undo

.github/workflows/multiOSReleases.yml

@@ -1,4 +1,4 @@
-name: Multi-OS Tauri Releases
+name: Test Installers Build
 
 on:
   workflow_dispatch:
@@ -6,23 +6,7 @@ on:
       test_mode:
         description: "Run in test mode (skip release step)"
         required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo, V2-master]
+        default: "false"
   release:
     types: [created]
 
@@ -30,89 +14,60 @@ permissions:
   contents: read
 
 jobs:
-  determine-matrix:
+  read_versions:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
+      versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      - name: Set up JDK
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
+          distribution: 'temurin'
+          java-version: '21'
 
+      # ✅ Get version from Gradle
       - name: Get version number
         id: versionNumber
         run: |
-          echo "Running gradlew printVersion..."
-          ./gradlew printVersion --quiet
           VERSION=$(./gradlew printVersion --quiet | tail -1)
-          echo "Extracted version: $VERSION"
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      # ✅ Get Mac-specific version from Gradle
+      - name: Get version number mac
+        id: versionNumberMac
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          VERSION_MAC=$(./gradlew printMacVersion --quiet | tail -1)
+          echo "versionNumberMac=$VERSION_MAC" >> $GITHUB_OUTPUT
 
-  build-jars:
-    needs: determine-matrix
+  build-portable:
+    needs: read_versions
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        variant:
-          - name: "default"
-            disable_security: true
-            build_frontend: true
-            file_suffix: ""
-          - name: "with-login"
-            disable_security: false
-            build_frontend: true
+        disable_security: [true, false]
+        include:
+          - disable_security: false
             file_suffix: "-with-login"
-          - name: "server-only"
-            disable_security: true
-            build_frontend: false
-            file_suffix: "-server"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           java-version: "21"
           distribution: "temurin"
@@ -121,409 +76,226 @@ jobs:
         with:
           gradle-version: 8.14
 
-      - name: Setup Node.js
-        if: matrix.variant.build_frontend == true
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Build JAR
-        run: ./gradlew clean build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
         env:
-          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.variant.disable_security }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Rename JAR
+      - name: Rename binaries
         run: |
-          echo "Version from determine-matrix: ${{ needs.determine-matrix.outputs.version }}"
-          echo "Looking for: app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar"
-          ls -la app/core/build/libs/
-          mkdir -p ./jar-dist
-          cp app/core/build/libs/stirling-pdf-${{ needs.determine-matrix.outputs.version }}.jar ./jar-dist/Stirling-PDF${{ matrix.variant.file_suffix }}.jar
-
-      - name: Upload JAR artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: jar${{ matrix.variant.file_suffix }}
-          path: ./jar-dist/*.jar
-          retention-days: 1
-
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master')
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on release or V2-master
-          SIGN: ${{ (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || github.ref == 'refs/heads/V2-master') }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
+          mkdir ./binaries
+          mv ./build/launch4j/Stirling-PDF.exe ./binaries/win-Stirling-PDF-portable-Server${{ matrix.file_suffix }}.exe
+          mv ./app/core/build/libs/stirling-pdf-${{ needs.read_versions.outputs.version }}.jar ./binaries/Stirling-PDF${{ matrix.file_suffix }}.jar
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
           retention-days: 1
+          if-no-files-found: error
+          name: stirling${{ matrix.file_suffix }}-binaries
+          path: |
+            ./binaries/*
+
+  sign_verify-portable:
+    needs: [build-portable, read_versions]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "with-login-"
+          - disable_security: true
+            file_suffix: ""
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: stirling-${{ matrix.file_suffix }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: stirling-${{ matrix.file_suffix }}signed
+          path: |
+            ./*
+            !cosign.*
+
+  build-installers:
+    needs: read_versions
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      
+      - name: Set up JDK 21
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      # Install Windows dependencies
+      - name: Install WiX Toolset
+        if: matrix.os == 'windows-latest'
+        run: |
+          curl -L -o wix.exe https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314.exe
+          .\wix.exe /install /quiet
+
+      # Build installer
+      - name: Build Installer
+        run: ./gradlew build jpackage -x test --info
+        env:
+          DISABLE_ADDITIONAL_FEATURES: true
+          STIRLING_PDF_DESKTOP_UI: true
+          BROWSER_OPEN: true
+
+      - name: Set up JDK (x86_64)
+        if: matrix.os == 'macos-latest'
+        run: |
+          curl -L -o jdk.tar.gz https://cdn.azul.com/zulu/bin/zulu17.56.15-ca-jdk17.0.14-macosx_x64.tar.gz
+          mkdir -p zulu17
+          tar -xzf jdk.tar.gz -C zulu17 --strip-components=1
+          echo "JAVA_HOME=$PWD/zulu17" >> $GITHUB_ENV
+          echo "$PWD/zulu17/bin" >> $GITHUB_PATH
+
+      -   name: Verify JDK architecture
+          if: matrix.os == 'macos-latest'
+          run: file $JAVA_HOME/bin/java
+
+      -   name: Build project and run jpackage (x86_64)
+          if: matrix.os == 'macos-latest'
+          run: arch -x86_64 ./gradlew jpackageMacX64
+
+      # Rename and collect artifacts based on OS
+      - name: Prepare artifacts
+        id: prepare
+        shell: bash
+        run: |
+          ls -lah ./build/jpackage/
+          mkdir ./binaries
+          if [ "${{ matrix.os }}" = "windows-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.version }}.exe" "./binaries/Stirling-PDF-win-installer.exe"
+          elif [ "${{ matrix.os }}" = "macos-latest" ]; then
+            mv "./build/jpackage/Stirling PDF-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-installer.dmg"
+            mv "./build/jpackage/x86_64/Stirling PDF (x86_64)-${{ needs.read_versions.outputs.versionMac }}.dmg" "./binaries/Stirling-PDF-mac-x86_64-installer.dmg"
+          else
+            mv "./build/jpackage/stirling-pdf_${{ needs.read_versions.outputs.version }}-1_amd64.deb" "./binaries/Stirling-PDF-linux-installer.deb"
+          fi
+
+      - name: Display structure of downloaded files
+        run: ls -R ./binaries
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}binaries
+          path: |
+            ./binaries/*
+
+  sign_verify:
+    needs: [read_versions, build-installers]
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            platform: win-
+          - os: macos-latest
+            platform: mac-
+          # - os: ubuntu-latest
+          #   platform: linux-
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: ${{ matrix.platform }}binaries
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Install Cosign
+        if: matrix.os == 'windows-latest'
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+
+      - name: Generate key pair
+        if: matrix.os == 'windows-latest'
+        run: cosign generate-key-pair
+
+      - name: Sign and generate attestations
+        if: matrix.os == 'windows-latest'
+        run: |
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./Stirling-PDF-win-installer.exe.intoto.jsonl \
+            ./Stirling-PDF-win-installer.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./Stirling-PDF-win-installer.exe.sig \
+            ./Stirling-PDF-win-installer.exe
+
+      - name: Display structure of downloaded files
+        run: ls -R
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          retention-days: 1
+          if-no-files-found: error
+          name: ${{ matrix.platform }}signed
+          path: |
+            ./Stirling-PDF-${{ matrix.platform }}installer.*
+            ./Stirling-PDF-${{ matrix.platform }}x86_64-installer.*
+            !cosign.*
 
   create-release:
-    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-    needs: [determine-matrix, build, build-jars]
+    if: github.event_name != 'workflow_dispatch' || github.event.inputs.test_mode != 'true'
+    needs: [read_versions, sign_verify, sign_verify-portable]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -533,43 +305,14 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Download all Tauri artifacts
+      - name: Download signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          pattern: Stirling-PDF-*
-          path: ./artifacts/tauri
-
-      - name: Download JAR artifact (default)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (with login)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar-with-login
-          path: ./artifacts/jars
-
-      - name: Download JAR artifact (server only)
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: jar-server
-          path: ./artifacts/jars
-
       - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Upload binaries to Release
+        run: ls -R
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.read_versions.outputs.version }}
           generate_release_notes: true
           files: |
-            ./artifacts/**/*.jar
-            ./artifacts/**/*.msi
-            ./artifacts/**/*.dmg
-            ./artifacts/**/*.deb
-            ./artifacts/**/*.AppImage
-          draft: false
-          prerelease: false
+            ./*signed/*

.github/workflows/push-docker-v2.yml

@@ -1,244 +0,0 @@
-name: Push Docker Image - V2 Branch
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - V2-master
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  push:
-    runs-on: ubuntu-24.04-8core
-    permissions:
-      packages: write
-      id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-        with:
-          gradle-version: 8.14
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-
-      - name: Get version number
-        id: versionNumber
-        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
-
-      - name: Install cosign
-        if: github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
-        with:
-          cosign-release: "v2.4.1"
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Convert repository owner to lowercase
-        id: repoowner
-        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
-
-      - name: Generate tags for latest (V2-master branch - production)
-        id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Generate tags for latest (V2-demo branch - test)
-        id: meta-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
-            type=raw,value=latest
-
-      - name: Build and push Unified Dockerfile (latest variant)
-        id: build-push-latest
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/Dockerfile.unified
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.tags || steps.meta-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta.outputs.labels || steps.meta-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign regular images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-latest.outputs.digest }}
-          TAGS: ${{ steps.meta.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --yes \
-              --key env://COSIGN_PRIVATE_KEY \
-              "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for latest-fat (V2-master branch - production)
-        id: meta-fat
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Generate tags for latest-fat (V2-demo branch - test)
-        id: meta-fat-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
-            type=raw,value=latest-fat
-
-      - name: Build and push Unified Dockerfile (fat variant)
-        id: build-push-fat
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/Dockerfile.unified
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.tags || steps.meta-fat-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-fat.outputs.labels || steps.meta-fat-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign fat images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-fat.outputs.digest }}
-          TAGS: ${{ steps.meta-fat.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done
-
-      - name: Generate tags for ultra-lite (V2-master branch - production)
-        id: meta-lite
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-master'
-        with:
-          images: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/s-pdf
-            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
-            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Generate tags for ultra-lite (V2-demo branch - test)
-        id: meta-lite-test
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/V2-demo'
-        with:
-          images: |
-            ghcr.io/stirling-tools/stirling-pdf-test
-          tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
-            type=raw,value=latest-ultra-lite
-
-      - name: Build and push Unified Dockerfile (ultra-lite variant)
-        id: build-push-lite
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
-        with:
-          builder: ${{ steps.buildx.outputs.name }}
-          context: .
-          file: ./docker/Dockerfile.unified-lite
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.tags || steps.meta-lite-test.outputs.tags }}
-          labels: ${{ github.ref == 'refs/heads/V2-master' && steps.meta-lite.outputs.labels || steps.meta-lite-test.outputs.labels }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64,linux/arm64/v8
-          provenance: true
-          sbom: true
-
-      - name: Sign ultra-lite images
-        if: github.ref == 'refs/heads/V2-master'
-        env:
-          DIGEST: ${{ steps.build-push-lite.outputs.digest }}
-          TAGS: ${{ steps.meta-lite.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-        run: |
-          echo "$TAGS" | tr ',' '\n' | while read -r tag; do
-            cosign sign --key env://COSIGN_PRIVATE_KEY --yes "${tag}@${DIGEST}"
-          done

