0, 0, 0, 0));
-    }
-
-    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
-    private float computeModalSpacing(List<RawLine> lines) {
-        if (lines.size() < 2) return 0f;
-        Map<Float, Long> freq = new HashMap<>();
-        for (int i = 1; i < lines.size(); i++) {
-            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
-            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
-        }
-        return freq.entrySet().stream()
-                .max(Map.Entry.comparingByValue())
-                .map(Map.Entry::getKey)
-                .orElse(0f);
-    }
-
-    private static int bucket(float x) {
-        return Math.round(x / COLUMN_BUCKET_PT);
-    }
-
-    // ── private data types ───────────────────────────────────────────────────────────────────────
-
-    /** A word-level token with an approximate right-edge x-position. */
-    record LineToken(String text, float x, float right, boolean numeric) {}
-
-    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
-    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
-        boolean isAnchor() {
-            return numeric.size() >= 2;
-        }
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineBuilder.java

@@ -1,139 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.List;
-
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
- *
- * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
- * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
- * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
- */
-@Service
-@Slf4j
-public class LineBuilder {
-
-    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
-    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
-
-    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
-    private static final float MIN_BASELINE_TOLERANCE = 2f;
-
-    /**
-     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
-     * two-column gutters.
-     */
-    static final float COLUMN_GAP_RATIO = 0.10f;
-
-    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
-    static final float COLUMN_GAP_MIN_PT = 40f;
-
-    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
-        if (fragments.isEmpty()) return List.of();
-
-        float effectiveWidth = inferEffectiveWidth(fragments);
-        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
-        log.debug(
-                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
-                pageNumber,
-                effectiveWidth,
-                columnGapThreshold);
-
-        // Sort top-to-bottom first, then left-to-right within the same baseline band.
-        List<TextFragment> sorted =
-                fragments.stream()
-                        .sorted(
-                                Comparator.comparingDouble(TextFragment::baseline)
-                                        .thenComparingDouble(f -> f.bounds().x()))
-                        .toList();
-
-        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
-
-        List<RawLine> lines = new ArrayList<>(groups.size());
-        for (int i = 0; i < groups.size(); i++) {
-            List<TextFragment> group =
-                    groups.get(i).stream()
-                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
-                            .toList();
-
-            Bounds lineBounds =
-                    group.stream()
-                            .map(TextFragment::bounds)
-                            .reduce(Bounds::merge)
-                            .orElse(new Bounds(0, 0, 0, 0));
-
-            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
-        }
-        return lines;
-    }
-
-    private List<List<TextFragment>> groupByBaseline(
-            List<TextFragment> sorted, float columnGapThreshold) {
-        List<List<TextFragment>> groups = new ArrayList<>();
-        List<TextFragment> current = new ArrayList<>();
-        float currentBaseline = Float.NaN;
-
-        for (TextFragment fragment : sorted) {
-            if (current.isEmpty()) {
-                current.add(fragment);
-                currentBaseline = fragment.baseline();
-                continue;
-            }
-
-            float maxFontSize =
-                    Math.max(
-                            fragment.fontSize(),
-                            (float)
-                                    current.stream()
-                                            .mapToDouble(TextFragment::fontSize)
-                                            .max()
-                                            .orElse(0));
-            float tolerance =
-                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
-
-            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
-            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
-
-            if (sameBaseline && !columnGap) {
-                current.add(fragment);
-                // Anchor to the weighted mean baseline so long lines stay stable.
-                currentBaseline =
-                        (currentBaseline * (current.size() - 1) + fragment.baseline())
-                                / current.size();
-            } else {
-                groups.add(current);
-                current = new ArrayList<>();
-                current.add(fragment);
-                currentBaseline = fragment.baseline();
-            }
-        }
-
-        if (!current.isEmpty()) groups.add(current);
-        return groups;
-    }
-
-    /**
-     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
-     * threshold}.
-     */
-    private static boolean hasColumnGap(
-            TextFragment next, List<TextFragment> group, float threshold) {
-        float lastRight = group.get(group.size() - 1).bounds().right();
-        return next.bounds().x() - lastRight > threshold;
-    }
-
-    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
-    private static float inferEffectiveWidth(List<TextFragment> fragments) {
-        double maxRight =
-                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
-        return (float) maxRight * 1.10f;
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PdfIngester.java

@@ -1,79 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
- * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
- * {@link PDDocument} lifecycle.
- */
-@Service
-@RequiredArgsConstructor
-@Slf4j
-public class PdfIngester {
-
-    private final LineBuilder lineBuilder;
-    private final TableParser tableParser;
-
-    public List<ParsedPage> parse(PDDocument document) throws IOException {
-        return parse(document, document.getNumberOfPages());
-    }
-
-    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
-        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
-        List<ParsedPage> pages = new ArrayList<>(pageCount);
-        long fragmentsMs = 0;
-        long tablesMs = 0;
-        long t0 = System.currentTimeMillis();
-
-        for (int p = 1; p <= pageCount; p++) {
-            long ft = System.currentTimeMillis();
-            List<TextFragment> fragments = extractFragments(document, p);
-            fragmentsMs += System.currentTimeMillis() - ft;
-
-            PDPage page = document.getPage(p - 1);
-            PDRectangle mediaBox = page.getMediaBox();
-            List<RawLine> lines = lineBuilder.build(fragments, p);
-            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
-
-            long tt = System.currentTimeMillis();
-            List<TableFragment> tables = tableParser.parse(document, rawPage);
-            tablesMs += System.currentTimeMillis() - tt;
-
-            log.debug(
-                    "Page {}: {} fragments → {} lines, {} table(s)",
-                    p,
-                    fragments.size(),
-                    lines.size(),
-                    tables.size());
-            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
-        }
-
-        log.info(
-                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
-                pageCount,
-                System.currentTimeMillis() - t0,
-                fragmentsMs,
-                tablesMs);
-        return pages;
-    }
-
-    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
-            throws IOException {
-        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
-        stripper.getText(document);
-        return stripper.getFragments();
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PdfModels.java

@@ -1,148 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.io.IOException;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-
-/**
- * All PDF parser model types and the table-parser contract in one place.
- *
- * <p>Import as {@code import static stirling.software.SPDF.pdf.parser.PdfModels.*;} to use all
- * nested types without qualification.
- */
-public final class PdfModels {
-
-    private PdfModels() {}
-
-    // ── Geometry ──────────────────────────────────────────────────────────────
-
-    public record Bounds(float x, float y, float width, float height) {
-
-        public float right() {
-            return x + width;
-        }
-
-        public float bottom() {
-            return y + height;
-        }
-
-        public static Bounds merge(Bounds a, Bounds b) {
-            float x = Math.min(a.x, b.x);
-            float y = Math.min(a.y, b.y);
-            return new Bounds(
-                    x, y, Math.max(a.right(), b.right()) - x, Math.max(a.bottom(), b.bottom()) - y);
-        }
-    }
-
-    // ── Text fragments and lines ──────────────────────────────────────────────
-
-    /**
-     * A contiguous run of text from a single PDF content-stream string operation. {@code baseline}
-     * is preserved separately from bounds for line-grouping — characters of different sizes on the
-     * same visual line share a baseline but differ in top Y.
-     */
-    public record TextFragment(
-            String fragmentId,
-            String text,
-            Bounds bounds,
-            float baseline,
-            float fontSize,
-            String fontName,
-            boolean bold) {}
-
-    public record RawLine(
-            String lineId, List<TextFragment> fragments, Bounds bounds, int pageNumber) {
-
-        public String text() {
-            if (fragments.isEmpty()) return "";
-            StringBuilder sb = new StringBuilder();
-            TextFragment prev = null;
-            for (TextFragment f : fragments) {
-                if (prev != null) {
-                    float gap = f.bounds().x() - prev.bounds().right();
-                    float avgCharWidth = prev.bounds().width() / Math.max(prev.text().length(), 1);
-                    if (gap > avgCharWidth * 0.5f) sb.append(' ');
-                }
-                sb.append(f.text());
-                prev = f;
-            }
-            return sb.toString();
-        }
-
-        public float dominantFontSize() {
-            return fragments.stream()
-                    .collect(Collectors.groupingBy(TextFragment::fontSize, Collectors.counting()))
-                    .entrySet()
-                    .stream()
-                    .max(Map.Entry.comparingByValue())
-                    .map(Map.Entry::getKey)
-                    .orElse(0f);
-        }
-
-        public boolean hasBold() {
-            return fragments.stream().anyMatch(TextFragment::bold);
-        }
-    }
-
-    public record RawPage(int pageNumber, float widthPt, float heightPt, List<RawLine> lines) {}
-
-    // ── Table model ───────────────────────────────────────────────────────────
-
-    /**
-     * A single cell within a {@link TableRow}. {@code colSpan} and {@code rowSpan} are always 1 in
-     * v1 — span detection is deferred but the fields keep the schema stable.
-     */
-    public record TableCell(int colIndex, String text, Bounds bounds, int colSpan, int rowSpan) {
-
-        public static TableCell of(int colIndex, String text, Bounds bounds) {
-            return new TableCell(colIndex, text, bounds, 1, 1);
-        }
-    }
-
-    public record TableRow(int rowIndex, List<TableCell> cells) {}
-
-    /**
-     * A table as it appears on a single page. {@code headers} is empty in v1 — all rows are in
-     * {@code rows}. {@code rawRows} preserves exact Tabula text output for diagnostics. {@code
-     * confidence} is a heuristic score in [0.0, 1.0]. {@code continuedFromPage} is null in v1.
-     */
-    public record TableFragment(
-            String tableId,
-            int pageNumber,
-            Bounds bounds,
-            List<TableRow> headers,
-            List<TableRow> rows,
-            List<List<String>> rawRows,
-            int columnCount,
-            float confidence,
-            List<String> warnings,
-            Integer continuedFromPage) {}
-
-    // ── Page output ───────────────────────────────────────────────────────────
-
-    public record ParsedPage(
-            int pageNumber,
-            float widthPt,
-            float heightPt,
-            List<TableFragment> tables,
-            List<RawLine> layoutLines) {}
-
-    // ── Parser contract ───────────────────────────────────────────────────────
-
-    /**
-     * Extracts tables from a single page of a PDF. The caller owns the document lifecycle;
-     * implementations must not close it.
-     */
-    public interface TableParser {
-
-        /**
-         * @param document open PDF; must not be closed by the implementation
-         * @param rawPage page metadata and lines for the page to process
-         * @return zero or more table fragments found on the page, never null
-         */
-        List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException;
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/TabulaTableParser.java

@@ -1,256 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-import technology.tabula.ObjectExtractor;
-import technology.tabula.Page;
-import technology.tabula.RectangularTextContainer;
-import technology.tabula.Table;
-import technology.tabula.extractors.BasicExtractionAlgorithm;
-import technology.tabula.extractors.ExtractionAlgorithm;
-import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
-
-/**
- * Primary {@link TableParser} implementation using Tabula's lattice-mode extraction.
- *
- * <h3>Algorithm</h3>
- *
- * Uses {@link SpreadsheetExtractionAlgorithm} (lattice mode), which detects tables from ruled lines
- * (horizontal and vertical PDF path operators). This is reliable for tables with visible borders.
- * Borderless or whitespace-delimited tables will not be detected — that requires stream mode, which
- * is deferred to a later iteration.
- *
- * <h3>Coordinate system</h3>
- *
- * Tabula normalises page coordinates so that (0,0) is the top-left corner and Y increases downward,
- * matching the {@link Bounds} convention used throughout this parser. No coordinate transformation
- * is needed when mapping Tabula cell bounds to {@link Bounds}.
- *
- * <h3>Known limitations</h3>
- *
- * <ul>
- *   <li>Borderless tables are not detected (use stream mode, deferred).
- *   <li>Colspan and rowspan are not detected; all cells report colSpan=1, rowSpan=1.
- *   <li>Header rows are not identified; all rows appear in {@code rows}, headers is empty.
- *   <li>Cross-page table linking is not performed; each page is independent.
- *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
- * </ul>
- */
-@Service
-@Slf4j
-public class TabulaTableParser implements TableParser {
-
-    /** Lattice mode — reliable for tables with visible ruled borders. */
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        return parseWithAlgorithm(
-                document, rawPage, new SpreadsheetExtractionAlgorithm(), "lattice");
-    }
-
-    /**
-     * Convenience overload for callers that only have a page number, not a full {@link RawPage}.
-     */
-    public List<TableFragment> parse(PDDocument document, int pageNumber) throws IOException {
-        return parse(document, new RawPage(pageNumber, 0f, 0f, List.of()));
-    }
-
-    /** Stream mode — whitespace-based column detection for borderless tables. */
-    public List<TableFragment> parseStream(PDDocument document, RawPage rawPage)
-            throws IOException {
-        return parseWithAlgorithm(document, rawPage, new BasicExtractionAlgorithm(), "stream");
-    }
-
-    private List<TableFragment> parseWithAlgorithm(
-            PDDocument document, RawPage rawPage, ExtractionAlgorithm algorithm, String modeName)
-            throws IOException {
-        int pageNumber = rawPage.pageNumber();
-
-        List<Table> tabulaTables;
-        try {
-            // Do NOT use try-with-resources: ObjectExtractor.close() closes the underlying
-            // PDDocument, which we don't own. The extractor holds no resources of its own.
-            ObjectExtractor extractor = new ObjectExtractor(document);
-            Page page = extractor.extract(pageNumber);
-            tabulaTables = new ArrayList<>(algorithm.extract(page));
-        } catch (Exception e) {
-            log.warn(
-                    "Tabula {} extraction failed on page {}: {}",
-                    modeName,
-                    pageNumber,
-                    e.getMessage());
-            return List.of();
-        }
-
-        if (tabulaTables.isEmpty()) {
-            log.debug("Page {}: no tables detected by Tabula ({})", pageNumber, modeName);
-            return List.of();
-        }
-
-        log.debug(
-                "Page {}: Tabula ({}) detected {} table(s)",
-                pageNumber,
-                modeName,
-                tabulaTables.size());
-
-        List<TableFragment> fragments = new ArrayList<>(tabulaTables.size());
-        for (int i = 0; i < tabulaTables.size(); i++) {
-            fragments.add(toFragment(tabulaTables.get(i), pageNumber, i));
-        }
-        return fragments;
-    }
-
-    // ── private helpers ──────────────────────────────────────────────────────────────────────────
-
-    private TableFragment toFragment(Table table, int pageNumber, int tableIndex) {
-        List<List<RectangularTextContainer>> tabulaRows = table.getRows();
-        List<String> warnings = new ArrayList<>();
-
-        List<List<String>> rawRows = buildRawRows(tabulaRows);
-        int colCount = inferColumnCount(rawRows, warnings);
-        List<TableRow> rows = buildRows(tabulaRows, colCount, warnings);
-        float confidence = computeConfidence(rawRows, colCount, warnings);
-        Bounds bounds = tableBounds(table);
-
-        String tableId = "tbl-p" + pageNumber + "-" + tableIndex;
-
-        if (!warnings.isEmpty()) {
-            log.warn("Page {}, table {}: {}", pageNumber, tableIndex, warnings);
-        }
-
-        return new TableFragment(
-                tableId,
-                pageNumber,
-                bounds,
-                List.of(), // headers: deferred to v2
-                rows,
-                rawRows,
-                colCount,
-                confidence,
-                Collections.unmodifiableList(warnings),
-                null); // continuedFromPage: deferred to v2
-    }
-
-    private List<List<String>> buildRawRows(List<List<RectangularTextContainer>> tabulaRows) {
-        List<List<String>> rawRows = new ArrayList<>(tabulaRows.size());
-        for (List<RectangularTextContainer> tabulaRow : tabulaRows) {
-            List<String> cells = new ArrayList<>(tabulaRow.size());
-            for (RectangularTextContainer cell : tabulaRow) {
-                cells.add(normaliseText(cell.getText()));
-            }
-            rawRows.add(Collections.unmodifiableList(cells));
-        }
-        return rawRows;
-    }
-
-    private List<TableRow> buildRows(
-            List<List<RectangularTextContainer>> tabulaRows, int colCount, List<String> warnings) {
-        List<TableRow> rows = new ArrayList<>(tabulaRows.size());
-        for (int rowIdx = 0; rowIdx < tabulaRows.size(); rowIdx++) {
-            List<RectangularTextContainer> tabulaRow = tabulaRows.get(rowIdx);
-            List<TableCell> cells = new ArrayList<>(tabulaRow.size());
-
-            for (int colIdx = 0; colIdx < tabulaRow.size(); colIdx++) {
-                RectangularTextContainer c = tabulaRow.get(colIdx);
-                Bounds cellBounds =
-                        new Bounds(
-                                (float) c.getX(),
-                                (float) c.getY(),
-                                (float) c.getWidth(),
-                                (float) c.getHeight());
-                cells.add(TableCell.of(colIdx, normaliseText(c.getText()), cellBounds));
-            }
-
-            if (tabulaRow.size() != colCount) {
-                warnings.add(
-                        "Row "
-                                + rowIdx
-                                + " has "
-                                + tabulaRow.size()
-                                + " cells; expected "
-                                + colCount);
-            }
-
-            rows.add(new TableRow(rowIdx, Collections.unmodifiableList(cells)));
-        }
-        return rows;
-    }
-
-    /**
-     * The canonical column count for a table is the size of the widest row. Tabula can produce
-     * uneven rows when a cell's ruling lines are partially missing.
-     */
-    private int inferColumnCount(List<List<String>> rawRows, List<String> warnings) {
-        if (rawRows.isEmpty()) return 0;
-        int max = rawRows.stream().mapToInt(List::size).max().orElse(0);
-        int mode =
-                rawRows.stream()
-                        .collect(
-                                java.util.stream.Collectors.groupingBy(
-                                        List::size, java.util.stream.Collectors.counting()))
-                        .entrySet()
-                        .stream()
-                        .max(java.util.Map.Entry.comparingByValue())
-                        .map(java.util.Map.Entry::getKey)
-                        .orElse(0);
-        if (max != mode) {
-            warnings.add("Inconsistent column count: modal=" + mode + " max=" + max);
-        }
-        return mode > 0 ? mode : max;
-    }
-
-    /**
-     * Heuristic confidence score in [0.0, 1.0].
-     *
-     * <ul>
-     *   <li>Starts at 1.0.
-     *   <li>-0.3 if only one column (single-column tables are usually not real tables).
-     *   <li>-0.1 per row with an inconsistent column count, capped at -0.4.
-     *   <li>-0.3 if the empty-cell ratio across all cells exceeds 80%.
-     * </ul>
-     */
-    private float computeConfidence(
-            List<List<String>> rawRows, int colCount, List<String> warnings) {
-        if (rawRows.isEmpty() || colCount == 0) return 0f;
-
-        float score = 1.0f;
-
-        if (colCount == 1) score -= 0.3f;
-
-        long inconsistentRows = rawRows.stream().filter(r -> r.size() != colCount).count();
-        score -= Math.min(inconsistentRows * 0.1f, 0.4f);
-
-        long totalCells = rawRows.stream().mapToLong(List::size).sum();
-        long emptyCells =
-                rawRows.stream().flatMap(Collection::stream).filter(String::isBlank).count();
-        if (totalCells > 0 && (float) emptyCells / totalCells > 0.8f) {
-            score -= 0.3f;
-        }
-
-        return Math.max(0f, Math.min(1f, score));
-    }
-
-    private Bounds tableBounds(Table table) {
-        return new Bounds(
-                (float) table.getX(),
-                (float) table.getY(),
-                (float) table.getWidth(),
-                (float) table.getHeight());
-    }
-
-    private String normaliseText(String raw) {
-        if (raw == null) return "";
-        // Tabula wraps multi-line cell content with \r\n — collapse to a single space.
-        return raw.replace("\r\n", " ").replace("\n", " ").replace("\r", " ").trim();
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/WordExtractingStripper.java

@@ -1,113 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.font.PDFont;
-import org.apache.pdfbox.text.PDFTextStripper;
-import org.apache.pdfbox.text.TextPosition;
-
-/**
- * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
- *
- * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
- * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
- * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
- */
-class WordExtractingStripper extends PDFTextStripper {
-
-    private final int targetPage;
-    private final List<TextFragment> fragments = new ArrayList<>();
-    private int fragmentIndex = 0;
-
-    WordExtractingStripper(int pageNumber) throws IOException {
-        this.targetPage = pageNumber;
-        setStartPage(pageNumber);
-        setEndPage(pageNumber);
-        setSortByPosition(true);
-    }
-
-    @Override
-    protected void startPage(PDPage page) throws IOException {
-        super.startPage(page);
-        fragments.clear();
-        fragmentIndex = 0;
-    }
-
-    @Override
-    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
-        if (text == null || text.isBlank()) return;
-
-        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
-        // number as its own string operation, so this is the common case).
-        if (text.indexOf(' ') < 0) {
-            emitFragment(text, textPositions);
-            return;
-        }
-
-        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
-        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
-        if (textPositions.size() != text.length()) {
-            emitFragment(text, textPositions);
-            return;
-        }
-
-        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
-        int start = 0;
-        for (int i = 0; i <= text.length(); i++) {
-            if (i == text.length() || text.charAt(i) == ' ') {
-                if (start < i) {
-                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
-                }
-                start = i + 1;
-            }
-        }
-    }
-
-    private void emitFragment(String text, List<TextPosition> positions) {
-        if (positions.isEmpty()) return;
-
-        float minX = Float.MAX_VALUE;
-        float minY = Float.MAX_VALUE;
-        float maxRight = -Float.MAX_VALUE;
-        float maxBaseline = -Float.MAX_VALUE;
-        TextPosition first = null;
-
-        for (TextPosition tp : positions) {
-            if (tp == null) continue;
-            if (first == null) first = tp;
-
-            float x = tp.getX();
-            // getY() is the baseline; top of character = getY() - getHeight().
-            float top = tp.getY() - tp.getHeight();
-            float right = x + tp.getWidth();
-            float baseline = tp.getY();
-
-            minX = Math.min(minX, x);
-            minY = Math.min(minY, top);
-            maxRight = Math.max(maxRight, right);
-            maxBaseline = Math.max(maxBaseline, baseline);
-        }
-
-        if (first == null) return;
-
-        PDFont font = first.getFont();
-        String fontName = font != null ? font.getName() : "";
-        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
-        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
-        float fontSize = first.getHeight();
-
-        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
-        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
-        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
-    }
-
-    List<TextFragment> getFragments() {
-        return Collections.unmodifiableList(fragments);
-    }
-}

app/common/src/main/java/stirling/software/common/annotations/AutoJobPostMapping.java

@@ -75,8 +75,8 @@ public @interface AutoJobPostMapping {
     boolean queueable() default false;
 
     /**
-     * Relative resource weight (1-100). See {@link
-     * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
+     * Relative resource weight (1–100) used by the scheduler to prioritise / throttle jobs. Values
+     * below 1 are clamped to 1, values above 100 to 100.
      */
-    int resourceWeight() default 1;
+    int resourceWeight() default 50;
 }

app/common/src/main/java/stirling/software/common/configuration/InstallationPathConfig.java

@@ -59,18 +59,6 @@ public class InstallationPathConfig {
     }
 
     private static String initializeBasePath() {
-        // Allow tests / harnesses to redirect the entire state tree (configs,
-        // backups, customFiles, pipeline, logs) to an isolated location via
-        // -Dstirling.base-path=... or STIRLING_BASE_PATH=... so a Playwright
-        // run never touches a developer's working state.
-        String override = System.getProperty("stirling.base-path");
-        if (override == null || override.isBlank()) {
-            override = System.getenv("STIRLING_BASE_PATH");
-        }
-        if (override != null && !override.isBlank()) {
-            boolean hasTrailingSeparator = override.endsWith("/") || override.endsWith("\\");
-            return hasTrailingSeparator ? override : override + File.separator;
-        }
         return "." + File.separator;
     }
 

app/common/src/main/java/stirling/software/common/enumeration/ResourceWeight.java

@@ -1,22 +0,0 @@
-package stirling.software.common.enumeration;
-
-/**
- * Standard resource-weight tiers for {@link
- * stirling.software.common.annotations.AutoJobPostMapping#resourceWeight()}.
- */
-public final class ResourceWeight {
-
-    /** Lightweight: rotate, page numbers, extract pages, permissions, etc. */
-    public static final int SMALL_WEIGHT = 1;
-
-    /** Medium: merge, split, multi-tool batch. */
-    public static final int MEDIUM_WEIGHT = 3;
-
-    /** Heavy: compress, OCR (small), conversions, raster. */
-    public static final int LARGE_WEIGHT = 5;
-
-    /** Extra heavy: OCR on large files, full-document re-render, AI-assisted edits. */
-    public static final int XLARGE_WEIGHT = 10;
-
-    private ResourceWeight() {}
-}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -76,7 +76,6 @@ public class ApplicationProperties {
     private ProcessExecutor processExecutor = new ProcessExecutor();
     private PdfEditor pdfEditor = new PdfEditor();
     private AiEngine aiEngine = new AiEngine();
-    private InternalApi internalApi = new InternalApi();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -97,14 +96,7 @@ public class ApplicationProperties {
         EncodedResource encodedResource = new EncodedResource(resource);
         PropertySource<?> propertySource =
                 new YamlPropertySourceFactory().createPropertySource(null, encodedResource);
-
-        boolean saasActive = Arrays.asList(environment.getActiveProfiles()).contains("saas");
-        if (saasActive) {
-            // Saas-pinned values in application-saas.properties must beat settings.yml.
-            environment.getPropertySources().addLast(propertySource);
-        } else {
-            environment.getPropertySources().addFirst(propertySource);
-        }
+        environment.getPropertySources().addFirst(propertySource);
 
         log.debug("Loaded properties: {}", propertySource.getSource());
 
@@ -245,26 +237,6 @@ public class ApplicationProperties {
         private boolean enabled = false;
         private String url = "http://localhost:5001";
         private int timeoutSeconds = 120;
-
-        /**
-         * Longer timeout for heavy operations like RAG ingestion, which embeds the whole document
-         * and can take multiple minutes for large books. Applied per-call when the caller
-         * explicitly requests it via {@code AiEngineClient.postWithTimeout}.
-         */
-        private int longRunningTimeoutSeconds = 600;
-    }
-
-    /**
-     * HTTP timeouts for loopback calls to internal Stirling API endpoints, used by the AI workflow
-     * executor and the pipeline processor. A bounded read timeout prevents a hung tool (e.g. an
-     * infinite loop in a PDF processing service) from stalling the entire chat workflow forever.
-     * Tools that legitimately need longer than the read timeout should be invoked through the async
-     * job executor instead of synchronously.
-     */
-    @Data
-    public static class InternalApi {
-        private int connectTimeoutSeconds = 10;
-        private int readTimeoutSeconds = 300;
     }
 
     @Data

app/common/src/main/java/stirling/software/common/model/api/PDFFile.java

@@ -14,6 +14,7 @@ import lombok.NoArgsConstructor;
 @Data
 @NoArgsConstructor
 @EqualsAndHashCode
+@Schema(description = "PDF file input - either upload a file or provide a server-side file ID")
 public class PDFFile {
 
     @Schema(

app/common/src/main/java/stirling/software/common/model/api/comments/AnnotationLocation.java

@@ -1,15 +0,0 @@
-package stirling.software.common.model.api.comments;
-
-/**
- * Absolute position of a PDF annotation in the document.
- *
- * <p>Coordinates are in PDF user-space with the origin at the page's bottom-left, consistent with
- * PDFBox's {@code PDRectangle} convention.
- *
- * @param pageIndex 0-indexed page number the annotation lives on.
- * @param x bottom-left x coordinate of the annotation rectangle.
- * @param y bottom-left y coordinate of the annotation rectangle.
- * @param width width of the annotation rectangle, in user-space units.
- * @param height height of the annotation rectangle, in user-space units.
- */
-public record AnnotationLocation(int pageIndex, float x, float y, float width, float height) {}

app/common/src/main/java/stirling/software/common/model/api/comments/StickyNoteSpec.java