.github/workflows/releaseArtifacts.yml

@@ -2,445 +2,85 @@ name: Release Artifacts
 
 on:
   workflow_dispatch:
-    inputs:
-      platform:
-        description: "Platform to build (windows, macos, linux, or all)"
-        required: true
-        default: "all"
-        type: choice
-        options:
-          - all
-          - windows
-          - macos
-          - linux
-  push:
-    branches: [main, V2, V2-demo]
+  release:
+    types: [created]
 
 permissions:
   contents: read
 
 jobs:
-  determine-matrix:
+  build:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      - name: Set up JDK 17
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          java-version: "17"
+          distribution: "temurin"
+
+      - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        with:
+          gradle-version: 8.14
+
+      - name: Generate jar (Disable Security=${{ matrix.disable_security }})
+        run: ./gradlew clean createExe
+        env:
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }}
+          STIRLING_PDF_DESKTOP_UI: false
+
       - name: Get version number
         id: versionNumber
         run: |
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Determine build matrix
-        id: set-matrix
+      - name: Rename binaries
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
-              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-                ;;
-            esac
-          else
-            # For push events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target aarch64-apple-darwin","name":"macos-aarch64"},{"platform":"macos-15-intel","args":"--target x86_64-apple-darwin","name":"macos-x86_64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
-          fi
+          mv ./build/launch4j/Stirling-PDF.exe ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+          mv ./build/libs/Stirling-PDF-${{ steps.versionNumber.outputs.versionNumber }}.jar ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-  build:
-    needs: determine-matrix
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.determine-matrix.outputs.matrix) }}
-    runs-on: ${{ matrix.platform }}
-    env:
-      SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04'
+      - name: Debug build artifacts
         run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libjavascriptcoregtk-4.0-dev libsoup2.4-dev libjavascriptcoregtk-4.1-dev libsoup-3.0-dev
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-          targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
-        with:
-          java-version: "21"
-          distribution: "temurin"
-
-      - name: Build Java backend with JLink
-        working-directory: ./
-        shell: bash
-        run: |
-          chmod +x ./gradlew
-          echo "🔧 Building Stirling-PDF JAR..."
-          ./gradlew clean build -x spotlessApply -x spotlessCheck -x test -x sonarqube
-
-          # Find the built JAR
-          STIRLING_JAR=$(ls app/core/build/libs/stirling-pdf-*.jar | head -n 1)
-          echo "✅ Built JAR: $STIRLING_JAR"
-
-          # Create Tauri directories
-          mkdir -p ./frontend/src-tauri/libs
-          mkdir -p ./frontend/src-tauri/runtime
-
-          # Copy JAR to Tauri libs
-          cp "$STIRLING_JAR" ./frontend/src-tauri/libs/
-          echo "✅ JAR copied to Tauri libs"
-
-          # Analyze JAR dependencies for jlink modules
-          echo "🔍 Analyzing JAR dependencies..."
-          if command -v jdeps &> /dev/null; then
-            DETECTED_MODULES=$(jdeps --print-module-deps --ignore-missing-deps "$STIRLING_JAR" 2>/dev/null || echo "")
-            if [ -n "$DETECTED_MODULES" ]; then
-              echo "📋 jdeps detected modules: $DETECTED_MODULES"
-              MODULES="$DETECTED_MODULES,java.compiler,java.instrument,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            else
-              echo "⚠️ jdeps analysis failed, using predefined modules"
-              MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-            fi
-          else
-            echo "⚠️ jdeps not available, using predefined modules"
-            MODULES="java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
-          fi
-
-          # Create custom JRE with jlink
-          echo "🔧 Creating custom JRE with jlink..."
-          echo "📋 Using modules: $MODULES"
-
-          # Remove any existing JRE
-          rm -rf ./frontend/src-tauri/runtime/jre
-
-          # Create the custom JRE
-          jlink \
-            --add-modules "$MODULES" \
-            --strip-debug \
-            --compress=2 \
-            --no-header-files \
-            --no-man-pages \
-            --output ./frontend/src-tauri/runtime/jre
-
-          if [ ! -d "./frontend/src-tauri/runtime/jre" ]; then
-            echo "❌ Failed to create JLink runtime"
-            exit 1
-          fi
-
-          # Test the bundled runtime
-          if [ -f "./frontend/src-tauri/runtime/jre/bin/java" ]; then
-            RUNTIME_VERSION=$(./frontend/src-tauri/runtime/jre/bin/java --version 2>&1 | head -n 1)
-            echo "✅ Custom JRE created successfully: $RUNTIME_VERSION"
-          else
-            echo "❌ Custom JRE executable not found"
-            exit 1
-          fi
-
-          # Calculate runtime size
-          RUNTIME_SIZE=$(du -sh ./frontend/src-tauri/runtime/jre | cut -f1)
-          echo "📊 Custom JRE size: $RUNTIME_SIZE"
-        env:
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Install frontend dependencies
-        working-directory: ./frontend
-        run: npm install
-
-      # DigiCert KeyLocker Setup (Cloud HSM)
-      - name: Setup DigiCert KeyLocker
-        id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        uses: digicert/ssm-code-signing@v1.1.0
-        env:
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-          SM_HOST: ${{ secrets.SM_HOST }}
-
-      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "Setting up DigiCert KeyLocker environment..."
-
-          # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
-          $certPath = "D:\Certificate_pkcs12.p12"
-          [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-          # Set environment variables
-          echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
-
-          # Get PKCS11 config path from DigiCert action
-          $pkcs11Config = $env:PKCS11_CONFIG
-          if ($pkcs11Config) {
-            Write-Host "Found PKCS11_CONFIG: $pkcs11Config"
-            echo "PKCS11_CONFIG=$pkcs11Config" >> $env:GITHUB_ENV
-          } else {
-            Write-Host "PKCS11_CONFIG not set by DigiCert action, using default path"
-            $defaultPath = "C:\Users\RUNNER~1\AppData\Local\Temp\smtools-windows-x64\pkcs11properties.cfg"
-            if (Test-Path $defaultPath) {
-              Write-Host "Found config at default path: $defaultPath"
-              echo "PKCS11_CONFIG=$defaultPath" >> $env:GITHUB_ENV
-            } else {
-              Write-Host "Warning: Could not find PKCS11 config file"
-            }
-          }
-
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
-      - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          echo "Importing Apple Developer Certificate..."
-          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
-          # Create temporary keychain
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Import certificate
-          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          # Clean up
-          rm certificate.p12
-
-      - name: Verify Certificate
-        if: matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel'
-        run: |
-          echo "Verifying Apple Developer Certificate..."
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          CERT_INFO=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application")
-          echo "Certificate Info: $CERT_INFO"
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "Certificate ID: $CERT_ID"
-          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported successfully."
-
-      - name: Build Tauri app
-        uses: tauri-apps/tauri-action@v0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.APPIMAGETOOL_SIGN_PASSPHRASE }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
-          CI: true
-        with:
-          projectPath: ./frontend
-          tauriScript: npx tauri
-          args: ${{ matrix.args }}
-
-      # Sign with DigiCert KeyLocker (post-build)
-      - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
-        shell: pwsh
-        run: |
-          Write-Host "=== DigiCert KeyLocker Signing ==="
-
-          # Test smctl connectivity first
-          Write-Host "Testing smctl connection..."
-          $healthCheck = & smctl healthcheck 2>&1
-          if ($LASTEXITCODE -eq 0) {
-            Write-Host "[SUCCESS] Connected to DigiCert KeyLocker"
-          } else {
-            Write-Host "[ERROR] Failed to connect to DigiCert KeyLocker"
-            Write-Host $healthCheck
-            exit 1
-          }
-          Write-Host ""
-
-          # Sync certificates to Windows certificate store
-          Write-Host "Syncing certificates to Windows certificate store..."
-          $syncOutput = & smctl windows certsync 2>&1
-          Write-Host "Cert sync result: $syncOutput"
-          Write-Host ""
-
-          # Find only the files we need to sign (not build scripts)
-          $filesToSign = @()
-
-          # Main application executable
-          $mainExe = Get-ChildItem -Path "./frontend/src-tauri/target/x86_64-pc-windows-msvc/release" -Filter "stirling-pdf.exe" -File -ErrorAction SilentlyContinue
-          if ($mainExe) { $filesToSign += $mainExe }
-
-          # MSI installer
-          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
-          $filesToSign += $msiFiles
-
-          if ($filesToSign.Count -eq 0) {
-            Write-Host "[ERROR] No files found to sign"
-            exit 1
-          }
-
-          Write-Host "Found $($filesToSign.Count) files to sign:"
-          foreach ($f in $filesToSign) { Write-Host "  - $($f.Name)" }
-          Write-Host ""
-
-          $signedCount = 0
-          foreach ($file in $filesToSign) {
-            Write-Host "Signing: $($file.Name)"
-
-            # Get PKCS11 config file path (set by DigiCert action)
-            $pkcs11Config = $env:PKCS11_CONFIG
-            if (-not $pkcs11Config) {
-              Write-Host "[ERROR] PKCS11_CONFIG environment variable not set"
-              Write-Host "DigiCert KeyLocker action may not have run correctly"
-              exit 1
-            }
-
-            Write-Host "Using PKCS11 config: $pkcs11Config"
-
-            # Try signing with certificate fingerprint first (if available)
-            $fingerprint = "${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}"
-            if ($fingerprint -and $fingerprint -ne "") {
-              Write-Host "Attempting to sign with certificate fingerprint..."
-              $output = & smctl sign --fingerprint "$fingerprint" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            } else {
-              Write-Host "No fingerprint provided, using keypair alias..."
-              # Use smctl to sign with keypair alias
-              $output = & smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$($file.FullName)" --config-file "$pkcs11Config" --verbose 2>&1
-              $exitCode = $LASTEXITCODE
-            }
-
-            Write-Host "Exit code: $exitCode"
-            Write-Host "Output: $output"
-
-            # Check if output contains "FAILED" even with exit code 0
-            if ($output -match "FAILED" -or $output -match "error" -or $output -match "Error") {
-              Write-Host ""
-              Write-Host "[ERROR] Signing failed for $($file.Name)"
-              Write-Host "[ERROR] smctl returned success but output indicates failure"
-              exit 1
-            }
-
-            if ($exitCode -ne 0) {
-              Write-Host "[ERROR] Failed to sign $($file.Name)"
-              Write-Host "Full error output:"
-              Write-Host $output
-              exit 1
-            }
-
-            $signedCount++
-            Write-Host "[SUCCESS] Signed: $($file.Name)"
-            Write-Host ""
-          }
-
-          Write-Host "=== Summary ==="
-          Write-Host "[SUCCESS] Signed $signedCount/$($filesToSign.Count) files successfully"
-
-      - name: Rename artifacts
-        shell: bash
-        run: |
-          mkdir -p ./dist
-          cd ./frontend/src-tauri/target
-
-          # Find and rename artifacts based on platform
-          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.exe" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.exe" \;
-            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
-          elif [ "${{ matrix.platform }}" = "macos-15" ] || [ "${{ matrix.platform }}" = "macos-15-intel" ]; then
-            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
-          else
-            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-          fi
+          echo "Current Directory: $(pwd)"
+          ls -R ./build/libs
+          ls -R ./build/launch4j
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-          path: ./dist/*
-          retention-days: 30
+          name: binaries${{ matrix.file_suffix }}
+          path: |
+            ./build/launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
+            ./build/libs/Stirling-PDF${{ matrix.file_suffix }}.*
 