@@ -1,15 +0,0 @@
-package stirling.software.common.model.api.comments;
-
-/**
- * Description of a single sticky-note (PDF Text) annotation to place on a document.
- *
- * <p>{@code author} and {@code subject} are optional — callers that pass {@code null} get a default
- * author/subject from {@code PdfAnnotationService}.
- *
- * @param location where to anchor the annotation icon, in PDF user-space.
- * @param text the comment body shown in the popup (required, non-blank).
- * @param author optional author label shown in the popup; {@code null} → service default.
- * @param subject optional subject line shown in the popup; {@code null} → service default.
- */
-public record StickyNoteSpec(
-        AnnotationLocation location, String text, String author, String subject) {}

app/common/src/main/java/stirling/software/common/model/api/general/EditTextOperation.java

@@ -1,19 +0,0 @@
-package stirling.software.common.model.api.general;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import lombok.Data;
-import lombok.EqualsAndHashCode;
-
-@Data
-@EqualsAndHashCode
-public class EditTextOperation {
-
-    @Schema(description = "The literal text to find.", requiredMode = Schema.RequiredMode.REQUIRED)
-    private String find;
-
-    @Schema(
-            description = "The replacement text. May be empty to delete the matched text.",
-            requiredMode = Schema.RequiredMode.REQUIRED)
-    private String replace;
-}

app/common/src/main/java/stirling/software/common/model/enumeration/InvitationStatus.java

@@ -1,26 +0,0 @@
-package stirling.software.common.model.enumeration;
-
-import lombok.Getter;
-import lombok.RequiredArgsConstructor;
-
-/** Team invitation status */
-@Getter
-@RequiredArgsConstructor
-public enum InvitationStatus {
-    PENDING("PENDING"),
-    ACCEPTED("ACCEPTED"),
-    REJECTED("REJECTED"),
-    CANCELLED("CANCELLED"),
-    EXPIRED("EXPIRED");
-
-    private final String statusName;
-
-    public static InvitationStatus fromString(String statusName) {
-        for (InvitationStatus status : InvitationStatus.values()) {
-            if (status.getStatusName().equalsIgnoreCase(statusName)) {
-                return status;
-            }
-        }
-        throw new IllegalArgumentException("No InvitationStatus defined for name: " + statusName);
-    }
-}

app/common/src/main/java/stirling/software/common/model/enumeration/Role.java

@@ -16,9 +16,6 @@ public enum Role {
     // Unlimited access
     USER("ROLE_USER", Integer.MAX_VALUE, Integer.MAX_VALUE, "adminUserSettings.user"),
 
-    // Paid tier; set by Stripe webhooks under saas mode.
-    PRO_USER("ROLE_PRO_USER", Integer.MAX_VALUE, Integer.MAX_VALUE, "adminUserSettings.proUser"),
-
     // 40 API calls Per Day, 40 web calls
     LIMITED_API_USER("ROLE_LIMITED_API_USER", 40, 40, "adminUserSettings.apiUser"),
 

app/common/src/main/java/stirling/software/common/model/enumeration/TeamRole.java

@@ -1,26 +0,0 @@
-package stirling.software.common.model.enumeration;
-
-import lombok.Getter;
-import lombok.RequiredArgsConstructor;
-
-/**
- * Team membership roles LEADER: Can invite/remove members, manage settings, view usage, manage
- * billing MEMBER: Regular team member with standard access
- */
-@Getter
-@RequiredArgsConstructor
-public enum TeamRole {
-    LEADER("LEADER"),
-    MEMBER("MEMBER");
-
-    private final String roleName;
-
-    public static TeamRole fromString(String roleName) {
-        for (TeamRole role : TeamRole.values()) {
-            if (role.getRoleName().equalsIgnoreCase(roleName)) {
-                return role;
-            }
-        }
-        throw new IllegalArgumentException("No TeamRole defined for name: " + roleName);
-    }
-}

app/common/src/main/java/stirling/software/common/service/FileStorage.java

@@ -10,7 +10,6 @@ import java.nio.file.Path;
 import java.util.UUID;
 
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
@@ -158,48 +157,13 @@ public class FileStorage {
             success = true;
         } finally {
             if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
+                Files.deleteIfExists(filePath);
             }
         }
         log.debug("Stored StreamingResponseBody with ID: {}", fileId);
         return fileId;
     }
 
-    /**
-     * Persist a {@link Resource} body to disk, returning the generated file ID. Used by the async
-     * job pipeline to capture {@code ResponseEntity<Resource>} results produced by controllers.
-     */
-    public String storeFromResource(Resource resource, String originalName) throws IOException {
-        String fileId = generateFileId();
-        Path filePath = getFilePath(fileId);
-        Files.createDirectories(filePath.getParent());
-        boolean success = false;
-        try (InputStream in = resource.getInputStream()) {
-            Files.copy(in, filePath);
-            success = true;
-        } finally {
-            if (!success) {
-                try {
-                    Files.deleteIfExists(filePath);
-                } catch (IOException cleanupEx) {
-                    log.warn(
-                            "Failed to clean up partial file {} after store failure",
-                            filePath,
-                            cleanupEx);
-                }
-            }
-        }
-        log.debug("Stored Resource with ID: {}", fileId);
-        return fileId;
-    }
-
     /**
      * Delete a file by its ID
      *

app/common/src/main/java/stirling/software/common/service/InternalApiClient.java

@@ -5,7 +5,6 @@ import java.io.UncheckedIOException;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
-import java.time.Duration;
 import java.util.regex.Pattern;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -13,18 +12,15 @@ import org.springframework.core.env.Environment;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
 import org.springframework.http.*;
-import org.springframework.http.client.SimpleClientHttpRequestFactory;
 import org.springframework.stereotype.Service;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.RestTemplate;
 
 import jakarta.servlet.ServletContext;
 
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
@@ -38,45 +34,26 @@ import stirling.software.common.util.TempFileManager;
 @Slf4j
 public class InternalApiClient {
 
-    // Allowlist for internal dispatch. Matches fixed namespace prefixes,
+    // Allowlist for internal dispatch. Matches a fixed namespace prefix,
     // but rejects traversal (..), URL-encoding (%), query/fragment, backslashes, and any other
     // character that could alter the resolved endpoint on the local Spring server.
-    //
-    // The second alternation carves out `/api/v1/ai/tools/*` specifically — AI tools are
-    // dispatchable, but the broader `/api/v1/ai/` surface (orchestrate, health, etc.) is
-    // intentionally NOT permitted to avoid plan steps re-entering the orchestrator.
     private static final Pattern ALLOWED_ENDPOINT_PATH =
-            Pattern.compile(
-                    "^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$"
-                            + "|^/api/v1/ai/tools(/[A-Za-z0-9_-]+)+$");
+            Pattern.compile("^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$");
 
     private final ServletContext servletContext;
     private final UserServiceInterface userService;
     private final TempFileManager tempFileManager;
     private final Environment environment;
-    private final Duration readTimeout;
-    private final RestTemplate restTemplate;
 
     public InternalApiClient(
             ServletContext servletContext,
             @Autowired(required = false) UserServiceInterface userService,
             TempFileManager tempFileManager,
-            Environment environment,
-            ApplicationProperties applicationProperties) {
+            Environment environment) {
         this.servletContext = servletContext;
         this.userService = userService;
         this.tempFileManager = tempFileManager;
         this.environment = environment;
-        ApplicationProperties.InternalApi internalApi = applicationProperties.getInternalApi();
-        // A bounded read timeout is what protects the workflow when an internal tool hangs
-        // (e.g. an infinite loop in a PDF processing service). The connect timeout is short
-        // because this is a loopback call; if connecting takes longer than a few seconds the
-        // local server is itself unhealthy.
-        this.readTimeout = Duration.ofSeconds(internalApi.getReadTimeoutSeconds());
-        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
-        factory.setConnectTimeout(Duration.ofSeconds(internalApi.getConnectTimeoutSeconds()));
-        factory.setReadTimeout(readTimeout);
-        this.restTemplate = new RestTemplate(factory);
     }
 
     /**
@@ -91,6 +68,7 @@ public class InternalApiClient {
         validateUrl(endpointPath);
         String url = getBaseUrl() + endpointPath;
 
+        RestTemplate restTemplate = new RestTemplate();
         HttpHeaders headers = new HttpHeaders();
         String apiKey = getApiKeyForUser();
         if (apiKey != null && !apiKey.isEmpty()) {
@@ -100,38 +78,26 @@ public class InternalApiClient {
         HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
         RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);
 
-        try {
-            return restTemplate.execute(
-                    url,
-                    HttpMethod.POST,
-                    requestCallback,
-                    response -> {
-                        try {
-                            TempFile tempFile =
-                                    tempFileManager.createManagedTempFile("internal-api");
-                            Files.copy(
-                                    response.getBody(),
-                                    tempFile.getPath(),
-                                    java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-                            String filename = extractFilename(response.getHeaders());
-                            TempFileResource resource = new TempFileResource(tempFile, filename);
-                            return ResponseEntity.status(response.getStatusCode())
-                                    .headers(response.getHeaders())
-                                    .body(resource);
-                        } catch (IOException e) {
-                            throw new UncheckedIOException(e);
-                        }
-                    });
-        } catch (ResourceAccessException e) {
-            // RestTemplate wraps low-level I/O failures in ResourceAccessException. Only the
-            // SocketTimeoutException-rooted case is a real timeout; other I/O failures (connection
-            // refused, DNS, etc.) propagate as-is so the upstream generic handler can describe
-            // them accurately.
-            if (e.getCause() instanceof java.net.SocketTimeoutException) {
-                throw new InternalApiTimeoutException(endpointPath, readTimeout, e);
-            }
-            throw e;
-        }
+        return restTemplate.execute(
+                url,
+                HttpMethod.POST,
+                requestCallback,
+                response -> {
+                    try {
+                        TempFile tempFile = tempFileManager.createManagedTempFile("internal-api");
+                        Files.copy(
+                                response.getBody(),
+                                tempFile.getPath(),
+                                java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                        String filename = extractFilename(response.getHeaders());
+                        TempFileResource resource = new TempFileResource(tempFile, filename);
+                        return ResponseEntity.status(response.getStatusCode())
+                                .headers(response.getHeaders())
+                                .body(resource);
+                    } catch (IOException e) {
+                        throw new UncheckedIOException(e);
+                    }
+                });
     }
 
     /**

app/common/src/main/java/stirling/software/common/service/InternalApiTimeoutException.java

@@ -1,36 +0,0 @@
-package stirling.software.common.service;
-
-import java.time.Duration;
-
-/**
- * Thrown when an internal Stirling tool invocation exceeds its configured read timeout or otherwise
- * fails at the transport layer. Distinguishes a hung/timed-out tool from a tool that returned a
- * non-2xx HTTP response (which is reported via the response status itself), so callers can present
- * a clear "the tool didn't respond in time" message to the user instead of a generic stack trace.
- */
-public class InternalApiTimeoutException extends RuntimeException {
-
-    private final String endpointPath;
-    private final Duration readTimeout;
-
-    public InternalApiTimeoutException(String endpointPath, Duration readTimeout, Throwable cause) {
-        super(buildMessage(endpointPath, readTimeout, cause), cause);
-        this.endpointPath = endpointPath;
-        this.readTimeout = readTimeout;
-    }
-
-    public String getEndpointPath() {
-        return endpointPath;
-    }
-
-    public Duration getReadTimeout() {
-        return readTimeout;
-    }
-
-    private static String buildMessage(String endpointPath, Duration readTimeout, Throwable cause) {
-        String reason = cause != null && cause.getMessage() != null ? cause.getMessage() : "";
-        return String.format(
-                "Internal tool %s did not respond within %ds (%s)",
-                endpointPath, readTimeout.toSeconds(), reason);
-    }
-}

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -11,7 +11,6 @@ import java.util.function.Supplier;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -322,13 +321,6 @@ public class JobExecutorService {
                     log.debug(
                             "Stored ResponseEntity<StreamingResponseBody> result with fileId: {}",
                             fileId);
-                } else if (body instanceof Resource resource) {
-                    String filename = extractResponseFilename(response);
-                    String contentType = extractResponseContentType(response);
-
-                    String fileId = fileStorage.storeFromResource(resource, filename);
-                    taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug("Stored ResponseEntity<Resource> result with fileId: {}", fileId);
                 } else {
                     // Check if the response body contains a fileId
                     if (body != null && body.toString().contains("fileId")) {

app/common/src/main/java/stirling/software/common/service/PdfAnnotationService.java