   sign_verify:
     needs: build
     runs-on: ubuntu-latest
-    if: success()
     strategy:
-      fail-fast: false
       matrix:
-        name: [windows-x86_64, macos-aarch64, macos-x86_64, linux-x86_64]
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -450,8 +90,7 @@ jobs:
       - name: Download build artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: Stirling-PDF-${{ matrix.name }}
-
+          name: binaries${{ matrix.file_suffix }}
       - name: Display structure of downloaded files
         run: ls -R
 
@@ -462,74 +101,80 @@ jobs:
         run: cosign generate-key-pair
 
       - name: Sign and generate attestations
-        shell: bash
         run: |
-          # Sign all artifacts for this platform
-          for file in *; do
-            if [ -f "$file" ] && [[ ! "$file" =~ \.(sig|intoto\.jsonl)$ ]]; then
-              echo "Signing: $file"
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Sign the artifact
-              cosign sign-blob \
-                --key ./cosign.key \
-                --yes \
-                --output-signature "${file}.sig" \
-                "$file"
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.intoto.jsonl \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Generate attestation
-              cosign attest-blob \
-                --predicate - \
-                --key ./cosign.key \
-                --yes \
-                --output-attestation "${file}.intoto.jsonl" \
-                "$file"
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar.sig \
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.jar
 
-              # Verify the signature
-              cosign verify-blob \
-                --key ./cosign.pub \
-                --signature "${file}.sig" \
-                "$file"
+          cosign sign-blob \
+            --key ./cosign.key \
+            --yes \
+            --output-signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
 
-              echo "✅ Signed and verified: $file"
-            fi
-          done
+          cosign attest-blob \
+            --predicate - \
+            --key ./cosign.key \
+            --yes \
+            --output-attestation ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.intoto.jsonl \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
+
+          cosign verify-blob \
+            --key ./cosign.pub \
+            --signature ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe.sig \
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.exe
 
       - name: Upload signed artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Stirling-PDF-${{ matrix.name }}-signed
+          name: signed${{ matrix.file_suffix }}
           path: |
-            *
-            !cosign.key
-            !cosign.pub
-          retention-days: 30
+            ./libs/Stirling-PDF${{ matrix.file_suffix }}.*
+            ./launch4j/Stirling-PDF-Server${{ matrix.file_suffix }}.*
 
   release:
-    needs: [determine-matrix, build, sign_verify]
+    needs: [build, sign_verify]
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
     permissions:
       contents: write
+    strategy:
+      matrix:
+        disable_security: [true, false]
+        include:
+          - disable_security: false
+            file_suffix: "-with-login"
+          - disable_security: true
+            file_suffix: ""
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit
 
-      - name: Download all signed artifacts
+      - name: Download signed artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          pattern: Stirling-PDF-*-signed
-          path: ./artifacts
+          name: signed${{ matrix.file_suffix }}
 
-      - name: Display structure of downloaded files
-        run: ls -R ./artifacts
-
-      - name: Create GitHub Release
+      - name: Upload binaries, attestations and signatures to Release and create GitHub Release
         uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
         with:
-          tag_name: v${{ needs.determine-matrix.outputs.version }}
+          tag_name: v${{ needs.build.outputs.version }}
           generate_release_notes: true
-          files: ./artifacts/**/*
-          draft: false
-          prerelease: false
+          files: |
+            ./libs/Stirling-PDF*
+            ./launch4j/Stirling-PDF-Server*

.github/workflows/tauri-build.yml

@@ -92,6 +92,8 @@ jobs:
           toolchain: stable
           targets: ${{ (matrix.platform == 'macos-15' || matrix.platform == 'macos-15-intel') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
+
+
       - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
@@ -178,7 +180,7 @@ jobs:
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         uses: digicert/ssm-code-signing@v1.1.0
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -188,7 +190,7 @@ jobs:
           SM_HOST: ${{ secrets.SM_HOST }}
 
       - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         shell: pwsh
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
@@ -223,7 +225,7 @@ jobs:
 
       # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
       - name: Import Windows Code Signing Certificate
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' }}
         env:
           WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
           WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -312,8 +314,7 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY }}
           VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL }}
-          # Only enable Windows signing in Tauri when on main
-          SIGN: ${{ github.ref == 'refs/heads/main' && (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
+          SIGN: ${{ (env.SM_API_KEY == '' && env.WINDOWS_CERTIFICATE != '') && '1' || '0' }}
           CI: true
         with:
           projectPath: ./frontend
@@ -322,7 +323,7 @@ jobs:
 
       # Sign with DigiCert KeyLocker (post-build)
       - name: Sign Windows binaries with DigiCert KeyLocker
-        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' }}
         shell: pwsh
         run: |
           Write-Host "=== DigiCert KeyLocker Signing ==="
@@ -513,7 +514,7 @@ jobs:
           fi
 
       - name: Verify Windows Code Signature
-        if: matrix.platform == 'windows-latest' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'windows-latest'
         shell: pwsh
         run: |
           Write-Host "Verifying Windows code signatures..."

.gitignore

@@ -17,8 +17,8 @@ local.properties
 version.properties
 
 #### Stirling-PDF Files ###
-pipeline/
-!pipeline/.gitkeep
+pipeline/watchedFolders/
+pipeline/finishedFolders/
 customFiles/
 configs/
 watchedFolders/
@@ -31,20 +31,6 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 SwaggerDoc.json
 
-# Frontend build artifacts copied to backend static resources
-# These are generated by npm build and should not be committed
-app/core/src/main/resources/static/assets/
-app/core/src/main/resources/static/index.html
-app/core/src/main/resources/static/locales/
-app/core/src/main/resources/static/Login/
-app/core/src/main/resources/static/classic-logo/
-app/core/src/main/resources/static/modern-logo/
-app/core/src/main/resources/static/og_images/
-app/core/src/main/resources/static/samples/
-app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/robots.txt
-# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
-
 # Gradle
 .gradle
 .gradle-home

LICENSE

@@ -6,10 +6,6 @@ Portions of this software are licensed as follows:
 
 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "frontend/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
-* All content that resides under the "frontend/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

README.md

@@ -115,46 +115,46 @@ Stirling-PDF currently supports 40 languages!
 