@@ -1,157 +0,0 @@
-package stirling.software.common.service;
-
-import java.util.Calendar;
-import java.util.List;
-
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.graphics.color.PDColor;
-import org.apache.pdfbox.pdmodel.graphics.color.PDDeviceRGB;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationText;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.api.comments.AnnotationLocation;
-import stirling.software.common.model.api.comments.StickyNoteSpec;
-
-/**
- * Shared primitive for adding sticky-note (PDF Text) annotations to a document.
- *
- * <p>Used by:
- *
- * <ul>
- *   <li>{@code /api/v1/misc/add-comments} — a deterministic, reusable tool.
- *   <li>AI-agent flows that generate comment specs (e.g. PDF review agent, math auditor review
- *       mode) and hand them off to this service for deterministic placement.
- * </ul>
- */
-@Slf4j
-@Service
-public class PdfAnnotationService {
-
-    /** Yellow sticky-note fill colour (R, G, B in 0..1 range). */
-    private static final float[] STICKY_NOTE_COLOR_RGB = {1f, 0.95f, 0.4f};
-
-    /** Opacity for the sticky-note icon. */
-    private static final float ANNOTATION_OPACITY = 0.9f;
-
-    /** PDF Text-annotation icon name — {@code "Comment"} is one of the standard icons. */
-    private static final String ANNOTATION_ICON_NAME = "Comment";
-
-    /** Default subject shown in the annotation popup when a spec does not supply one. */
-    private static final String DEFAULT_SUBJECT = "Stirling AI Comment";
-
-    /** Default author label shown in the annotation popup when a spec does not supply one. */
-    private static final String DEFAULT_AUTHOR = "Stirling AI";
-
-    /**
-     * Cap on sticky-note text length. PDF annotation bodies can technically be much longer, but
-     * anything beyond this is almost certainly pathological (accidental document-dump or malicious
-     * payload) and would bloat the output file.
-     */
-    private static final int MAX_COMMENT_TEXT_LENGTH = 100_000;
-
-    /**
-     * Add a list of sticky notes to {@code doc}. Specs that reference an out-of-range page or
-     * contain blank text are logged and skipped; this method never throws for a single bad spec.
-     *
-     * @return the number of annotations actually applied
-     */
-    public int addStickyNotes(PDDocument doc, List<StickyNoteSpec> specs) {
-        if (specs == null || specs.isEmpty()) {
-            return 0;
-        }
-        int totalPages = doc.getNumberOfPages();
-        Calendar now = Calendar.getInstance();
-        int applied = 0;
-        for (int i = 0; i < specs.size(); i++) {
-            StickyNoteSpec spec = specs.get(i);
-            if (!isValid(spec, totalPages, i)) {
-                continue;
-            }
-            apply(doc, spec, now);
-            applied++;
-        }
-        if (applied < specs.size()) {
-            log.warn(
-                    "Applied {}/{} sticky notes; {} skipped due to invalid specs.",
-                    applied,
-                    specs.size(),
-                    specs.size() - applied);
-        }
-        return applied;
-    }
-
-    /**
-     * Add a single sticky note. Convenience wrapper; prefer {@link #addStickyNotes(PDDocument,
-     * List)} when placing multiple annotations so log output is batched.
-     */
-    public void addStickyNote(PDDocument doc, StickyNoteSpec spec) {
-        addStickyNotes(doc, List.of(spec));
-    }
-
-    private boolean isValid(StickyNoteSpec spec, int totalPages, int index) {
-        if (spec == null || spec.location() == null) {
-            log.warn("Skipping sticky-note[{}]: spec or location is null.", index);
-            return false;
-        }
-        if (spec.text() == null || spec.text().isBlank()) {
-            log.warn("Skipping sticky-note[{}]: text is blank.", index);
-            return false;
-        }
-        if (spec.text().length() > MAX_COMMENT_TEXT_LENGTH) {
-            log.warn(
-                    "Skipping sticky-note[{}]: text length {} exceeds limit {}.",
-                    index,
-                    spec.text().length(),
-                    MAX_COMMENT_TEXT_LENGTH);
-            return false;
-        }
-        AnnotationLocation loc = spec.location();
-        if (loc.width() <= 0f || loc.height() <= 0f) {
-            log.warn(
-                    "Skipping sticky-note[{}]: non-positive dimensions width={} height={}.",
-                    index,
-                    loc.width(),
-                    loc.height());
-            return false;
-        }
-        int page = loc.pageIndex();
-        if (page < 0 || page >= totalPages) {
-            log.warn(
-                    "Skipping sticky-note[{}]: pageIndex={} out of range [0, {}).",
-                    index,
-                    page,
-                    totalPages);
-            return false;
-        }
-        return true;
-    }
-
-    private void apply(PDDocument doc, StickyNoteSpec spec, Calendar now) {
-        AnnotationLocation loc = spec.location();
-
-        PDAnnotationText annot = new PDAnnotationText();
-        annot.setContents(spec.text());
-        annot.setRectangle(new PDRectangle(loc.x(), loc.y(), loc.width(), loc.height()));
-        annot.setSubject(nonBlankOr(spec.subject(), DEFAULT_SUBJECT));
-        annot.setTitlePopup(nonBlankOr(spec.author(), DEFAULT_AUTHOR));
-        annot.setColor(new PDColor(STICKY_NOTE_COLOR_RGB, PDDeviceRGB.INSTANCE));
-        annot.setCreationDate(now);
-        annot.setConstantOpacity(ANNOTATION_OPACITY);
-        annot.getCOSObject().setName(COSName.NAME, ANNOTATION_ICON_NAME);
-
-        try {
-            doc.getPage(loc.pageIndex()).getAnnotations().add(annot);
-        } catch (java.io.IOException e) {
-            log.warn(
-                    "Failed to attach sticky note to page {}: {}", loc.pageIndex(), e.getMessage());
-        }
-    }
-
-    private static String nonBlankOr(String value, String fallback) {
-        return value != null && !value.isBlank() ? value : fallback;
-    }
-}

app/common/src/main/java/stirling/software/common/util/FormUtils.java

@@ -629,12 +629,11 @@ public class FormUtils {
             }
             log.debug("Skipping form fill because document has no AcroForm");
             if (flatten) {
-                flattenEntireDocument(document, null, false, false);
+                flattenEntireDocument(document, null, false);
             }
             return;
         }
 
-        boolean valuesProvided = values != null && !values.isEmpty();
         boolean valuesApplied = false;
         if (values != null && !values.isEmpty()) {
             acroForm.setCacheFields(true);
@@ -680,7 +679,7 @@ public class FormUtils {
         repairWidgetGeometry(document, acroForm);
 
         if (flatten) {
-            flattenEntireDocument(document, acroForm, valuesApplied, valuesProvided);
+            flattenEntireDocument(document, acroForm, valuesApplied);
         }
     }
 
@@ -727,16 +726,15 @@ public class FormUtils {
     // Forcing appearance regeneration via setNeedAppearances(true) drives
     // PDFBox into refreshAppearances inside flatten(), where it can hang on
     // certain documents (PDFBOX-5962). We therefore only regenerate when we
-    // actually wrote new values, or when the request included values and the
-    // document has widgets without appearance streams.
+    // actually wrote new values, or when some widgets are missing appearance
+    // streams and would otherwise flatten blank.
     private void flattenEntireDocument(
-            PDDocument document, PDAcroForm acroForm, boolean valuesWritten, boolean valuesProvided)
-            throws IOException {
+            PDDocument document, PDAcroForm acroForm, boolean valuesWritten) throws IOException {
         if (document == null || acroForm == null) {
             return;
         }
 
-        if (valuesWritten || (valuesProvided && hasWidgetWithoutAppearance(acroForm))) {
+        if (valuesWritten || hasWidgetWithoutAppearance(acroForm)) {
             ensureAppearances(acroForm);
         } else {
             acroForm.setNeedAppearances(false);
@@ -2289,85 +2287,6 @@ public class FormUtils {
         acroForm.getFields().add(field);
     }
 
-    /** Drops AcroForm fields whose widgets are no longer on any page of {@code document}. */
-    public void pruneOrphanedFormFields(PDDocument document) {
-        if (document == null) {
-            return;
-        }
-        PDDocumentCatalog catalog = document.getDocumentCatalog();
-        if (catalog == null) {
-            return;
-        }
-        PDAcroForm form = catalog.getAcroForm(null);
-        if (form == null) {
-            return;
-        }
-        List<PDField> fields = form.getFields();
-        if (fields.isEmpty()) {
-            return;
-        }
-
-        Set<COSDictionary> liveWidgets = collectLiveWidgetDictionaries(document);
-        List<PDField> kept = pruneFieldList(fields, liveWidgets);
-        if (kept.isEmpty()) {
-            catalog.setAcroForm(null);
-        } else if (kept.size() != fields.size()) {
-            form.setFields(kept);
-        }
-    }
-
-    private Set<COSDictionary> collectLiveWidgetDictionaries(PDDocument document) {
-        Set<COSDictionary> live = new HashSet<>();
-        int pageCount = document.getNumberOfPages();
-        for (int i = 0; i < pageCount; i++) {
-            try {
-                for (PDAnnotation annotation : document.getPage(i).getAnnotations()) {
-                    if (annotation instanceof PDAnnotationWidget) {
-                        live.add(annotation.getCOSObject());
-                    }
-                }
-            } catch (IOException e) {
-                log.debug("Failed reading page {} annotations: {}", i, e.getMessage());
-            }
-        }
-        return live;
-    }
-
-    private List<PDField> pruneFieldList(List<PDField> fields, Set<COSDictionary> liveWidgets) {
-        List<PDField> kept = new ArrayList<>(fields.size());
-        for (PDField field : fields) {
-            if (field instanceof PDNonTerminalField nonTerminal) {
-                List<PDField> children = nonTerminal.getChildren();
-                List<PDField> remaining = pruneFieldList(children, liveWidgets);
-                if (remaining.isEmpty()) {
-                    continue;
-                }
-                if (remaining.size() != children.size()) {
-                    nonTerminal.setChildren(remaining);
-                }
-                kept.add(nonTerminal);
-            } else if (field instanceof PDTerminalField terminal) {
-                List<PDAnnotationWidget> widgets = terminal.getWidgets();
-                List<PDAnnotationWidget> liveOnes = new ArrayList<>(widgets.size());
-                for (PDAnnotationWidget widget : widgets) {
-                    if (liveWidgets.contains(widget.getCOSObject())) {
-                        liveOnes.add(widget);
-                    }
-                }
-                if (liveOnes.isEmpty()) {
-                    continue;
-                }
-                if (liveOnes.size() != widgets.size()) {
-                    terminal.setWidgets(liveOnes);
-                }
-                kept.add(terminal);
-            } else {
-                kept.add(field);
-            }
-        }
-        return kept;
-    }
-
     // Delegation methods to GeneralFormCopyUtils for form field transformation
     public boolean hasAnyRotatedPage(PDDocument document) {
         return stirling.software.common.util.GeneralFormCopyUtils.hasAnyRotatedPage(document);

app/common/src/main/java/stirling/software/common/util/PDFToFile.java

@@ -16,11 +16,11 @@ import java.util.zip.ZipOutputStream;
 
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import com.vladsch.flexmark.html2md.converter.FlexmarkHtmlConverter;
 import com.vladsch.flexmark.util.data.MutableDataSet;
@@ -49,7 +49,7 @@ public class PDFToFile {
         this.runtimePathConfig = runtimePathConfig;
     }
 
-    public ResponseEntity<Resource> processPdfToMarkdown(MultipartFile inputFile)
+    public ResponseEntity<StreamingResponseBody> processPdfToMarkdown(MultipartFile inputFile)
             throws IOException, InterruptedException {
         if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
             return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -169,7 +169,7 @@ public class PDFToFile {
         return PATTERN.matcher(markdown).replaceAll("$1(images/$2)");
     }
 
-    public ResponseEntity<Resource> processPdfToHtml(MultipartFile inputFile)
+    public ResponseEntity<StreamingResponseBody> processPdfToHtml(MultipartFile inputFile)
             throws IOException, InterruptedException {
         if (!MediaType.APPLICATION_PDF_VALUE.equals(inputFile.getContentType())) {
             return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
@@ -232,7 +232,7 @@ public class PDFToFile {
                 finalOut, fileName, MediaType.APPLICATION_OCTET_STREAM);
     }
 
-    public ResponseEntity<Resource> processPdfToOfficeFormat(
+    public ResponseEntity<StreamingResponseBody> processPdfToOfficeFormat(
             MultipartFile inputFile, String outputFormat, String libreOfficeFilter)
             throws IOException, InterruptedException {
 

app/common/src/main/java/stirling/software/common/util/PdfTextLocator.java

@@ -1,139 +0,0 @@
-package stirling.software.common.util;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Locale;
-import java.util.Optional;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.text.PDFTextStripper;
-import org.apache.pdfbox.text.TextPosition;
-import org.springframework.stereotype.Component;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Locate text on a specific PDF page and return its bounding box in PDF user-space (bottom-left
- * origin). Used by tools that receive "anchor by text" hints — e.g. {@code
- * /api/v1/misc/add-comments} when callers supply an {@code anchorText} instead of explicit
- * coordinates.
- *
- * <p>Matching is tolerant: case-insensitive with punctuation/whitespace stripped on both sides, so
- * a caller-supplied needle of {@code "215000"} matches page text {@code "$215,000"}, and {@code
- * "Total Revenue"} matches {@code "Total Revenue."}.
- */
-@Slf4j
-@Component
-public class PdfTextLocator {
-
-    /** One found line of text with its user-space bounding box. */
-    public record MatchedBox(float x, float y, float width, float height) {}
-
-    /**
-     * Find the first line on {@code pageIndex} (0-indexed) whose text contains {@code needle} under
-     * the tolerant match. Returns empty when no match, when the page index is out of range, or when
-     * the needle is blank.
-     */
-    public Optional<MatchedBox> findOnPage(PDDocument doc, int pageIndex, String needle) {
-        if (doc == null
-                || needle == null
-                || needle.isBlank()
-                || pageIndex < 0
-                || pageIndex >= doc.getNumberOfPages()) {
-            return Optional.empty();
-        }
-        String normalizedNeedle = normalize(needle);
-        if (normalizedNeedle.isEmpty()) {
-            return Optional.empty();
-        }
-
-        List<CapturedLine> lines = new ArrayList<>();
-        LineCapturingStripper stripper;
-        try {
-            stripper = new LineCapturingStripper(lines);
-            stripper.setStartPage(pageIndex + 1);
-            stripper.setEndPage(pageIndex + 1);
-            stripper.setSortByPosition(true);
-            // Side effect: populates `lines`. We don't need the concatenated text.
-            stripper.getText(doc);
-        } catch (IOException e) {
-            log.warn(
-                    "PdfTextLocator failed to extract text on page {}: {}",
-                    pageIndex,
-                    e.getMessage());
-            return Optional.empty();
-        }
-
-        PDRectangle mediaBox = doc.getPage(pageIndex).getMediaBox();
-        float pageHeight = mediaBox.getHeight();
-
-        for (CapturedLine line : lines) {
-            if (normalize(line.text).contains(normalizedNeedle)) {
-                // PDFBox's *DirAdj coords descend from the top of the page; convert to PDF
-                // user-space (origin = bottom-left) so the bbox can feed a PDRectangle directly.
-                float userSpaceY = pageHeight - line.yTopDown - line.height;
-                return Optional.of(new MatchedBox(line.x, userSpaceY, line.width, line.height));
-            }
-        }
-        return Optional.empty();
-    }
-
-    /** Strip everything non-alphanumeric and lowercase for tolerant matching. */
-    private static String normalize(String s) {
-        return s.replaceAll("[^A-Za-z0-9]", "").toLowerCase(Locale.ROOT);
-    }
-
-    private static final class CapturedLine {
-        String text;
-        float x;
-        float yTopDown;
-        float width;
-        float height;
-    }
-
-    private static final class LineCapturingStripper extends PDFTextStripper {
-        private final List<CapturedLine> lines;
-
-        LineCapturingStripper(List<CapturedLine> sink) throws IOException {
-            super();
-            this.lines = sink;
-        }
-
-        @Override
-        protected void writeString(String text, List<TextPosition> textPositions)
-                throws IOException {
-            if (textPositions != null && !textPositions.isEmpty()) {
-                CapturedLine line = new CapturedLine();
-                line.text = text;
-
-                float minX = Float.MAX_VALUE;
-                float maxRight = 0f;
-                float minY = Float.MAX_VALUE;
-                float maxHeight = 0f;
-                for (TextPosition p : textPositions) {
-                    float x = p.getXDirAdj();
-                    float y = p.getYDirAdj();
-                    float w = p.getWidthDirAdj();
-                    float h = p.getHeightDir();
-                    if (h == 0f) {
-                        // Workaround: some fonts report 0 height via TextPosition; fall back to
-                        // the nominal font size so downstream bboxes are never zero-height.
-                        h = p.getFontSizeInPt();
-                    }
-                    if (x < minX) minX = x;
-                    if (x + w > maxRight) maxRight = x + w;
-                    if (y < minY) minY = y;
-                    if (h > maxHeight) maxHeight = h;
-                }
-                line.x = minX;
-                line.width = maxRight - minX;
-                line.yTopDown = minY;
-                line.height = maxHeight;
-                lines.add(line);
-            }
-            super.writeString(text, textPositions);
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/util/ProcessExecutor.java

@@ -15,7 +15,6 @@ import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Semaphore;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
 
 import io.github.pixee.security.BoundedLineReader;
 
@@ -203,15 +202,7 @@ public class ProcessExecutor {
         boolean useSemaphore = true;
         List<String> commandToRun = command;
         if (shouldUseUnoServerPool(command)) {
-            try {
-                unoLease = unoServerPool.acquireEndpoint(timeoutDuration, TimeUnit.MINUTES);
-            } catch (TimeoutException e) {
-                throw new IOException(
-                        "All unoserver endpoints busy; request timed out after "
-                                + timeoutDuration
-                                + " minutes",
-                        e);
-            }
+            unoLease = unoServerPool.acquireEndpoint();
             commandToRun = applyUnoServerEndpoint(command, unoLease.getEndpoint());
             useSemaphore = false;
         }

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -182,9 +182,7 @@ public class RequestUriUtils {
                         "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
                 || trimmedUri.startsWith("/v1/api-docs")
                 // Workflow participant endpoints — access controlled by share tokens, not login
-                || trimmedUri.startsWith("/api/v1/workflow/participant/")
-                // Share-link SPA bootstrap; data APIs remain protected
-                || trimmedUri.matches("^/share/[^/]+/?$");
+                || trimmedUri.startsWith("/api/v1/workflow/participant/");
     }
 
     private static String stripContextPath(String contextPath, String requestURI) {

app/common/src/main/java/stirling/software/common/util/UnoServerPool.java

@@ -3,11 +3,8 @@ package stirling.software.common.util;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
-import java.util.Locale;
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicBoolean;
 
 import stirling.software.common.model.ApplicationProperties;
@@ -45,27 +42,6 @@ public class UnoServerPool {
         return new UnoServerLease(endpoints.get(index), index, this);
     }
 
-    /** Fail-fast variant; non-positive timeout falls back to unbounded acquire. */
-    public UnoServerLease acquireEndpoint(long timeout, TimeUnit unit)
-            throws InterruptedException, TimeoutException {
-        if (endpoints.isEmpty()) {
-            return new UnoServerLease(defaultEndpoint(), null, this);
-        }
-        if (timeout <= 0) {
-            return acquireEndpoint();
-        }
-
-        Integer index = availableIndices.poll(timeout, unit);
-        if (index == null) {
-            throw new TimeoutException(
-                    "Timed out waiting for a free unoserver endpoint after "
-                            + timeout
-                            + " "
-                            + unit.name().toLowerCase(Locale.ROOT));
-        }
-        return new UnoServerLease(endpoints.get(index), index, this);
-    }
-
     private void releaseEndpoint(Integer index) {
         if (index != null) {
             availableIndices.offer(index);

app/common/src/main/java/stirling/software/common/util/WebResponseUtils.java

@@ -1,22 +1,19 @@
 package stirling.software.common.util;
 
 import java.io.ByteArrayOutputStream;
-import java.io.FilterInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.github.pixee.security.Filenames;
 
@@ -52,7 +49,12 @@ public class WebResponseUtils {
         HttpHeaders headers = new HttpHeaders();
         headers.setContentType(mediaType);
         headers.setContentLength(bytes.length);
-        headers.setContentDispositionFormData("attachment", encodeAttachmentName(docName));
+        String encodedDocName =
+                RegexPatternUtils.getInstance()
+                        .getPlusSignPattern()
+                        .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
+                        .replaceAll("%20");
+        headers.setContentDispositionFormData("attachment", encodedDocName);
         return new ResponseEntity<>(bytes, headers, HttpStatus.OK);
     }
 
@@ -71,17 +73,7 @@ public class WebResponseUtils {
         return baosToWebResponse(baos, docName);
     }
 
-    /**
-     * Save a {@link PDDocument} to a managed temp file and return it as a file-backed {@code
-     * ResponseEntity<Resource>}.
-     *
-     * <p>The returned {@link Resource} owns the supplied {@link TempFile} — the file is deleted
-     * when Spring closes the response {@link InputStream} after writing the body. This is a
-     * synchronous equivalent of the previous {@code StreamingResponseBody} pattern and avoids the
-     * async-dispatch hazards (response-committed races, filter incompatibility, silent write
-     * failures) that {@code StreamingResponseBody} introduced.
-     */
-    public static ResponseEntity<Resource> pdfDocToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> pdfDocToWebResponse(
             PDDocument document, String docName, TempFileManager tempFileManager)
             throws IOException {
         TempFile tempFile = tempFileManager.createManagedTempFile(".pdf");
@@ -95,49 +87,38 @@ public class WebResponseUtils {
     }
 
     /**
-     * Convert a {@link TempFile} holding a PDF into a web response.
-     *
-     * <p>The temp file is deleted when Spring closes the response body stream.
+     * Convert a File to a web response (PDF default).
      *
      * @param outputTempFile The temporary file to be sent as a response.
      * @param docName The name of the document.
-     * @return A ResponseEntity whose body streams the file, deleting it on close.
+     * @return A ResponseEntity containing the file as a resource.
      */
-    public static ResponseEntity<Resource> pdfFileToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> pdfFileToWebResponse(
             TempFile outputTempFile, String docName) throws IOException {
         return fileToWebResponse(outputTempFile, docName, MediaType.APPLICATION_PDF);
     }
 
     /**
-     * Convert a {@link TempFile} holding a ZIP archive into a web response.
-     *
-     * <p>The temp file is deleted when Spring closes the response body stream.
+     * Convert a File to a web response (ZIP default).
      *
      * @param outputTempFile The temporary file to be sent as a response.
      * @param docName The name of the document.
-     * @return A ResponseEntity whose body streams the file, deleting it on close.
+     * @return A ResponseEntity containing the file as a resource.
      */
-    public static ResponseEntity<Resource> zipFileToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> zipFileToWebResponse(
             TempFile outputTempFile, String docName) throws IOException {
         return fileToWebResponse(outputTempFile, docName, MediaType.APPLICATION_OCTET_STREAM);
     }
 
     /**
-     * Convert a {@link TempFile} into a web response with an explicit media type.
-     *
-     * <p>The returned {@link ResponseEntity} carries a {@link ManagedTempFileResource} as its body.
-     * Spring's {@code ResourceHttpMessageConverter} calls {@link Resource#getInputStream()} once
-     * and closes the returned stream after writing — at which point the underlying {@link TempFile}
-     * is deleted. Everything runs synchronously on the request thread, so write failures propagate
-     * through normal Spring error handling and are logged, rather than silently truncating the
-     * response.
+     * Convert a File to a web response with explicit media type (e.g., ZIP).
      *
      * @param outputTempFile The temporary file to be sent as a response.
      * @param docName The name of the document.
      * @param mediaType The content type to set on the response.
-     * @return A ResponseEntity whose body streams the file, deleting it on close.
+     * @return A ResponseEntity containing the file as a resource.
      */
-    public static ResponseEntity<Resource> fileToWebResponse(
+    public static ResponseEntity<StreamingResponseBody> fileToWebResponse(
             TempFile outputTempFile, String docName, MediaType mediaType) throws IOException {
 
         try {
@@ -146,9 +127,23 @@ public class WebResponseUtils {
             HttpHeaders headers = new HttpHeaders();
             headers.setContentType(mediaType);
             headers.setContentLength(len);
-            headers.setContentDispositionFormData("attachment", encodeAttachmentName(docName));
+            String encodedDocName =
+                    RegexPatternUtils.getInstance()
+                            .getPlusSignPattern()
+                            .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
+                            .replaceAll("%20");
+            headers.setContentDispositionFormData("attachment", encodedDocName);
+
+            StreamingResponseBody body =
+                    os -> {
+                        try (os) {
+                            Files.copy(path, os);
+                            os.flush();
+                        } finally {
+                            outputTempFile.close();
+                        }
+                    };
 
-            Resource body = new ManagedTempFileResource(outputTempFile);
             return new ResponseEntity<>(body, headers, HttpStatus.OK);
         } catch (IOException | RuntimeException e) {
             try {
@@ -159,115 +154,4 @@ public class WebResponseUtils {
             throw e;
         }
     }
-
-    private static String encodeAttachmentName(String docName) {
-        return RegexPatternUtils.getInstance()
-                .getPlusSignPattern()
-                .matcher(URLEncoder.encode(docName, StandardCharsets.UTF_8))
-                .replaceAll("%20");
-    }
-
-    /**
-     * {@link Resource} backed by a {@link TempFile}. The underlying temp file is deleted when the
-     * response {@code InputStream} is closed — i.e. after Spring has finished writing the body. Any
-     * {@link IOException} during the copy is logged via {@link ClosingInputStream} and propagates
-     * through Spring's normal error path. Since response headers are committed before the body
-     * transfer begins, a mid-body failure manifests as a server-side log entry plus an aborted
-     * connection rather than a silently-truncated success — which is the behaviour this class was
-     * added to restore.
-     *
-     * <p><b>Single-use contract:</b> {@link #getInputStream()} is intended to be called once by
-     * Spring's {@code ResourceHttpMessageConverter} on the normal write path. After the returned
-     * stream is closed the backing temp file is deleted, so subsequent {@code getInputStream()}
-     * calls will either see a deleted file (tests that mock {@link TempFile#close()} are an
-     * exception) or fail at read time. Callers that need to re-read the body must copy it first.
-     */
-    public static final class ManagedTempFileResource extends FileSystemResource {
-
-        private final TempFile tempFile;
-
-        public ManagedTempFileResource(TempFile tempFile) {
-            super(tempFile.getFile());
-            this.tempFile = tempFile;
-        }
-
-        @Override
-        public InputStream getInputStream() throws IOException {
-            InputStream source;
-            try {
-                source = super.getInputStream();
-            } catch (IOException e) {
-                // Opening the input stream already failed; make sure we don't leak the temp file.
-                try {
-                    tempFile.close();
-                } catch (Exception closeEx) {
-                    e.addSuppressed(closeEx);
-                }
-                throw e;
-            }
-            return new ClosingInputStream(source, tempFile);
-        }
-    }
-
-    /**
-     * Stream wrapper that deletes its backing {@link TempFile} on close. Logs — but does not
-     * swallow — any IOException that happens while reading the body, so upstream handlers can
-     * surface the failure to the client.
-     */
-    private static final class ClosingInputStream extends FilterInputStream {
-
-        private final TempFile tempFile;
-        private boolean closed;
-
-        ClosingInputStream(InputStream delegate, TempFile tempFile) {
-            super(delegate);
-            this.tempFile = tempFile;
-        }
-
-        @Override
-        public int read() throws IOException {
-            try {
-                return super.read();
-            } catch (IOException e) {
-                log.error(
-                        "Failed to read temp response body {} while streaming to client",
-                        tempFile.getAbsolutePath(),
-                        e);
-                throw e;
-            }
-        }
-
-        @Override
-        public int read(byte[] b, int off, int len) throws IOException {
-            try {
-                return super.read(b, off, len);
-            } catch (IOException e) {
-                log.error(
-                        "Failed to read temp response body {} while streaming to client",
-                        tempFile.getAbsolutePath(),
-                        e);
-                throw e;
-            }
-        }
-
-        @Override
-        public void close() throws IOException {
-            if (closed) {
-                return;
-            }
-            closed = true;
-            try {
-                super.close();
-            } finally {
-                try {
-                    tempFile.close();
-                } catch (Exception closeEx) {
-                    log.warn(
-                            "Failed to clean up temp file {} after streaming response",
-                            tempFile.getAbsolutePath(),
-                            closeEx);
-                }
-            }
-        }
-    }
 }

app/common/src/main/java/stirling/software/common/util/propertyeditor/StringToArrayListPropertyEditor.java

@@ -6,18 +6,15 @@ import java.util.List;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.model.api.security.RedactionArea;
+
+import tools.jackson.core.type.TypeReference;
 import tools.jackson.databind.DeserializationFeature;
-import tools.jackson.databind.JavaType;
 import tools.jackson.databind.ObjectMapper;
 import tools.jackson.databind.json.JsonMapper;
 