 | Language                                     | Progress                               |
 | -------------------------------------------- | -------------------------------------- |
-| Arabic (العربية) (ar_AR)                        | ![87%](https://geps.dev/progress/87)   |
-| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![86%](https://geps.dev/progress/86)   |
-| Basque (Euskara) (eu_ES)                     | ![86%](https://geps.dev/progress/86)   |
-| Bulgarian (Български) (bg_BG)                | ![86%](https://geps.dev/progress/86)   |
-| Catalan (Català) (ca_CA)                     | ![85%](https://geps.dev/progress/85)   |
-| Croatian (Hrvatski) (hr_HR)                  | ![86%](https://geps.dev/progress/86)   |
-| Czech (Česky) (cs_CZ)                        | ![84%](https://geps.dev/progress/84)   |
-| Danish (Dansk) (da_DK)                       | ![85%](https://geps.dev/progress/85)   |
-| Dutch (Nederlands) (nl_NL)                   | ![85%](https://geps.dev/progress/85)   |
+| Arabic (العربية) (ar_AR)                        | ![94%](https://geps.dev/progress/94)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![93%](https://geps.dev/progress/93)   |
+| Basque (Euskara) (eu_ES)                     | ![93%](https://geps.dev/progress/93)   |
+| Bulgarian (Български) (bg_BG)                | ![94%](https://geps.dev/progress/94)   |
+| Catalan (Català) (ca_CA)                     | ![93%](https://geps.dev/progress/93)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![93%](https://geps.dev/progress/93)   |
+| Czech (Česky) (cs_CZ)                        | ![91%](https://geps.dev/progress/91)   |
+| Danish (Dansk) (da_DK)                       | ![92%](https://geps.dev/progress/92)   |
+| Dutch (Nederlands) (nl_NL)                   | ![93%](https://geps.dev/progress/93)   |
 | English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
 | English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
-| French (Français) (fr_FR)                    | ![85%](https://geps.dev/progress/85)   |
-| German (Deutsch) (de_DE)                     | ![86%](https://geps.dev/progress/86)   |
-| Greek (Ελληνικά) (el_GR)                     | ![86%](https://geps.dev/progress/86)   |
-| Hindi (हिंदी) (hi_IN)                          | ![86%](https://geps.dev/progress/86)   |
-| Hungarian (Magyar) (hu_HU)                   | ![86%](https://geps.dev/progress/86)   |
-| Indonesian (Bahasa Indonesia) (id_ID)        | ![85%](https://geps.dev/progress/85)   |
-| Irish (Gaeilge) (ga_IE)                      | ![86%](https://geps.dev/progress/86)   |
-| Italian (Italiano) (it_IT)                   | ![85%](https://geps.dev/progress/85)   |
-| Japanese (日本語) (ja_JP)                    | ![86%](https://geps.dev/progress/86)   |
-| Korean (한국어) (ko_KR)                      | ![86%](https://geps.dev/progress/86)   |
-| Norwegian (Norsk) (no_NB)                    | ![86%](https://geps.dev/progress/86)   |
-| Persian (فارسی) (fa_IR)                      | ![86%](https://geps.dev/progress/86)   |
-| Polish (Polski) (pl_PL)                      | ![86%](https://geps.dev/progress/86)   |
-| Portuguese (Português) (pt_PT)               | ![86%](https://geps.dev/progress/86)   |
-| Portuguese Brazilian (Português) (pt_BR)     | ![86%](https://geps.dev/progress/86)   |
-| Romanian (Română) (ro_RO)                    | ![85%](https://geps.dev/progress/85)   |
-| Russian (Русский) (ru_RU)                    | ![86%](https://geps.dev/progress/86)   |
-| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![86%](https://geps.dev/progress/86)   |
-| Simplified Chinese (简体中文) (zh_CN)         | ![87%](https://geps.dev/progress/87)   |
-| Slovakian (Slovensky) (sk_SK)                | ![86%](https://geps.dev/progress/86)   |
-| Slovenian (Slovenščina) (sl_SI)              | ![86%](https://geps.dev/progress/86)   |
-| Spanish (Español) (es_ES)                    | ![86%](https://geps.dev/progress/86)   |
-| Swedish (Svenska) (sv_SE)                    | ![86%](https://geps.dev/progress/86)   |
-| Thai (ไทย) (th_TH)                           | ![86%](https://geps.dev/progress/86)   |
+| French (Français) (fr_FR)                    | ![93%](https://geps.dev/progress/93)   |
+| German (Deutsch) (de_DE)                     | ![93%](https://geps.dev/progress/93)   |
+| Greek (Ελληνικά) (el_GR)                     | ![93%](https://geps.dev/progress/93)   |
+| Hindi (हिंदी) (hi_IN)                          | ![94%](https://geps.dev/progress/94)   |
+| Hungarian (Magyar) (hu_HU)                   | ![94%](https://geps.dev/progress/94)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![93%](https://geps.dev/progress/93)   |
+| Irish (Gaeilge) (ga_IE)                      | ![94%](https://geps.dev/progress/94)   |
+| Italian (Italiano) (it_IT)                   | ![93%](https://geps.dev/progress/93)   |
+| Japanese (日本語) (ja_JP)                    | ![94%](https://geps.dev/progress/94)   |
+| Korean (한국어) (ko_KR)                      | ![94%](https://geps.dev/progress/94)   |
+| Norwegian (Norsk) (no_NB)                    | ![93%](https://geps.dev/progress/93)   |
+| Persian (فارسی) (fa_IR)                      | ![94%](https://geps.dev/progress/94)   |
+| Polish (Polski) (pl_PL)                      | ![93%](https://geps.dev/progress/93)   |
+| Portuguese (Português) (pt_PT)               | ![93%](https://geps.dev/progress/93)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![93%](https://geps.dev/progress/93)   |
+| Romanian (Română) (ro_RO)                    | ![93%](https://geps.dev/progress/93)   |
+| Russian (Русский) (ru_RU)                    | ![94%](https://geps.dev/progress/94)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![93%](https://geps.dev/progress/93)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![94%](https://geps.dev/progress/94)   |
+| Slovakian (Slovensky) (sk_SK)                | ![93%](https://geps.dev/progress/93)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![94%](https://geps.dev/progress/94)   |
+| Spanish (Español) (es_ES)                    | ![94%](https://geps.dev/progress/94)   |
+| Swedish (Svenska) (sv_SE)                    | ![93%](https://geps.dev/progress/93)   |
+| Thai (ไทย) (th_TH)                           | ![93%](https://geps.dev/progress/93)   |
 | Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
-| Traditional Chinese (繁體中文) (zh_TW)        | ![87%](https://geps.dev/progress/87)   |
-| Turkish (Türkçe) (tr_TR)                     | ![86%](https://geps.dev/progress/86)   |
-| Ukrainian (Українська) (uk_UA)               | ![86%](https://geps.dev/progress/86)   |
-| Vietnamese (Tiếng Việt) (vi_VN)              | ![86%](https://geps.dev/progress/86)   |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![94%](https://geps.dev/progress/94)   |
+| Turkish (Türkçe) (tr_TR)                     | ![94%](https://geps.dev/progress/94)   |
+| Ukrainian (Українська) (uk_UA)               | ![94%](https://geps.dev/progress/94)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![93%](https://geps.dev/progress/93)   |
 | Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
 
 ## Stirling PDF Enterprise

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Analysis",
         description =
                 """
-                Read-only inspection of PDFs: page count, page sizes, fonts, form fields, annotations, document properties, and security details.
-                Use these endpoints to understand what's inside a document without changing it.
+                Document analysis and information extraction services for content intelligence and insights.
 
-                Typical uses:
-                • Get page counts and dimensions for layout or print rules
-                • List fonts and annotations to spot compatibility issues
-                • Inspect form fields before deciding how to fill or modify them
-                • Pull metadata and security settings for audits or reports
+                This endpoint group provides analytical capabilities to understand document structure,
+                extract information, and generate insights from PDF content for automated processing.
+
+                Common use cases:
+                • Document inventory management and content audit for compliance verification
+                • Quality assurance workflows and business intelligence analytics
+                • Migration planning, accessibility evaluation, and document forensics
+
+                Business applications:
+                • Legal discovery, financial document review, and healthcare records analysis
+                • Academic research, government processing, and publishing optimization
+
+                Operational scenarios:
+                • Large-scale profiling, migration assessment, and performance optimization
+                • Automated quality control and content strategy development
+
+                Target users: Data analysts, QA teams, administrators, and business intelligence
+                professionals requiring detailed document insights.
                 """)
 public @interface AnalysisApi {}

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Convert",
         description =
                 """
-                Convert PDFs to and from other formats (Word, images, HTML, Markdown, PDF/A, CBZ/CBR, EML, etc.).
-                This group also powers the text-editor / jobId-based editing flow for incremental PDF edits.
+                Document format transformation services for cross-platform compatibility and workflow integration.
 
-                Typical uses:
-                • Turn PDFs into Word or text for editing
-                • Convert office files, images, HTML, or email (EML) into PDFs
-                • Create PDF/A for long-term archiving
-                • Export PDFs as images, HTML, CSV, or Markdown for search, analysis, or reuse
+                This endpoint group enables transformation between various formats, supporting
+                diverse business workflows and system integrations for mixed document ecosystems.
+
+                Common use cases:
+                • Legacy system integration, document migration, and cross-platform sharing
+                • Archive standardization, publishing preparation, and content adaptation
+                • Accessibility compliance and mobile-friendly document preparation
+
+                Business applications:
+                • Enterprise content management, digital publishing, and educational platforms
+                • Legal document processing, healthcare interoperability, and government standardization
+
+                Integration scenarios:
+                • API-driven pipelines, automated workflow preparation, and batch conversions
+                • Real-time format adaptation for user requests
+
+                Target users: System integrators, content managers, digital archivists, and
+                organizations requiring flexible document format interoperability.
                 """)
 public @interface ConvertApi {}

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Filter",
         description =
                 """
-                Check basic properties of PDFs before you process them: page count, file size, page size/rotation, and whether they contain text or images.
-                Use these endpoints as a "pre-check" step to decide what to do with a file next.
+                Document content filtering and search operations for information discovery and organization.
 
-                Typical uses:
-                • Reject files that are too big or too small
-                • Detect image-only PDFs that should go through OCR
-                • Ensure a document has enough pages before it enters a workflow
-                • Check orientation of pages before printing or merging
+                This endpoint group enables intelligent content discovery and organization within
+                document collections for content-based processing and information extraction.
+
+                Common use cases:
+                • Legal discovery, research organization, and compliance auditing
+                • Content moderation, academic research, and business intelligence
+                • Quality assurance and content validation workflows
+
+                Business applications:
+                • Contract analysis, financial review, and healthcare records organization
+                • Government processing, educational curation, and IP protection
+
+                Workflow scenarios:
+                • Large-scale processing, automated classification, and information extraction
+                • Document preparation for further processing or analysis
+
+                Target users: Legal professionals, researchers, compliance officers, and
+                organizations requiring intelligent document content discovery and organization.
                 """)
 public @interface FilterApi {}

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -22,13 +22,21 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "General",
         description =
                 """
-                Page-level PDF editing: split, merge, rotate, crop, rearrange, and scale pages.
-                These endpoints handle most daily "I opened a PDF editor just to…" type tasks.
+                Core PDF processing operations for fundamental document manipulation workflows.
 
-                Typical uses:
-                • Split a large PDF into smaller files (by pages, chapters, or size)
-                • Merge several PDFs into one report or pack
-                • Rotate or reorder pages before sending or archiving
-                • Turn a multi-page document into one long scrolling page
+                This endpoint group provides essential PDF functionality that forms the foundation
+                of most document processing workflows across various industries.
+
+                Common use cases:
+                • Document preparation for archival systems and content organization
+                • File preparation for distribution, accessibility compliance, and batch processing
+                • Document consolidation for reporting and legal compliance workflows
+
+                Typical applications:
+                • Content management, publishing workflows, and educational content distribution
+                • Business process automation and archive management
+
+                Target users: Content managers, document processors, and organizations requiring
+                reliable foundational PDF manipulation capabilities.
                 """)
 public @interface GeneralApi {}

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -22,15 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Misc",
         description =
                 """
-                Tools that don't fit neatly elsewhere: OCR, compress, repair, flatten, extract images, update metadata, add stamps/page numbers/images, and more.
-                These endpoints help fix problem PDFs and prepare them for sharing, storage, or further processing.
+                Specialized utilities and supplementary tools for enhanced document processing workflows.
 
-                Typical uses:
-                • Repair a damaged PDF or remove blank pages
-                • Run OCR on scanned PDFs so they become searchable
-                • Compress large PDFs for email or web download
-                • Extract embedded images or scans
-                • Add page numbers, stamps, or overlay an image (e.g. logo, seal)
-                • Update PDF metadata (title, author, etc.)
+                This endpoint group provides utility operations that support core document processing
+                tasks and address specific workflow needs in real-world scenarios.
+
+                Common use cases:
+                • Document optimization for bandwidth-limited environments and storage cost management
+                • Document repair, content extraction, and validation for quality assurance
+                • Accessibility improvement and custom processing for specialized needs
+
+                Business applications:
+                • Web publishing optimization, email attachment management, and archive efficiency
+                • Mobile compatibility, print production, and legacy document recovery
+
+                Operational scenarios:
+                • Batch processing, quality control, and performance optimization
+                • Troubleshooting and recovery of problematic documents
+
+                Target users: System administrators, document specialists, and organizations requiring
+                specialized document processing and optimization tools.
                 """)
 public @interface MiscApi {}

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -22,12 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Pipeline",
         description =
                 """
-                Run several PDF operations in one configured pipeline instead of calling multiple endpoints yourself.
-                Useful when you always do the same steps in sequence (for example: convert → OCR → compress → watermark).
+                Automated document processing workflows for complex multi-stage business operations.
 
-                Typical uses:
-                • Process incoming invoices in one go (clean, OCR, compress, stamp, etc.)
-                • Normalise documents before they enter an archive
-                • Wrap a complex document flow behind a single API call for your own apps
+                This endpoint group enables organizations to create sophisticated document processing
+                workflows that combine multiple operations into streamlined, repeatable processes.
+
+                Common use cases:
+                • Invoice processing, legal document review, and healthcare records standardization
+                • Government processing, educational content preparation, and publishing automation
+                • Contract lifecycle management and approval processes
+
+                Business applications:
+                • Automated compliance reporting, large-scale migration, and quality assurance
+                • Archive preparation, content delivery, and document approval workflows
+
+                Operational scenarios:
+                • Scheduled batch processing and event-driven document processing
+                • Multi-department coordination and business system integration
+
+                Target users: Business process managers, IT automation specialists, and organizations
+                requiring consistent, repeatable document processing workflows.
                 """)
 public @interface PipelineApi {}

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -22,13 +22,25 @@ import io.swagger.v3.oas.annotations.tags.Tag;
         name = "Security",
         description =
                 """
-                Protect and clean PDFs: passwords, digital signatures, redaction, and sanitizing.
-                These endpoints help you control who can open a file, what they can do with it, and remove sensitive content when needed.
+                Document security and protection services for confidential and sensitive content.
 
-                Typical uses:
-                • Add or remove a password on a PDF
-                • Redact personal or confidential information (manually or automatically)
-                • Validate or remove digital signatures
-                • Sanitize a PDF to strip scripts and embedded content
+                This endpoint group provides essential security operations for organizations handling
+                sensitive documents and materials requiring controlled access.
+
+                Common use cases:
+                • Legal confidentiality, healthcare privacy (HIPAA), and financial regulatory compliance
+                • Government classified handling, corporate IP protection, and educational privacy (FERPA)
+                • Contract security for business transactions
+
+                Business applications:
+                • Document authentication, confidential sharing, and secure archiving
+                • Content watermarking, access control, and privacy protection through redaction
+
+                Industry scenarios:
+                • Legal discovery, medical records exchange, financial audit documentation
+                • Enterprise policy enforcement and data governance
+
+                Target users: Legal professionals, healthcare administrators, compliance officers,
+                government agencies, and enterprises handling sensitive content.
                 """)
 public @interface SecurityApi {}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -590,7 +590,6 @@ public class ApplicationProperties {
             private boolean ssoAutoLogin;
             private boolean database;
             private CustomMetadata customMetadata = new CustomMetadata();
-            private Chatbot chatbot = new Chatbot();
 
             @Data
             public static class CustomMetadata {
@@ -609,61 +608,6 @@ public class ApplicationProperties {
                             : producer;
                 }
             }
-
-            @Data
-            public static class Chatbot {
-                private boolean enabled;
-                private boolean alphaWarning = true;
-                private Cache cache = new Cache();
-                private Models models = new Models();
-                private Rag rag = new Rag();
-                private Ocr ocr = new Ocr();
-                private Audit audit = new Audit();
-                private long maxPromptCharacters = 4000;
-                private double minConfidenceNano = 0.65;
-                private Usage usage = new Usage();
-
-                @Data
-                public static class Cache {
-                    private long ttlMinutes = 720;
-                    private long maxEntries = 200;
-                    private long maxDocumentCharacters = 200000;
-                }
-
-                @Data
-                public static class Models {
-                    private String provider = "openai";
-                    private String primary = "gpt-5-nano";
-                    private String fallback = "gpt-5-mini";
-                    private String embedding = "text-embedding-3-small";
-                    private double topP = 0.95;
-                    private long connectTimeoutMillis = 10000;
-                    private long readTimeoutMillis = 60000;
-                }
-
-                @Data
-                public static class Rag {
-                    private int chunkSizeTokens = 512;
-                    private int chunkOverlapTokens = 128;
-                    private int topK = 8;
-                }
-
-                @Data
-                public static class Ocr {
-                    private boolean enabledByDefault;
-                }
-
-                @Data
-                public static class Audit {
-                    private boolean enabled = true;
-                }
-
-                @Data
-                public static class Usage {
-                    private long perUserMonthlyTokens = 200000;
-                    private double warnAtRatio = 0.7;
-                }
-            }
         }
 
         @Data

app/common/src/main/java/stirling/software/common/service/PersonalSignatureServiceInterface.java

@@ -1,21 +0,0 @@
-package stirling.software.common.service;
-
-import java.io.IOException;
-
-/**
- * Interface for personal signature access (proprietary feature). Implemented only in proprietary
- * module to provide authenticated users access to their personal signatures.
- */
-public interface PersonalSignatureServiceInterface {
-
-    /**
-     * Get a personal signature from the user's folder. Only checks personal folder, not shared
-     * folder.
-     *
-     * @param username Username of the signature owner
-     * @param fileName Signature filename
-     * @return Personal signature image bytes
-     * @throws IOException If file not found or read error
-     */
-    byte[] getPersonalSignatureBytes(String username, String fileName) throws IOException;
-}

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -7,103 +7,23 @@ public class RequestUriUtils {
     }
 
     public static boolean isStaticResource(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // API routes are never static except for the public status endpoint
-        if (normalizedUri.startsWith("/api/")) {
-            return normalizedUri.startsWith("/api/v1/info/status");
-        }
-
-        // Well-known static asset directories (backend + React build artifacts)
-        if (normalizedUri.startsWith("/css/")
-                || normalizedUri.startsWith("/fonts/")
-                || normalizedUri.startsWith("/js/")
-                || normalizedUri.startsWith("/images/")
-                || normalizedUri.startsWith("/public/")
-                || normalizedUri.startsWith("/pdfjs/")
-                || normalizedUri.startsWith("/pdfjs-legacy/")
-                || normalizedUri.startsWith("/assets/")
-                || normalizedUri.startsWith("/locales/")
-                || normalizedUri.startsWith("/Login/")
-                || normalizedUri.startsWith("/samples/")
-                || normalizedUri.startsWith("/classic-logo/")
-                || normalizedUri.startsWith("/modern-logo/")
-                || normalizedUri.startsWith("/og_images/")) {
-            return true;
-        }
-
-        // Specific static files bundled with the frontend
-        if (normalizedUri.equals("/robots.txt")
-                || normalizedUri.equals("/favicon.ico")
-                || normalizedUri.equals("/site.webmanifest")
-                || normalizedUri.equals("/manifest-classic.json")
-                || normalizedUri.equals("/index.html")) {
-            return true;
-        }
-
-        // Login/error pages remain public
-        if (normalizedUri.startsWith("/login") || normalizedUri.startsWith("/error")) {
-            return true;
-        }
-
-        // Treat common static file extensions as static resources
-        return normalizedUri.endsWith(".svg")
-                || normalizedUri.endsWith(".png")
-                || normalizedUri.endsWith(".ico")
-                || normalizedUri.endsWith(".txt")
-                || normalizedUri.endsWith(".webmanifest")
-                || normalizedUri.endsWith(".js")
-                || normalizedUri.endsWith(".css")
-                || normalizedUri.endsWith(".mjs")
-                || normalizedUri.endsWith(".html")
-                || normalizedUri.endsWith(".toml");
-    }
-
-    public static boolean isFrontendRoute(String contextPath, String requestURI) {
-        if (requestURI == null) {
-            return false;
-        }
-
-        String normalizedUri = stripContextPath(contextPath, requestURI);
-
-        // APIs are never treated as frontend routes
-        if (normalizedUri.startsWith("/api/")) {
-            return false;
-        }
-
-        // Blocklist of backend/non-frontend paths that should still go through filters
-        String[] backendOnlyPrefixes = {
-            "/register",
-            "/invite",
-            "/pipeline",
-            "/pdfjs",
-            "/pdfjs-legacy",
-            "/fonts",
-            "/images",
-            "/files",
-            "/css",
-            "/js",
-            "/swagger",
-            "/v1/api-docs",
-            "/actuator"
-        };
-
-        for (String prefix : backendOnlyPrefixes) {
-            if (normalizedUri.equals(prefix) || normalizedUri.startsWith(prefix + "/")) {
-                return false;
-            }
-        }
-
-        if (normalizedUri.isBlank()) {
-            return false;
-        }
-
-        // Allow root and any extensionless path (React Router will handle these)
-        return !normalizedUri.contains(".");
+        return requestURI.startsWith(contextPath + "/css/")
+                || requestURI.startsWith(contextPath + "/fonts/")
+                || requestURI.startsWith(contextPath + "/js/")
+                || requestURI.endsWith(contextPath + "robots.txt")
+                || requestURI.startsWith(contextPath + "/images/")
+                || requestURI.startsWith(contextPath + "/public/")
+                || requestURI.startsWith(contextPath + "/pdfjs/")
+                || requestURI.startsWith(contextPath + "/pdfjs-legacy/")
+                || requestURI.startsWith(contextPath + "/login")
+                || requestURI.startsWith(contextPath + "/error")
+                || requestURI.startsWith(contextPath + "/favicon")
+                || requestURI.endsWith(".svg")
+                || requestURI.endsWith(".png")
+                || requestURI.endsWith(".ico")
+                || requestURI.endsWith(".txt")
+                || requestURI.endsWith(".webmanifest")
+                || requestURI.startsWith(contextPath + "/api/v1/info/status");
     }
 
     public static boolean isTrackableResource(String requestURI) {
@@ -123,7 +43,6 @@ public class RequestUriUtils {
                 || requestURI.endsWith(".svg")
                 || requestURI.endsWith("popularity.txt")
                 || requestURI.endsWith(".js")
-                || requestURI.endsWith(".toml")
                 || requestURI.contains("swagger")
                 || requestURI.startsWith("/api/v1/info")
                 || requestURI.startsWith("/site.webmanifest")
@@ -159,18 +78,9 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith(
                         "/api/v1/proprietary/ui-data/login") // Login page config (SSO providers +
                 // enableLogin)
-                || trimmedUri.startsWith(
-                        "/api/v1/ui-data/footer-info") // Public footer configuration
                 || trimmedUri.startsWith("/v1/api-docs")
                 || trimmedUri.startsWith("/api/v1/invite/validate")
                 || trimmedUri.startsWith("/api/v1/invite/accept")
                 || trimmedUri.contains("/v1/api-docs");
     }
-
-    private static String stripContextPath(String contextPath, String requestURI) {
-        if (contextPath != null && !contextPath.isBlank() && requestURI.startsWith(contextPath)) {
-            return requestURI.substring(contextPath.length());
-        }
-        return requestURI;
-    }
 }

app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java

@@ -49,27 +49,6 @@ public class RequestUriUtilsTest {
                 "API products should not be static");
     }
 