-/**
- * Spring property editor that decodes a JSON string into a typed {@link ArrayList}. Used to bind
- * complex list parameters (e.g. {@code List<RedactionArea>}, {@code List<EditTextOperation>}) from
- * multipart form fields, where Spring's default binding cannot deserialize a JSON array.
- */
 @Slf4j
-public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
+public class StringToArrayListPropertyEditor extends PropertyEditorSupport {
 
     private final ObjectMapper objectMapper =
             JsonMapper.builder()
@@ -25,12 +22,6 @@ public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
                     .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
                     .build();
 
-    private final Class<T> elementType;
-
-    public StringToArrayListPropertyEditor(Class<T> elementType) {
-        this.elementType = elementType;
-    }
-
     @Override
     public void setAsText(String text) throws IllegalArgumentException {
         if (text == null || text.trim().isEmpty()) {
@@ -38,11 +29,8 @@ public class StringToArrayListPropertyEditor<T> extends PropertyEditorSupport {
             return;
         }
         try {
-            JavaType listType =
-                    objectMapper
-                            .getTypeFactory()
-                            .constructCollectionType(ArrayList.class, elementType);
-            List<T> list = objectMapper.readValue(text, listType);
+            TypeReference<ArrayList<RedactionArea>> typeRef = new TypeReference<>() {};
+            List<RedactionArea> list = objectMapper.readValue(text, typeRef);
             setValue(list);
         } catch (Exception e) {
             log.error("Exception while converting {}", e);

app/common/src/test/java/stirling/software/SPDF/config/EndpointConfigurationTest.java

@@ -1,39 +0,0 @@
-package stirling.software.SPDF.config;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNull;
-
-import org.junit.jupiter.api.Test;
-
-class EndpointConfigurationTest {
-
-    @Test
-    void endpointKeyForUriExtractsSimpleKebab() {
-        assertEquals(
-                "remove-pages",
-                EndpointConfiguration.endpointKeyForUri("/api/v1/general/remove-pages"));
-        assertEquals(
-                "compress-pdf",
-                EndpointConfiguration.endpointKeyForUri("/api/v1/misc/compress-pdf"));
-        assertEquals(
-                "add-watermark",
-                EndpointConfiguration.endpointKeyForUri("/api/v1/security/add-watermark"));
-    }
-
-    @Test
-    void endpointKeyForUriComposesConvertEndpoints() {
-        assertEquals(
-                "pdf-to-img", EndpointConfiguration.endpointKeyForUri("/api/v1/convert/pdf/img"));
-        assertEquals(
-                "pdf-to-word", EndpointConfiguration.endpointKeyForUri("/api/v1/convert/pdf/word"));
-        assertEquals(
-                "html-to-pdf", EndpointConfiguration.endpointKeyForUri("/api/v1/convert/html/pdf"));
-    }
-
-    @Test
-    void endpointKeyForUriReturnsNullForNonApiPaths() {
-        assertNull(EndpointConfiguration.endpointKeyForUri(null));
-        assertNull(EndpointConfiguration.endpointKeyForUri("/some-page"));
-        assertNull(EndpointConfiguration.endpointKeyForUri("/api/v1/general"));
-    }
-}

app/common/src/test/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParserTest.java

@@ -1,153 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.util.List;
-
-import org.junit.jupiter.api.Test;
-
-/**
- * Unit tests for {@link LineAlignmentTableParser}, focused on the coincident-line merge logic and
- * column-grid construction.
- */
-class LineAlignmentTableParserTest {
-
-    private final LineAlignmentTableParser parser = new LineAlignmentTableParser();
-
-    // ── mergeCoincidentLines ─────────────────────────────────────────────────────────────────────
-
-    @Test
-    void mergeCoincidentLines_singleLine_unchanged() {
-        var lines = List.of(tokenized(rawLine(10f, 100f, "Revenue")));
-        assertThat(parser.mergeCoincidentLines(lines)).hasSize(1);
-    }
-
-    @Test
-    void mergeCoincidentLines_distinctYLines_unchanged() {
-        // Two lines at different y positions — must NOT be merged.
-        var lines =
-                List.of(
-                        tokenized(rawLine(10f, 100f, "Revenue")),
-                        tokenized(rawLine(10f, 115f, "Cost")));
-        assertThat(parser.mergeCoincidentLines(lines)).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_sameY_merged() {
-        // Simulates a financial-table row split by LineBuilder at the column gap:
-        //   label fragment at x=72  → "Revenue"
-        //   value fragment at x=350 → "1,234"
-        // Both have y=100. After merge they should form one TokenizedLine.
-        var label = rawLine(72f, 100f, "Revenue");
-        var value = rawLine(350f, 100f, "1,234");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
-
-        assertThat(merged).hasSize(1);
-        // The merged line should contain tokens from both halves.
-        var tokens = merged.get(0).all();
-        assertThat(tokens.stream().map(t -> t.text()).toList())
-                .containsExactlyInAnyOrder("Revenue", "1,234");
-    }
-
-    @Test
-    void mergeCoincidentLines_sameY_mergedLineHasCorrectBounds() {
-        var label = rawLine(72f, 100f, "Revenue"); // 7 chars × 6pt = 42pt wide → right = 114
-        var value = rawLine(350f, 100f, "1,234"); // 5 chars × 6pt = 30pt wide → right = 380
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(value)));
-
-        var bounds = merged.get(0).line().bounds();
-        assertThat(bounds.x()).isEqualTo(72f);
-        assertThat(bounds.right()).isEqualTo(380f);
-    }
-
-    @Test
-    void mergeCoincidentLines_withinTolerance_merged() {
-        // Lines 1.5pt apart (within ROW_MERGE_TOLERANCE_PT = 2pt) should merge.
-        var a = rawLine(10f, 100.0f, "Alpha");
-        var b = rawLine(200f, 101.5f, "99");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
-        assertThat(merged).hasSize(1);
-    }
-
-    @Test
-    void mergeCoincidentLines_beyondTolerance_notMerged() {
-        // Lines 3pt apart (beyond ROW_MERGE_TOLERANCE_PT = 2pt) should NOT merge.
-        var a = rawLine(10f, 100.0f, "Alpha");
-        var b = rawLine(200f, 103.0f, "99");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b)));
-        assertThat(merged).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_threeCoincident_allMerged() {
-        // Three fragments at the same y (e.g. wide financial table with two value columns).
-        var a = rawLine(72f, 100f, "Revenue");
-        var b = rawLine(300f, 100f, "1,234");
-        var c = rawLine(400f, 100f, "5,678");
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
-        assertThat(merged).hasSize(1);
-        assertThat(merged.get(0).all()).hasSize(3);
-    }
-
-    @Test
-    void mergeCoincidentLines_coincidentPairFollowedByDistinctLine_twoGroups() {
-        var a = rawLine(72f, 100f, "Revenue");
-        var b = rawLine(350f, 100f, "1,234"); // same y as a → merges with a
-        var c = rawLine(10f, 115f, "Expenses"); // different y → stays separate
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(a), tokenized(b), tokenized(c)));
-        assertThat(merged).hasSize(2);
-    }
-
-    @Test
-    void mergeCoincidentLines_numericAnchorStatus_correctAfterMerge() {
-        // After merging, the combined line should be an anchor (≥2 numeric tokens).
-        // "Revenue" alone → not an anchor. "1,234  567" alone → anchor.
-        // Merged → anchor with at least 2 numerics.
-        var label = rawLine(72f, 100f, "Revenue");
-        var values = rawLineMultiWord(350f, 100f, "1,234", 30f, "567", 30f);
-
-        var merged = parser.mergeCoincidentLines(List.of(tokenized(label), tokenized(values)));
-
-        assertThat(merged).hasSize(1);
-        assertThat(merged.get(0).isAnchor()).isTrue();
-    }
-
-    // ── helpers ──────────────────────────────────────────────────────────────────────────────────
-
-    /** Creates a RawLine with a single TextFragment of the given text at the given position. */
-    private static RawLine rawLine(float x, float y, String text) {
-        float width = text.length() * 6f; // ~6pt per char — rough but consistent
-        float height = 12f;
-        Bounds bounds = new Bounds(x, y, width, height);
-        TextFragment fragment =
-                new TextFragment("tf-test", text, bounds, y + height, 11f, "Helvetica", false);
-        return new RawLine("ln-test", List.of(fragment), bounds, 1);
-    }
-
-    /**
-     * Creates a RawLine with two TextFragments representing two words separated by a small gap.
-     * Used to simulate a values-only line with multiple numeric tokens.
-     */
-    private static RawLine rawLineMultiWord(
-            float x, float y, String word1, float w1, String word2, float w2) {
-        float height = 12f;
-        Bounds b1 = new Bounds(x, y, w1, height);
-        Bounds b2 = new Bounds(x + w1 + 5f, y, w2, height);
-        TextFragment f1 = new TextFragment("tf-1", word1, b1, y + height, 11f, "Helvetica", false);
-        TextFragment f2 = new TextFragment("tf-2", word2, b2, y + height, 11f, "Helvetica", false);
-        Bounds lineBounds = new Bounds(x, y, x + w1 + 5f + w2 - x, height);
-        return new RawLine("ln-test", List.of(f1, f2), lineBounds, 1);
-    }
-
-    /** Tokenises a RawLine via the parser's own tokenise logic (package-private access). */
-    private LineAlignmentTableParser.TokenizedLine tokenized(RawLine line) {
-        return parser.tokenize(line);
-    }
-}

app/common/src/test/java/stirling/software/common/architecture/ArchitectureTest.java

@@ -1,59 +0,0 @@
-package stirling.software.common.architecture;
-
-import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
-
-import org.junit.jupiter.api.Test;
-
-import com.tngtech.archunit.core.domain.JavaClasses;
-import com.tngtech.archunit.core.importer.ClassFileImporter;
-import com.tngtech.archunit.core.importer.ImportOption;
-import com.tngtech.archunit.lang.ArchRule;
-
-/**
- * Module dependency-direction guardrails. Allowed direction: {@code saas → proprietary → common}
- * and {@code stirling-pdf → proprietary → common}.
- */
-class ArchitectureTest {
-
-    private static final JavaClasses commonClasses =
-            new ClassFileImporter()
-                    .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_JARS)
-                    .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS)
-                    .importPackages("stirling.software.common");
-
-    @Test
-    void commonDoesNotDependOnCore() {
-        ArchRule rule =
-                noClasses()
-                        .that()
-                        .resideInAPackage("stirling.software.common..")
-                        .should()
-                        .dependOnClassesThat()
-                        .resideInAPackage("stirling.software.SPDF..");
-        rule.check(commonClasses);
-    }
-
-    @Test
-    void commonDoesNotDependOnProprietary() {
-        ArchRule rule =
-                noClasses()
-                        .that()
-                        .resideInAPackage("stirling.software.common..")
-                        .should()
-                        .dependOnClassesThat()
-                        .resideInAPackage("stirling.software.proprietary..");
-        rule.check(commonClasses);
-    }
-
-    @Test
-    void commonDoesNotDependOnSaas() {
-        ArchRule rule =
-                noClasses()
-                        .that()
-                        .resideInAPackage("stirling.software.common..")
-                        .should()
-                        .dependOnClassesThat()
-                        .resideInAPackage("stirling.software.saas..");
-        rule.check(commonClasses);
-    }
-}

app/common/src/test/java/stirling/software/common/jpdfium/JPDFiumSmokeTest.java

@@ -1,32 +0,0 @@
-package stirling.software.common.jpdfium;
-
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import stirling.software.jpdfium.PdfDocument;
-
-class JPDFiumSmokeTest {
-
-    @Test
-    void opensExamplePdfAndReadsPageCount(@TempDir Path tmp) throws IOException {
-        Path pdf = tmp.resolve("example.pdf");
-        try (InputStream in = getClass().getResourceAsStream("/example.pdf")) {
-            assertNotNull(in, "example.pdf must exist under src/test/resources");
-            Files.copy(in, pdf);
-        }
-
-        try (PdfDocument doc = PdfDocument.open(pdf)) {
-            assertTrue(
-                    doc.pageCount() >= 1,
-                    "PdfDocument should report at least one page for example.pdf");
-        }
-    }
-}

app/common/src/test/java/stirling/software/common/service/FileStorageTest.java

@@ -4,11 +4,8 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.stream.Stream;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -16,8 +13,6 @@ import org.junit.jupiter.api.io.TempDir;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
-import org.springframework.core.io.ByteArrayResource;
-import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.multipart.MultipartFile;
@@ -190,76 +185,4 @@ class FileStorageTest {
         // Assert
         assertFalse(result);
     }
-
-    @Test
-    void storeFromResource_happyPath_persistsContent() throws IOException {
-        // Arrange
-        byte[] payload = "resource-body-bytes".getBytes(StandardCharsets.UTF_8);
-        Resource resource = new ByteArrayResource(payload);
-
-        // Act
-        String fileId = fileStorage.storeFromResource(resource, "whatever.pdf");
-
-        // Assert
-        assertNotNull(fileId);
-        assertTrue(Files.exists(tempDir.resolve(fileId)));
-        assertArrayEquals(payload, fileStorage.retrieveBytes(fileId));
-    }
-
-    @Test
-    void storeFromResource_failureCleansUpPartialFile() throws IOException {
-        // Arrange: a Resource whose getInputStream returns a stream that throws after
-        // emitting a few bytes. The finally block in storeFromResource should remove
-        // the partial file on disk.
-        byte[] head = "partial".getBytes(StandardCharsets.UTF_8);
-        Resource flakyResource =
-                new ByteArrayResource(head) {
-                    @Override
-                    public InputStream getInputStream() {
-                        return new InputStream() {
-                            private int position = 0;
-
-                            @Override
-                            public int read() throws IOException {
-                                if (position < head.length) {
-                                    return head[position++] & 0xFF;
-                                }
-                                throw new IOException("simulated mid-copy read failure");
-                            }
-
-                            @Override
-                            public int read(byte[] b, int off, int len) throws IOException {
-                                if (position >= head.length) {
-                                    throw new IOException("simulated mid-copy read failure");
-                                }
-                                int toCopy = Math.min(len, head.length - position);
-                                System.arraycopy(head, position, b, off, toCopy);
-                                position += toCopy;
-                                return toCopy;
-                            }
-                        };
-                    }
-                };
-
-        // Snapshot dir contents before the call so we can detect any lingering file.
-        long filesBefore;
-        try (Stream<Path> s = Files.list(tempDir)) {
-            filesBefore = s.count();
-        }
-
-        // Act + Assert: IOException must propagate out — not be swallowed.
-        assertThrows(
-                IOException.class, () -> fileStorage.storeFromResource(flakyResource, "n.pdf"));
-
-        // Assert: no partial file lingers under the storage directory — the finally
-        // branch's deleteIfExists must have cleaned it up.
-        long filesAfter;
-        try (Stream<Path> s = Files.list(tempDir)) {
-            filesAfter = s.count();
-        }
-        assertEquals(
-                filesBefore,
-                filesAfter,
-                "partial file must be cleaned up by storeFromResource finally block");
-    }
 }

app/common/src/test/java/stirling/software/common/service/InternalApiClientTest.java