-    @Test
-    void testIsFrontendRoute() {
-        assertTrue(
-                RequestUriUtils.isFrontendRoute("", "/"), "Root path should be a frontend route");
-        assertTrue(
-                RequestUriUtils.isFrontendRoute("", "/app/dashboard"),
-                "React routes without extensions should be frontend routes");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/api/v1/users"),
-                "API routes should not be frontend routes");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/register"),
-                "Register should not be treated as a frontend route");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/pipeline/jobs"),
-                "Pipeline should not be treated as a frontend route");
-        assertFalse(
-                RequestUriUtils.isFrontendRoute("", "/files/download"),
-                "Files path should not be treated as a frontend route");
-    }
-
     @Test
     void testIsStaticResourceWithContextPath() {
         String contextPath = "/myapp";
@@ -104,7 +83,6 @@ public class RequestUriUtilsTest {
                 "/favicon.ico",
                 "/icon.svg",
                 "/image.png",
-                "/locales/en/translation.toml",
                 "/site.webmanifest",
                 "/app/logo.svg",
                 "/downloads/document.png",

app/core/build.gradle

@@ -1,7 +1,5 @@
 apply plugin: 'org.springframework.boot'
 
-import org.apache.tools.ant.taskdefs.condition.Os
-
 repositories {
     maven { url = 'https://build.shibboleth.net/maven/releases' }
     maven { url = 'https://maven.pkg.github.com/jcefmaven/jcefmaven' }
@@ -17,7 +15,6 @@ configurations {
 spotless {
     java {
         target 'src/**/java/**/*.java'
-        targetExclude 'src/main/resources/static/**'
         googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
 
         importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
@@ -28,14 +25,12 @@ spotless {
     }
     yaml {
         target '**/*.yml', '**/*.yaml'
-        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
     }
     format 'gradle', {
         target '**/gradle/*.gradle', '**/*.gradle'
-        targetExclude 'src/main/resources/static/**'
         trimTrailingWhitespace()
         leadingTabsToSpaces()
         endWithNewline()
@@ -162,125 +157,5 @@ springBoot {
     mainClass = 'stirling.software.SPDF.SPDFApplication'
 }
 
-// Frontend build tasks - only enabled with -PbuildWithFrontend=true
-def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
-def frontendDir = file('../../frontend')
-def frontendDistDir = file('../../frontend/dist')
-def resourcesStaticDir = file('src/main/resources/static')
-def generatedFrontendPaths = [
-    'assets',
-    'index.html',
-    'locales',
-    'Login',
-    'classic-logo',
-    'modern-logo',
-    'og_images',
-    'samples',
-    'manifest-classic.json'
-]
-
-tasks.register('npmInstall', Exec) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Install frontend dependencies'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
-    inputs.file(new File(frontendDir, 'package.json'))
-    inputs.file(new File(frontendDir, 'package-lock.json'))
-    outputs.dir(new File(frontendDir, 'node_modules'))
-
-    // Show live output
-    standardOutput = System.out
-    errorOutput = System.err
-
-    // Skip if node_modules exists and is up-to-date
-    onlyIf {
-        def nodeModules = new File(frontendDir, 'node_modules')
-        if (!nodeModules.exists()) {
-            println "node_modules not found, will install..."
-            return true
-        }
-        def packageJson = new File(frontendDir, 'package.json')
-        def packageLock = new File(frontendDir, 'package-lock.json')
-        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
-                        nodeModules.lastModified() < packageLock.lastModified()
-        if (isOutdated) {
-            println "package.json or package-lock.json changed, will reinstall..."
-        } else {
-            println "node_modules is up-to-date, skipping npm install"
-        }
-        return isOutdated
-    }
-
-    doFirst {
-        println "Installing npm dependencies in ${frontendDir}..."
-    }
-}
-
-tasks.register('npmBuild', Exec) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Build frontend application'
-    workingDir frontendDir
-    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'run', 'build'] : ['npm', 'run', 'build']
-    dependsOn npmInstall
-    inputs.dir(new File(frontendDir, 'src'))
-    inputs.file(new File(frontendDir, 'package.json'))
-    outputs.dir(frontendDistDir)
-
-    // Show live output
-    standardOutput = System.out
-    errorOutput = System.err
-
-    // Override VITE_API_BASE_URL to use relative paths for production builds
-    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
-    environment 'VITE_API_BASE_URL', '/'
-
-    doFirst {
-        println "Building frontend application for production (VITE_API_BASE_URL=/)"
-    }
-}
-
-tasks.register('copyFrontendAssets', Copy) {
-    enabled = buildWithFrontend
-    group = 'frontend'
-    description = 'Copy frontend build to static resources'
-    dependsOn npmBuild
-    from(frontendDistDir) {
-        // Exclude files that conflict with backend static resources
-        exclude 'robots.txt'  // Backend already has this
-        exclude 'favicon.ico' // Backend already has this
-    }
-    into resourcesStaticDir
-    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
-    doFirst {
-        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
-        println "Backend static resources will be preserved"
-    }
-    doLast {
-        println "Frontend assets copied successfully!"
-    }
-}
-
-tasks.register('cleanFrontendAssets', Delete) {
-    group = 'frontend'
-    description = 'Remove previously generated frontend assets from static resources'
-    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
-}
-
-// Ensure copyFrontendAssets runs after spotless tasks
-tasks.named('copyFrontendAssets').configure {
-    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
-}
-
-if (buildWithFrontend) {
-    println "Frontend build enabled - JAR will include React frontend"
-    processResources.dependsOn copyFrontendAssets
-} else {
-    println "Frontend build disabled - JAR will be backend-only"
-    // When not building the UI, ensure any stale frontend assets are removed
-    processResources.dependsOn cleanFrontendAssets
-}
-
 bootJar.dependsOn ':common:jar'
 bootJar.dependsOn ':proprietary:jar'

app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java

@@ -25,7 +25,6 @@ public class ExternalAppDepConfig {
     private final String weasyprintPath;
     private final String unoconvPath;
     private final Map<String, List<String>> commandToGroupMapping;
-    private volatile boolean dependenciesChecked = false;
 
     public ExternalAppDepConfig(
             EndpointConfiguration endpointConfiguration, RuntimePathConfig runtimePathConfig) {
@@ -112,10 +111,6 @@ public class ExternalAppDepConfig {
         }
     }
 
-    public boolean isDependenciesChecked() {
-        return dependenciesChecked;
-    }
-
     @PostConstruct
     public void checkDependencies() {
         // Check core dependencies
@@ -167,7 +162,5 @@ public class ExternalAppDepConfig {
             }
         }
         endpointConfiguration.logDisabledEndpointsSummary();
-        dependenciesChecked = true;
-        log.info("Dependency checks completed");
     }
 }

app/core/src/main/java/stirling/software/SPDF/config/SpringDocConfig.java

@@ -21,9 +21,6 @@ public class SpringDocConfig {
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
                         "/api/v1/team/**",
-                        "/api/v1/auth/**",
-                        "/api/v1/invite/**",
-                        "/api/v1/audit/**",
                         "/api/v1/ui-data/**",
                         "/api/v1/proprietary/ui-data/**",
                         "/api/v1/info/**",
@@ -36,7 +33,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - Processing API")
                                             .description(
-                                                    "APIs for converting, editing, securing, and analysing PDF documents. Use these endpoints to automate common PDF tasks (like split, merge, convert, OCR) and plug them into your own apps and backend jobs."));
+                                                    "API documentation for PDF processing operations including conversion, manipulation, security, and utilities."));
                         })
                 .build();
     }
@@ -50,17 +47,14 @@ public class SpringDocConfig {
                         "/api/v1/admin/**",
                         "/api/v1/user/**",
                         "/api/v1/settings/**",
-                        "/api/v1/team/**",
-                        "/api/v1/auth/**",
-                        "/api/v1/invite/**",
-                        "/api/v1/audit/**")
+                        "/api/v1/team/**")
                 .addOpenApiCustomizer(
                         openApi -> {
                             openApi.info(
                                     openApi.getInfo()
-                                            .title("Stirling PDF - Management API")
+                                            .title("Stirling PDF - Admin API")
                                             .description(
-                                                    "Endpoints for authentication, user management, invitations, audit logging, and system configuration."));
+                                                    "API documentation for administrative functions, user management, and system configuration."));
                         })
                 .build();
     }
@@ -82,7 +76,7 @@ public class SpringDocConfig {
                                     openApi.getInfo()
                                             .title("Stirling PDF - System API")
                                             .description(
-                                                    "System information, UI metadata, job status, and file management endpoints."));
+                                                    "API documentation for system information, UI data, and utility endpoints."));
                         })
                 .build();
     }

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -42,7 +42,7 @@ public class WebMvcConfig implements WebMvcConfigurer {
             // Tauri v1 uses tauri://localhost, v2 uses http(s)://tauri.localhost
             logger.info("Tauri mode detected - enabling CORS for Tauri protocols (v1 and v2)");
             registry.addMapping("/**")
-                    .allowedOriginPatterns(
+                    .allowedOrigins(
                             "tauri://localhost",
                             "http://tauri.localhost",
                             "https://tauri.localhost")

app/core/src/main/java/stirling/software/SPDF/controller/api/UIDataController.java

@@ -26,7 +26,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.Dependency;
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.SPDF.service.SignatureService;
 import stirling.software.common.annotations.api.UiDataApi;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
@@ -40,14 +40,14 @@ import stirling.software.common.util.GeneralUtils;
 public class UIDataController {
 
     private final ApplicationProperties applicationProperties;
-    private final SharedSignatureService signatureService;
+    private final SignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public UIDataController(
             ApplicationProperties applicationProperties,
-            SharedSignatureService signatureService,
+            SignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {
@@ -58,21 +58,6 @@ public class UIDataController {
         this.runtimePathConfig = runtimePathConfig;
     }
 