@@ -22,13 +22,11 @@ import org.springframework.mock.env.MockEnvironment;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.client.RequestCallback;
-import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.ResponseExtractor;
 import org.springframework.web.client.RestTemplate;
 
 import jakarta.servlet.ServletContext;
 
-import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 
@@ -44,19 +42,8 @@ class InternalApiClientTest {
     @BeforeEach
     void setUp() {
         lenient().when(servletContext.getContextPath()).thenReturn("");
-        client = newClient();
-    }
-
-    /**
-     * Build a fresh client. Tests that use {@link org.mockito.Mockito#mockConstruction} to
-     * intercept {@link RestTemplate} must call this from inside their {@code mockConstruction}
-     * block, since the client now caches one RestTemplate per instance at construction time.
-     */
-    private InternalApiClient newClient() {
         MockEnvironment environment = new MockEnvironment().withProperty("server.port", "8080");
-        ApplicationProperties applicationProperties = new ApplicationProperties();
-        return new InternalApiClient(
-                servletContext, userService, tempFileManager, environment, applicationProperties);
+        client = new InternalApiClient(servletContext, userService, tempFileManager, environment);
     }
 
     @Test
@@ -88,10 +75,7 @@ class InternalApiClientTest {
                                     .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
                         })) {
 
-            // Reconstruct the client so its cached RestTemplate is the mocked one.
-            InternalApiClient mockedClient = newClient();
-            ResponseEntity<Resource> response =
-                    mockedClient.post("/api/v1/general/merge-pdfs", body);
+            ResponseEntity<Resource> response = client.post("/api/v1/general/merge-pdfs", body);
 
             assertNotNull(response);
             assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -102,123 +86,12 @@ class InternalApiClientTest {
         }
     }
 
-    @Test
-    void postWrapsSocketTimeoutAsInternalApiTimeoutException() {
-        // Simulates the read-timeout case: RestTemplate wraps SocketTimeoutException in
-        // ResourceAccessException when the underlying socket times out. The client must repackage
-        // that into a typed timeout exception that carries the failing endpoint and the configured
-        // read timeout, so the workflow layer can surface a clean "tool didn't respond" message
-        // to the user.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenAnswer(inv -> (RequestCallback) req -> {});
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenThrow(
-                                            new ResourceAccessException(
-                                                    "I/O error on POST request: Read timed out",
-                                                    new java.net.SocketTimeoutException(
-                                                            "Read timed out")));
-                        })) {
-
-            InternalApiClient mockedClient = newClient();
-            InternalApiTimeoutException thrown =
-                    assertThrows(
-                            InternalApiTimeoutException.class,
-                            () -> mockedClient.post("/api/v1/general/merge-pdfs", body));
-
-            assertEquals("/api/v1/general/merge-pdfs", thrown.getEndpointPath());
-            assertNotNull(thrown.getReadTimeout());
-            assertTrue(thrown.getMessage().contains("/api/v1/general/merge-pdfs"));
-        }
-    }
-
-    @Test
-    void postRethrowsNonTimeoutResourceAccessExceptionAsIs() {
-        // ResourceAccessException covers more than just timeouts (e.g. connection refused, DNS
-        // failure). Only SocketTimeoutException-rooted failures are timeouts; everything else
-        // must propagate so the upstream generic handler can label it correctly instead of lying
-        // about a "tool didn't respond" timeout.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenAnswer(inv -> (RequestCallback) req -> {});
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenThrow(
-                                            new ResourceAccessException(
-                                                    "I/O error on POST request: Connection refused",
-                                                    new java.net.ConnectException(
-                                                            "Connection refused")));
-                        })) {
-
-            InternalApiClient mockedClient = newClient();
-            assertThrows(
-                    ResourceAccessException.class,
-                    () -> mockedClient.post("/api/v1/general/merge-pdfs", body));
-        }
-    }
-
     @Test
     void postRejectsDisallowedPath() {
         MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
         assertThrows(SecurityException.class, () -> client.post("/api/v1/admin/settings", body));
     }
 
-    @Test
-    void postRejectsAiEndpointsOutsideToolsSubnamespace() {
-        // /api/v1/ai/orchestrate and other non-tool AI endpoints are not internally
-        // dispatchable. Only /api/v1/ai/tools/* and the general/misc/security/convert/filter
-        // namespaces are on the allowlist — letting a plan step re-enter /orchestrate would
-        // introduce recursion risk.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        assertThrows(SecurityException.class, () -> client.post("/api/v1/ai/orchestrate", body));
-    }
-
-    @Test
-    void postAcceptsAiToolsSubnamespace() throws Exception {
-        // Agent tool paths like /api/v1/ai/tools/pdf-comment-agent are on the allowlist and
-        // should be dispatchable by the orchestrator's plan executor.
-        MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();
-        body.add("fileInput", namedResource("input.pdf", "data"));
-
-        Path tempPath = Files.createTempFile("internal-api-ai-tools-test", ".tmp");
-        TempFile tempFile = mock(TempFile.class);
-        when(tempFile.getPath()).thenReturn(tempPath);
-        when(tempFile.getFile()).thenReturn(tempPath.toFile());
-        when(tempFileManager.createManagedTempFile("internal-api")).thenReturn(tempFile);
-
-        try (var ignored =
-                mockConstruction(
-                        RestTemplate.class,
-                        (rt, ctx) -> {
-                            when(rt.httpEntityCallback(any(), eq(Resource.class)))
-                                    .thenReturn((RequestCallback) req -> {});
-                            when(rt.execute(anyString(), eq(HttpMethod.POST), any(), any()))
-                                    .thenAnswer(inv -> fakeOkResponse(inv.getArgument(3)));
-                        })) {
-
-            // Reconstruct the client so its cached RestTemplate is the mocked one.
-            InternalApiClient mockedClient = newClient();
-            ResponseEntity<Resource> response =
-                    mockedClient.post("/api/v1/ai/tools/pdf-comment-agent", body);
-
-            assertNotNull(response);
-            assertEquals(HttpStatus.OK, response.getStatusCode());
-        } finally {
-            Files.deleteIfExists(tempPath);
-        }
-    }
-
     @Test
     void postRejectsPathTraversal() {
         MultiValueMap<String, Object> body = new LinkedMultiValueMap<>();

app/common/src/test/java/stirling/software/common/service/JobExecutorServiceTest.java

@@ -8,11 +8,9 @@ import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeoutException;
@@ -26,12 +24,7 @@ import org.mockito.Captor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.core.io.ByteArrayResource;
-import org.springframework.core.io.Resource;
-import org.springframework.http.ContentDisposition;
-import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 
 import jakarta.servlet.http.HttpServletRequest;
@@ -187,46 +180,6 @@ class JobExecutorServiceTest {
         verify(spy).runJobGeneric(eq(false), any(Supplier.class), eq(customTimeout));
     }
 
-    @Test
-    void shouldPersistResponseEntityResourceBodyViaFileStorage() throws Exception {
-        // Given: an async job whose result is a ResponseEntity<Resource> — the new
-        // branch added by the stream-to-Resource migration. The executor must route
-        // the body through FileStorage.storeFromResource and then record the result
-        // via TaskManager.setFileResult with the filename/content-type extracted
-        // from the response headers.
-        byte[] payload = "resource-bytes".getBytes(StandardCharsets.UTF_8);
-        Resource resource = new ByteArrayResource(payload);
-
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(MediaType.APPLICATION_PDF);
-        headers.setContentDisposition(
-                ContentDisposition.formData().name("attachment").filename("result.pdf").build());
-
-        Supplier<Object> work = () -> new ResponseEntity<>(resource, headers, HttpStatus.OK);
-
-        when(fileStorage.storeFromResource(any(Resource.class), anyString()))
-                .thenReturn("stored-file-id");
-
-        // When: run the job asynchronously — processJobResult runs on the executor.
-        ResponseEntity<?> response = jobExecutorService.runJobGeneric(true, work);
-
-        // Then: the immediate return must be the JobResponse envelope.
-        assertEquals(HttpStatus.OK, response.getStatusCode());
-        assertInstanceOf(JobResponse.class, response.getBody());
-
-        // Wait for async processing and verify the Resource branch was taken —
-        // FileStorage.storeFromResource was invoked with the same Resource instance,
-        // and TaskManager.setFileResult recorded the extracted filename + content-type.
-        verify(fileStorage, timeout(5000)).storeFromResource(eq(resource), eq("result.pdf"));
-        verify(taskManager, timeout(5000))
-                .setFileResult(
-                        anyString(),
-                        eq("stored-file-id"),
-                        eq("result.pdf"),
-                        eq(MediaType.APPLICATION_PDF_VALUE));
-        verify(taskManager, timeout(5000)).setComplete(anyString());
-    }
-
     @Test
     void shouldHandleTimeout() throws Exception {
         // Given

app/common/src/test/java/stirling/software/common/service/PdfAnnotationServiceTest.java

@@ -1,191 +0,0 @@
-package stirling.software.common.service;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.Loader;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotation;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationText;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import stirling.software.common.model.api.comments.AnnotationLocation;
-import stirling.software.common.model.api.comments.StickyNoteSpec;
-
-class PdfAnnotationServiceTest {
-
-    private PdfAnnotationService service;
-
-    @BeforeEach
-    void setUp() {
-        service = new PdfAnnotationService();
-    }
-
-    @Test
-    void addStickyNotesPlacesOneAnnotationPerValidSpec() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            List<StickyNoteSpec> specs =
-                    List.of(
-                            spec(0, 72f, 700f, "First comment", "alice", null),
-                            spec(1, 100f, 650f, "Second comment", null, "Second"));
-
-            int applied = service.addStickyNotes(doc, specs);
-
-            assertEquals(2, applied);
-            byte[] saved = save(doc);
-            try (PDDocument reloaded = Loader.loadPDF(saved)) {
-                assertEquals(1, textAnnotations(reloaded.getPage(0).getAnnotations()).size());
-                assertEquals(1, textAnnotations(reloaded.getPage(1).getAnnotations()).size());
-
-                PDAnnotationText first =
-                        textAnnotations(reloaded.getPage(0).getAnnotations()).get(0);
-                assertEquals("First comment", first.getContents());
-                assertEquals("alice", first.getTitlePopup(), "author override propagates");
-                assertNotNull(first.getSubject(), "subject falls back to default when null");
-            }
-        }
-    }
-
-    @Test
-    void skipsSpecsWithBlankText() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            List<StickyNoteSpec> specs =
-                    List.of(
-                            spec(0, 72f, 700f, "Valid", null, null),
-                            spec(0, 72f, 680f, "   ", null, null));
-
-            int applied = service.addStickyNotes(doc, specs);
-
-            assertEquals(1, applied, "Blank-text spec must be skipped");
-        }
-    }
-
-    @Test
-    void skipsSpecsWithOutOfRangePageIndex() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            List<StickyNoteSpec> specs =
-                    List.of(
-                            spec(0, 72f, 700f, "OK", null, null),
-                            spec(99, 72f, 700f, "Too far", null, null),
-                            spec(-1, 72f, 700f, "Negative", null, null));
-
-            int applied = service.addStickyNotes(doc, specs);
-
-            assertEquals(1, applied, "Only the in-range spec should be applied");
-        }
-    }
-
-    @Test
-    void handlesNullAndEmptySpecList() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            assertEquals(0, service.addStickyNotes(doc, null));
-            assertEquals(0, service.addStickyNotes(doc, List.of()));
-        }
-    }
-
-    @Test
-    void skipsSpecsWithNonPositiveDimensions() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            StickyNoteSpec zeroWidth =
-                    new StickyNoteSpec(
-                            new AnnotationLocation(0, 72f, 700f, 0f, 20f),
-                            "Zero width",
-                            null,
-                            null);
-            StickyNoteSpec negativeHeight =
-                    new StickyNoteSpec(
-                            new AnnotationLocation(0, 72f, 680f, 20f, -5f),
-                            "Negative height",
-                            null,
-                            null);
-            List<StickyNoteSpec> specs =
-                    List.of(spec(0, 72f, 660f, "OK", null, null), zeroWidth, negativeHeight);
-
-            int applied = service.addStickyNotes(doc, specs);
-
-            assertEquals(1, applied, "Only the positively-sized spec should be applied");
-        }
-    }
-
-    @Test
-    void skipsSpecsWithOverlongText() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            String overlong = "x".repeat(100_001);
-            List<StickyNoteSpec> specs =
-                    List.of(
-                            spec(0, 72f, 700f, "Short", null, null),
-                            spec(0, 72f, 680f, overlong, null, null));
-
-            int applied = service.addStickyNotes(doc, specs);
-
-            assertEquals(1, applied, "Overlong-text spec must be skipped");
-        }
-    }
-
-    @Test
-    void appliesDefaultAuthorAndSubjectWhenAbsent() throws IOException {
-        byte[] bytes = twoPagePdfBytes();
-        try (PDDocument doc = Loader.loadPDF(bytes)) {
-            service.addStickyNote(doc, spec(0, 72f, 700f, "No author given", null, null));
-
-            byte[] saved = save(doc);
-            try (PDDocument reloaded = Loader.loadPDF(saved)) {
-                PDAnnotationText annot =
-                        textAnnotations(reloaded.getPage(0).getAnnotations()).get(0);
-                assertTrue(
-                        annot.getTitlePopup() != null && !annot.getTitlePopup().isBlank(),
-                        "Default author should be applied");
-                assertTrue(
-                        annot.getSubject() != null && !annot.getSubject().isBlank(),
-                        "Default subject should be applied");
-            }
-        }
-    }
-
-    // --- helpers ---
-
-    private static StickyNoteSpec spec(
-            int page, float x, float y, String text, String author, String subject) {
-        return new StickyNoteSpec(
-                new AnnotationLocation(page, x, y, 20f, 20f), text, author, subject);
-    }
-
-    private static byte[] twoPagePdfBytes() throws IOException {
-        try (PDDocument doc = new PDDocument()) {
-            doc.addPage(new PDPage(PDRectangle.A4));
-            doc.addPage(new PDPage(PDRectangle.A4));
-            return save(doc);
-        }
-    }
-
-    private static byte[] save(PDDocument doc) throws IOException {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        doc.save(baos);
-        return baos.toByteArray();
-    }
-
-    private static List<PDAnnotationText> textAnnotations(List<PDAnnotation> annotations) {
-        List<PDAnnotationText> out = new ArrayList<>();
-        for (PDAnnotation a : annotations) {
-            if (a instanceof PDAnnotationText t) {
-                out.add(t);
-            }
-        }
-        return out;
-    }
-}

app/common/src/test/java/stirling/software/common/util/FormUtilsPruneOrphanedFieldsTest.java

@@ -1,229 +0,0 @@
-package stirling.software.common.util;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.Loader;
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDResources;
-import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationWidget;
-import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;
-import org.apache.pdfbox.pdmodel.interactive.form.PDField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDNonTerminalField;
-import org.apache.pdfbox.pdmodel.interactive.form.PDTextField;
-import org.junit.jupiter.api.Test;
-
-class FormUtilsPruneOrphanedFieldsTest {
-
-    @Test
-    void noAcroFormIsNoOp() throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            document.addPage(new PDPage(PDRectangle.A4));
-            FormUtils.pruneOrphanedFormFields(document);
-            assertNull(document.getDocumentCatalog().getAcroForm(null));
-        }
-    }
-
-    @Test
-    void dropsFieldsWhoseWidgetsAreAllOnRemovedPages() throws IOException {
-        byte[] pdfBytes = buildPdfWithFieldPerPage(3);
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(2);
-            document.removePage(0);
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            PDAcroForm form = document.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            List<String> remainingNames = new ArrayList<>();
-            for (PDField field : form.getFields()) {
-                remainingNames.add(field.getPartialName());
-            }
-            assertEquals(List.of("field_1"), remainingNames);
-        }
-    }
-
-    @Test
-    void dropsAcroFormEntirelyWhenNoFieldsSurvive() throws IOException {
-        byte[] pdfBytes = buildPdfWithFieldPerPage(2);
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(1);
-            document.removePage(0);
-            document.addPage(new PDPage(PDRectangle.A4));
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            assertNull(document.getDocumentCatalog().getAcroForm(null));
-        }
-    }
-
-    @Test
-    void keepsLiveWidgetsAndDropsOrphanWidgetsFromMultiWidgetField() throws IOException {
-        byte[] pdfBytes = buildPdfWithMultiWidgetField();
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(0);
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            PDAcroForm form = document.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            assertEquals(1, form.getFields().size());
-            PDField field = form.getFields().get(0);
-            assertEquals("multi", field.getPartialName());
-            assertEquals(2, field.getWidgets().size(), "two widgets remain after one is dropped");
-        }
-    }
-
-    @Test
-    void survivesRoundTripWithoutOrphanPagesInOutput() throws IOException {
-        byte[] pdfBytes = buildPdfWithFieldPerPage(3);
-
-        byte[] writtenBytes;
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(2);
-            document.removePage(1);
-            FormUtils.pruneOrphanedFormFields(document);
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                writtenBytes = out.toByteArray();
-            }
-        }
-
-        try (PDDocument reloaded = Loader.loadPDF(writtenBytes)) {
-            assertEquals(1, reloaded.getNumberOfPages());
-            PDAcroForm form = reloaded.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            assertEquals(1, form.getFields().size());
-            assertEquals("field_0", form.getFields().get(0).getPartialName());
-        }
-    }
-
-    @Test
-    void prunesNestedNonTerminalFields() throws IOException {
-        byte[] pdfBytes = buildPdfWithNestedFields();
-
-        try (PDDocument document = Loader.loadPDF(pdfBytes)) {
-            document.removePage(1);
-
-            FormUtils.pruneOrphanedFormFields(document);
-
-            PDAcroForm form = document.getDocumentCatalog().getAcroForm(null);
-            assertNotNull(form);
-            assertEquals(1, form.getFields().size());
-            PDField group = form.getFields().get(0);
-            assertEquals("group", group.getPartialName());
-            assertTrue(group instanceof PDNonTerminalField);
-            PDNonTerminalField nonTerminal = (PDNonTerminalField) group;
-            assertEquals(1, nonTerminal.getChildren().size());
-            assertEquals("kept", nonTerminal.getChildren().get(0).getPartialName());
-        }
-    }
-
-    private static byte[] buildPdfWithFieldPerPage(int pageCount) throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            PDAcroForm acroForm = new PDAcroForm(document);
-            acroForm.setDefaultResources(new PDResources());
-            document.getDocumentCatalog().setAcroForm(acroForm);
-
-            for (int i = 0; i < pageCount; i++) {
-                PDPage page = new PDPage(PDRectangle.A4);
-                document.addPage(page);
-
-                PDTextField field = new PDTextField(acroForm);
-                field.setPartialName("field_" + i);
-                PDAnnotationWidget widget = new PDAnnotationWidget();
-                widget.setRectangle(new PDRectangle(50, 50, 100, 20));
-                widget.setPage(page);
-                field.setWidgets(List.of(widget));
-                acroForm.getFields().add(field);
-                page.getAnnotations().add(widget);
-            }
-
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                return out.toByteArray();
-            }
-        }
-    }
-
-    private static byte[] buildPdfWithMultiWidgetField() throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            PDAcroForm acroForm = new PDAcroForm(document);
-            acroForm.setDefaultResources(new PDResources());
-            document.getDocumentCatalog().setAcroForm(acroForm);
-
-            List<PDAnnotationWidget> widgets = new ArrayList<>();
-            for (int i = 0; i < 3; i++) {
-                PDPage page = new PDPage(PDRectangle.A4);
-                document.addPage(page);
-                PDAnnotationWidget widget = new PDAnnotationWidget();
-                widget.setRectangle(new PDRectangle(50, 50, 100, 20));
-                widget.setPage(page);
-                page.getAnnotations().add(widget);
-                widgets.add(widget);
-            }
-
-            PDTextField field = new PDTextField(acroForm);
-            field.setPartialName("multi");
-            field.setWidgets(widgets);
-            acroForm.getFields().add(field);
-
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                return out.toByteArray();
-            }
-        }
-    }
-
-    private static byte[] buildPdfWithNestedFields() throws IOException {
-        try (PDDocument document = new PDDocument()) {
-            PDAcroForm acroForm = new PDAcroForm(document);
-            acroForm.setDefaultResources(new PDResources());
-            document.getDocumentCatalog().setAcroForm(acroForm);
-
-            PDPage pageA = new PDPage(PDRectangle.A4);
-            PDPage pageB = new PDPage(PDRectangle.A4);
-            document.addPage(pageA);
-            document.addPage(pageB);
-
-            PDNonTerminalField group = new PDNonTerminalField(acroForm);
-            group.setPartialName("group");
-
-            PDTextField kept = new PDTextField(acroForm);
-            kept.setPartialName("kept");
-            PDAnnotationWidget keptWidget = new PDAnnotationWidget();
-            keptWidget.setRectangle(new PDRectangle(50, 50, 100, 20));
-            keptWidget.setPage(pageA);
-            kept.setWidgets(List.of(keptWidget));
-            pageA.getAnnotations().add(keptWidget);
-
-            PDTextField dropped = new PDTextField(acroForm);
-            dropped.setPartialName("dropped");
-            PDAnnotationWidget droppedWidget = new PDAnnotationWidget();
-            droppedWidget.setRectangle(new PDRectangle(50, 100, 100, 20));
-            droppedWidget.setPage(pageB);
-            dropped.setWidgets(List.of(droppedWidget));
-            pageB.getAnnotations().add(droppedWidget);
-
-            group.setChildren(List.of(kept, dropped));
-            acroForm.getFields().add(group);
-
-            try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
-                document.save(out);
-                return out.toByteArray();
-            }
-        }
-    }
-}

app/common/src/test/java/stirling/software/common/util/PDFToFileTest.java

@@ -25,12 +25,12 @@ import org.junit.jupiter.api.io.TempDir;
 import org.mockito.Mock;
 import org.mockito.MockedStatic;
 import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.mock.web.MockMultipartFile;
 import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import io.github.pixee.security.ZipSecurity;
 
@@ -83,11 +83,9 @@ class PDFToFileTest {
         pdfToFile = new PDFToFile(mockTempFileManager, mockRuntimePathConfig);
     }
 
-    private static byte[] drain(ResponseEntity<Resource> response) throws IOException {
+    private static byte[] drain(ResponseEntity<StreamingResponseBody> response) throws IOException {
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        try (java.io.InputStream __in = response.getBody().getInputStream()) {
-            __in.transferTo(baos);
-        }
+        response.getBody().writeTo(baos);
         return baos.toByteArray();
     }
 
@@ -102,7 +100,7 @@ class PDFToFileTest {
                         "This is not a PDF".getBytes());
 
         // Execute
-        ResponseEntity<Resource> response = pdfToFile.processPdfToMarkdown(nonPdfFile);
+        ResponseEntity<StreamingResponseBody> response = pdfToFile.processPdfToMarkdown(nonPdfFile);
 
         // Verify
         assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
@@ -119,7 +117,7 @@ class PDFToFileTest {
                         "This is not a PDF".getBytes());
 
         // Execute
-        ResponseEntity<Resource> response = pdfToFile.processPdfToHtml(nonPdfFile);
+        ResponseEntity<StreamingResponseBody> response = pdfToFile.processPdfToHtml(nonPdfFile);
 
         // Verify
         assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
@@ -137,7 +135,7 @@ class PDFToFileTest {
                         "This is not a PDF".getBytes());
 
         // Execute
-        ResponseEntity<Resource> response =
+        ResponseEntity<StreamingResponseBody> response =
                 pdfToFile.processPdfToOfficeFormat(nonPdfFile, "docx", "draw_pdf_import");
 
         // Verify
@@ -156,7 +154,7 @@ class PDFToFileTest {
                         "Fake PDF content".getBytes());
 
         // Execute with invalid format
-        ResponseEntity<Resource> response =
+        ResponseEntity<StreamingResponseBody> response =
                 pdfToFile.processPdfToOfficeFormat(pdfFile, "invalid_format", "draw_pdf_import");
 
         // Verify
@@ -207,7 +205,8 @@ class PDFToFileTest {
                             });
 
             // Execute the method
-            ResponseEntity<Resource> response = pdfToFile.processPdfToMarkdown(pdfFile);
+            ResponseEntity<StreamingResponseBody> response =
+                    pdfToFile.processPdfToMarkdown(pdfFile);
 
             // Verify - should now return a ZIP file instead of plain markdown
             assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -299,7 +298,8 @@ class PDFToFileTest {
                             });
 
             // Execute the method
-            ResponseEntity<Resource> response = pdfToFile.processPdfToMarkdown(pdfFile);
+            ResponseEntity<StreamingResponseBody> response =
+                    pdfToFile.processPdfToMarkdown(pdfFile);
 
             // Verify
             assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -377,7 +377,7 @@ class PDFToFileTest {
                             });
 
             // Execute the method
-            ResponseEntity<Resource> response = pdfToFile.processPdfToHtml(pdfFile);
+            ResponseEntity<StreamingResponseBody> response = pdfToFile.processPdfToHtml(pdfFile);
 
             // Verify
             assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -463,7 +463,7 @@ class PDFToFileTest {
                             });
 
             // Execute the method with docx format
-            ResponseEntity<Resource> response =
+            ResponseEntity<StreamingResponseBody> response =
                     pdfToFile.processPdfToOfficeFormat(pdfFile, "docx", "draw_pdf_import");
 
             // Verify
@@ -535,7 +535,7 @@ class PDFToFileTest {
                             });
 
             // Execute the method with ODP format
-            ResponseEntity<Resource> response =
+            ResponseEntity<StreamingResponseBody> response =
                     pdfToFile.processPdfToOfficeFormat(pdfFile, "odp", "draw_pdf_import");
 
             // Verify
@@ -620,7 +620,7 @@ class PDFToFileTest {
                             });
 
             // Execute the method with text format
-            ResponseEntity<Resource> response =
+            ResponseEntity<StreamingResponseBody> response =
                     pdfToFile.processPdfToOfficeFormat(pdfFile, "txt:Text", "draw_pdf_import");
 
             // Verify
@@ -679,7 +679,7 @@ class PDFToFileTest {
                             });
 
             // Execute the method
-            ResponseEntity<Resource> response =
+            ResponseEntity<StreamingResponseBody> response =
                     pdfToFile.processPdfToOfficeFormat(pdfFile, "docx", "draw_pdf_import");
 
             // Verify
@@ -726,7 +726,7 @@ class PDFToFileTest {
                                 return mockExecutorResult;
                             });
 
-            ResponseEntity<Resource> response =
+            ResponseEntity<StreamingResponseBody> response =
                     pdfToFileWithUno.processPdfToOfficeFormat(pdfFile, "docx", "writer_pdf_import");
 
             assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -790,7 +790,7 @@ class PDFToFileTest {
                                 return mockExecutorResult;
                             });
 
-            ResponseEntity<Resource> response =
+            ResponseEntity<StreamingResponseBody> response =
                     pdfToFileWithUno.processPdfToOfficeFormat(pdfFile, "docx", "writer_pdf_import");
 
             assertEquals(HttpStatus.OK, response.getStatusCode());