-    @GetMapping("/footer-info")
-    @Operation(summary = "Get public footer configuration data")
-    public ResponseEntity<FooterData> getFooterData() {
-        FooterData data = new FooterData();
-        data.setAnalyticsEnabled(applicationProperties.getSystem().getEnableAnalytics());
-        data.setTermsAndConditions(applicationProperties.getLegal().getTermsAndConditions());
-        data.setPrivacyPolicy(applicationProperties.getLegal().getPrivacyPolicy());
-        data.setAccessibilityStatement(
-                applicationProperties.getLegal().getAccessibilityStatement());
-        data.setCookiePolicy(applicationProperties.getLegal().getCookiePolicy());
-        data.setImpressum(applicationProperties.getLegal().getImpressum());
-
-        return ResponseEntity.ok(data);
-    }
-
     @GetMapping("/home")
     @Operation(summary = "Get home page data")
     public ResponseEntity<HomeData> getHomeData() {
@@ -252,16 +237,6 @@ public class UIDataController {
     }
 
     // Data classes
-    @Data
-    public static class FooterData {
-        private Boolean analyticsEnabled;
-        private String termsAndConditions;
-        private String privacyPolicy;
-        private String accessibilityStatement;
-        private String cookiePolicy;
-        private String impressum;
-    }
-
     @Data
     public static class HomeData {
         private boolean showSurveyFromDocker;

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -35,7 +35,6 @@ public class ConfigController {
     private final EndpointConfiguration endpointConfiguration;
     private final ServerCertificateServiceInterface serverCertificateService;
     private final UserServiceInterface userService;
-    private final stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig;
 
     public ConfigController(
             ApplicationProperties applicationProperties,
@@ -44,14 +43,12 @@ public class ConfigController {
             @org.springframework.beans.factory.annotation.Autowired(required = false)
                     ServerCertificateServiceInterface serverCertificateService,
             @org.springframework.beans.factory.annotation.Autowired(required = false)
-                    UserServiceInterface userService,
-            stirling.software.SPDF.config.ExternalAppDepConfig externalAppDepConfig) {
+                    UserServiceInterface userService) {
         this.applicationProperties = applicationProperties;
         this.applicationContext = applicationContext;
         this.endpointConfiguration = endpointConfiguration;
         this.serverCertificateService = serverCertificateService;
         this.userService = userService;
-        this.externalAppDepConfig = externalAppDepConfig;
     }
 
     @GetMapping("/app-config")
@@ -59,9 +56,6 @@ public class ConfigController {
         Map<String, Object> configData = new HashMap<>();
 
         try {
-            // Add dependency check status
-            configData.put("dependenciesReady", externalAppDepConfig.isDependenciesChecked());
-
             // Get AppConfig bean
             AppConfig appConfig = applicationContext.getBean(AppConfig.class);
 

app/core/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java

@@ -25,7 +25,7 @@ import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.service.SharedSignatureService;
+import stirling.software.SPDF.service.SignatureService;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.service.UserServiceInterface;
@@ -37,13 +37,13 @@ import stirling.software.common.util.GeneralUtils;
 @Slf4j
 public class GeneralWebController {
 
-    private final SharedSignatureService signatureService;
+    private final SignatureService signatureService;
     private final UserServiceInterface userService;
     private final ResourceLoader resourceLoader;
     private final RuntimePathConfig runtimePathConfig;
 
     public GeneralWebController(
-            SharedSignatureService signatureService,
+            SignatureService signatureService,
             @Autowired(required = false) UserServiceInterface userService,
             ResourceLoader resourceLoader,
             RuntimePathConfig runtimePathConfig) {

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,19 +1,16 @@
 package stirling.software.SPDF.controller.web;
 
-import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-@Controller
+// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
 public class ReactRoutingController {
 
-    @GetMapping(
-            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*$}")
+    @GetMapping("/{path:^(?!api|static|robots\\.txt|favicon\\.ico)[^\\.]*$}")
     public String forwardRootPaths() {
         return "forward:/index.html";
     }
 
-    @GetMapping(
-            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    @GetMapping("/{path:^(?!api|static)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
     public String forwardNestedPaths() {
         return "forward:/index.html";
     }

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java

@@ -0,0 +1,48 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import stirling.software.SPDF.service.SignatureService;
+import stirling.software.common.service.UserServiceInterface;
+
+// @Controller // Disabled - Backend-only mode, no Thymeleaf UI
+@RequestMapping("/api/v1/general")
+public class SignatureController {
+
+    private final SignatureService signatureService;
+
+    private final UserServiceInterface userService;
+
+    public SignatureController(
+            SignatureService signatureService,
+            @Autowired(required = false) UserServiceInterface userService) {
+        this.signatureService = signatureService;
+        this.userService = userService;
+    }
+
+    @GetMapping("/sign/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
+            throws IOException {
+        String username = "NON_SECURITY_USER";
+        if (userService != null) {
+            username = userService.getCurrentUsername();
+        }
+        // Verify access permission
+        if (!signatureService.hasAccessToFile(username, fileName)) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
+        return ResponseEntity.ok()
+                .contentType( // Adjust based on file type
+                        MediaType.IMAGE_JPEG)
+                .body(imageBytes);
+    }
+}

app/core/src/main/java/stirling/software/SPDF/controller/web/SignatureImageController.java

@@ -1,84 +0,0 @@
-package stirling.software.SPDF.controller.web;
-
-import java.io.IOException;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.service.SharedSignatureService;
-import stirling.software.common.service.PersonalSignatureServiceInterface;
-import stirling.software.common.service.UserServiceInterface;
-
-/**
- * Unified signature image controller that works for both authenticated and unauthenticated users.
- * Uses composition pattern: - Core SharedSignatureService (always available): reads shared
- * signatures - PersonalSignatureService (proprietary, optional): reads personal signatures For
- * authenticated signature management (save/delete), see proprietary SignatureController.
- */
-@Slf4j
-@RestController
-@RequestMapping("/api/v1/general")
-public class SignatureImageController {
-
-    private final SharedSignatureService sharedSignatureService;
-    private final PersonalSignatureServiceInterface personalSignatureService;
-    private final UserServiceInterface userService;
-
-    public SignatureImageController(
-            SharedSignatureService sharedSignatureService,
-            @Autowired(required = false) PersonalSignatureServiceInterface personalSignatureService,
-            @Autowired(required = false) UserServiceInterface userService) {
-        this.sharedSignatureService = sharedSignatureService;
-        this.personalSignatureService = personalSignatureService;
-        this.userService = userService;
-    }
-
-    /**
-     * Get a signature image (works for both authenticated and unauthenticated users). -
-     * Authenticated with proprietary: tries personal first, then shared - Unauthenticated or
-     * community: tries shared only
-     */
-    @GetMapping("/signatures/{fileName}")
-    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName) {
-        try {
-            byte[] imageBytes = null;
-
-            // If proprietary service available and user authenticated, try personal folder first
-            if (personalSignatureService != null && userService != null) {
-                try {
-                    String username = userService.getCurrentUsername();
-                    imageBytes =
-                            personalSignatureService.getPersonalSignatureBytes(username, fileName);
-                } catch (Exception e) {
-                    // Not found in personal folder or not authenticated, will try shared
-                    log.debug("Personal signature not found, trying shared: {}", e.getMessage());
-                }
-            }
-
-            // If not found in personal (or no personal service), try shared
-            if (imageBytes == null) {
-                imageBytes = sharedSignatureService.getSharedSignatureBytes(fileName);
-            }
-
-            // Determine content type from file extension
-            MediaType contentType = MediaType.IMAGE_PNG; // Default
-            String lowerFileName = fileName.toLowerCase();
-            if (lowerFileName.endsWith(".jpg") || lowerFileName.endsWith(".jpeg")) {
-                contentType = MediaType.IMAGE_JPEG;
-            }
-
-            return ResponseEntity.ok().contentType(contentType).body(imageBytes);
-        } catch (IOException e) {
-            log.debug("Signature not found: {}", fileName);
-            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureRequest.java

@@ -1,18 +0,0 @@
-package stirling.software.SPDF.model.api.signature;
-
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-public class SavedSignatureRequest {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-}

app/core/src/main/java/stirling/software/SPDF/model/api/signature/SavedSignatureResponse.java

@@ -1,22 +0,0 @@
-package stirling.software.SPDF.model.api.signature;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SavedSignatureResponse {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types (or URL to fetch image)
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-    private Long createdAt;
-    private Long updatedAt;
-}

app/core/src/main/java/stirling/software/SPDF/service/SharedSignatureService.java

@@ -1,308 +0,0 @@
-package stirling.software.SPDF.service;
-
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.nio.file.StandardOpenOption;
-import java.util.ArrayList;
-import java.util.Base64;
-import java.util.List;
-import java.util.stream.Stream;
-
-import org.springframework.stereotype.Service;
-import org.springframework.util.StringUtils;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.model.SignatureFile;
-import stirling.software.SPDF.model.api.signature.SavedSignatureRequest;
-import stirling.software.SPDF.model.api.signature.SavedSignatureResponse;
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Service
-@Slf4j
-public class SharedSignatureService {
-
-    private final String SIGNATURE_BASE_PATH;
-    private final String ALL_USERS_FOLDER = "ALL_USERS";
-    private final ObjectMapper objectMapper;
-
-    public SharedSignatureService() {
-        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
-        this.objectMapper = new ObjectMapper();
-    }
-
-    public boolean hasAccessToFile(String username, String fileName) throws IOException {
-        validateFileName(fileName);
-        // Check if file exists in user's personal folder or ALL_USERS folder
-        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-
-        return Files.exists(userPath) || Files.exists(allUsersPath);
-    }
-
-    public List<SignatureFile> getAvailableSignatures(String username) {
-        List<SignatureFile> signatures = new ArrayList<>();
-
-        // Get signatures from user's personal folder
-        if (StringUtils.hasText(username)) {
-            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-            if (Files.exists(userFolder)) {
-                try {
-                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
-                } catch (IOException e) {
-                    log.error("Error reading user signatures folder", e);
-                }
-            }
-        }
-
-        // Get signatures from ALL_USERS folder
-        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(allUsersFolder)) {
-            try {
-                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
-            } catch (IOException e) {
-                log.error("Error reading shared signatures folder", e);
-            }
-        }
-
-        return signatures;
-    }
-
-    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
-            throws IOException {
-        try (Stream<Path> stream = Files.list(folder)) {
-            return stream.filter(this::isImageFile)
-                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
-                    .toList();
-        }
-    }
-
-    /**
-     * Get a signature from the shared (ALL_USERS) folder. This is always available for both
-     * authenticated and unauthenticated users.
-     */
-    public byte[] getSharedSignatureBytes(String fileName) throws IOException {
-        validateFileName(fileName);
-        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
-        if (!Files.exists(allUsersPath)) {
-            throw new FileNotFoundException("Shared signature file not found");
-        }
-        return Files.readAllBytes(allUsersPath);
-    }
-
-    private boolean isImageFile(Path path) {
-        String fileName = path.getFileName().toString().toLowerCase();
-        return fileName.endsWith(".jpg") || fileName.endsWith(".jpeg") || fileName.endsWith(".png");
-    }
-
-    private void validateFileName(String fileName) {
-        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
-            throw new IllegalArgumentException("Invalid filename");
-        }
-        // Only allow alphanumeric, hyphen, underscore, and dot (for extensions)
-        if (!fileName.matches("^[a-zA-Z0-9_.-]+$")) {
-            throw new IllegalArgumentException("Filename contains invalid characters");
-        }
-    }
-
-    private String validateAndNormalizeExtension(String extension) {
-        String normalized = extension.toLowerCase().trim();
-        // Whitelist only safe image extensions
-        if (normalized.equals("png") || normalized.equals("jpg") || normalized.equals("jpeg")) {
-            return normalized;
-        }
-        throw new IllegalArgumentException("Unsupported image extension: " + extension);
-    }
-
-    private void verifyPathWithinDirectory(Path resolvedPath, Path targetDirectory)
-            throws IOException {
-        Path canonicalTarget = targetDirectory.toAbsolutePath().normalize();
-        Path canonicalResolved = resolvedPath.toAbsolutePath().normalize();
-        if (!canonicalResolved.startsWith(canonicalTarget)) {
-            throw new IOException("Resolved path is outside the target directory");
-        }
-    }
-
-    /** Save a signature as image file */
-    public SavedSignatureResponse saveSignature(String username, SavedSignatureRequest request)
-            throws IOException {
-        validateFileName(request.getId());
-
-        // Determine folder based on scope
-        String scope = request.getScope();
-        if (scope == null || scope.isEmpty()) {
-            scope = "personal"; // Default to personal
-        }
-
-        String folderName = "shared".equals(scope) ? ALL_USERS_FOLDER : username;
-        Path targetFolder = Paths.get(SIGNATURE_BASE_PATH, folderName);
-        Files.createDirectories(targetFolder);
-
-        long timestamp = System.currentTimeMillis();
-
-        SavedSignatureResponse response = new SavedSignatureResponse();
-        response.setId(request.getId());
-        response.setLabel(request.getLabel());
-        response.setType(request.getType());
-        response.setScope(scope);
-        response.setCreatedAt(timestamp);
-        response.setUpdatedAt(timestamp);
-
-        // Extract and save image data
-        String dataUrl = request.getDataUrl();
-        if (dataUrl != null && dataUrl.startsWith("data:image/")) {
-            // Extract base64 data
-            String base64Data = dataUrl.substring(dataUrl.indexOf(",") + 1);
-            byte[] imageBytes = Base64.getDecoder().decode(base64Data);
-
-            // Determine and validate file extension from data URL
-            String mimeType = dataUrl.substring(dataUrl.indexOf(":") + 1, dataUrl.indexOf(";"));
-            String rawExtension = mimeType.substring(mimeType.indexOf("/") + 1);
-            String extension = validateAndNormalizeExtension(rawExtension);
-
-            // Save image file only
-            String imageFileName = request.getId() + "." + extension;
-            Path imagePath = targetFolder.resolve(imageFileName);
-
-            // Verify path is within target directory
-            verifyPathWithinDirectory(imagePath, targetFolder);
-
-            Files.write(
-                    imagePath,
-                    imageBytes,
-                    StandardOpenOption.CREATE,
-                    StandardOpenOption.TRUNCATE_EXISTING);
-
-            // Store reference to image file
-            response.setDataUrl("/api/v1/general/sign/" + imageFileName);
-        }
-
-        log.info("Saved signature {} for user {}", request.getId(), username);
-        return response;
-    }
-
-    /** Get all saved signatures for a user */
-    public List<SavedSignatureResponse> getSavedSignatures(String username) throws IOException {
-        List<SavedSignatureResponse> signatures = new ArrayList<>();
-
-        // Load personal signatures
-        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-        if (Files.exists(personalFolder)) {
-            try (Stream<Path> stream = Files.list(personalFolder)) {
-                stream.filter(this::isImageFile)
-                        .forEach(
-                                path -> {
-                                    try {
-                                        String fileName = path.getFileName().toString();
-                                        String id =
-                                                fileName.substring(0, fileName.lastIndexOf('.'));
-
-                                        SavedSignatureResponse sig = new SavedSignatureResponse();
-                                        sig.setId(id);
-                                        sig.setLabel(id); // Use ID as label
-                                        sig.setType("image"); // Default type
-                                        sig.setScope("personal");
-                                        sig.setDataUrl("/api/v1/general/sign/" + fileName);
-                                        sig.setCreatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-                                        sig.setUpdatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-
-                                        signatures.add(sig);
-                                    } catch (IOException e) {
-                                        log.error("Error reading signature file: " + path, e);
-                                    }
-                                });
-            }
-        }
-
-        // Load shared signatures
-        Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-        if (Files.exists(sharedFolder)) {
-            try (Stream<Path> stream = Files.list(sharedFolder)) {
-                stream.filter(this::isImageFile)
-                        .forEach(
-                                path -> {
-                                    try {
-                                        String fileName = path.getFileName().toString();
-                                        String id =
-                                                fileName.substring(0, fileName.lastIndexOf('.'));
-
-                                        SavedSignatureResponse sig = new SavedSignatureResponse();
-                                        sig.setId(id);
-                                        sig.setLabel(id); // Use ID as label
-                                        sig.setType("image"); // Default type
-                                        sig.setScope("shared");
-                                        sig.setDataUrl("/api/v1/general/sign/" + fileName);
-                                        sig.setCreatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-                                        sig.setUpdatedAt(
-                                                Files.getLastModifiedTime(path).toMillis());
-
-                                        signatures.add(sig);
-                                    } catch (IOException e) {
-                                        log.error("Error reading signature file: " + path, e);
-                                    }
-                                });
-            }
-        }
-
-        return signatures;
-    }
-
-    /** Delete a saved signature */
-    public void deleteSignature(String username, String signatureId) throws IOException {
-        validateFileName(signatureId);
-
-        // Try to find and delete image file in personal folder
-        Path personalFolder = Paths.get(SIGNATURE_BASE_PATH, username);
-        boolean deleted = false;
-
-        if (Files.exists(personalFolder)) {
-            try (Stream<Path> stream = Files.list(personalFolder)) {
-                List<Path> matchingFiles =
-                        stream.filter(
-                                        path ->
-                                                path.getFileName()
-                                                        .toString()
-                                                        .startsWith(signatureId + "."))
-                                .toList();
-                for (Path file : matchingFiles) {
-                    Files.delete(file);
-                    deleted = true;
-                }
-            }
-        }
-
-        // Try shared folder if not found in personal
-        if (!deleted) {
-            Path sharedFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
-            if (Files.exists(sharedFolder)) {
-                try (Stream<Path> stream = Files.list(sharedFolder)) {
-                    List<Path> matchingFiles =
-                            stream.filter(
-                                            path ->
-                                                    path.getFileName()
-                                                            .toString()
-                                                            .startsWith(signatureId + "."))
-                                    .toList();
-                    for (Path file : matchingFiles) {
-                        Files.delete(file);
-                        deleted = true;
-                    }
-                }
-            }
-        }
-
-        if (!deleted) {
-            throw new FileNotFoundException("Signature not found");
-        }
-
-        log.info("Deleted signature {} for user {}", signatureId, username);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/service/SignatureService.java

@@ -0,0 +1,107 @@
+package stirling.software.SPDF.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Stream;
+
+import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.SPDF.model.SignatureFile;
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Service
+@Slf4j
+public class SignatureService {
+
+    private final String SIGNATURE_BASE_PATH;
+    private final String ALL_USERS_FOLDER = "ALL_USERS";
+
+    public SignatureService() {
+        SIGNATURE_BASE_PATH = InstallationPathConfig.getSignaturesPath();
+    }
+
+    public boolean hasAccessToFile(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // Check if file exists in user's personal folder or ALL_USERS folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+
+        return Files.exists(userPath) || Files.exists(allUsersPath);
+    }
+
+    public List<SignatureFile> getAvailableSignatures(String username) {
+        List<SignatureFile> signatures = new ArrayList<>();
+
+        // Get signatures from user's personal folder
+        if (StringUtils.hasText(username)) {
+            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+            if (Files.exists(userFolder)) {
+                try {
+                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
+                } catch (IOException e) {
+                    log.error("Error reading user signatures folder", e);
+                }
+            }
+        }
+
+        // Get signatures from ALL_USERS folder
+        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(allUsersFolder)) {
+            try {
+                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
+            } catch (IOException e) {
+                log.error("Error reading shared signatures folder", e);
+            }
+        }
+
+        return signatures;
+    }
+
+    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
+            throws IOException {
+        try (Stream<Path> stream = Files.list(folder)) {
+            return stream.filter(this::isImageFile)
+                    .map(path -> new SignatureFile(path.getFileName().toString(), category))
+                    .toList();
+        }
+    }
+
+    public byte[] getSignatureBytes(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // First try user's personal folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        if (Files.exists(userPath)) {
+            return Files.readAllBytes(userPath);
+        }
+
+        // Then try ALL_USERS folder
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+        if (Files.exists(allUsersPath)) {
+            return Files.readAllBytes(allUsersPath);
+        }
+
+        throw new FileNotFoundException("Signature file not found");
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg")
+                || fileName.endsWith(".jpeg")
+                || fileName.endsWith(".png")
+                || fileName.endsWith(".gif");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+    }
+}

app/core/src/main/resources/application.properties

@@ -4,8 +4,9 @@ logging.level.org.springframework.security=WARN
 logging.level.org.hibernate=WARN
 logging.level.org.eclipse.jetty=WARN
 #logging.level.org.springframework.security.oauth2=DEBUG
+#logging.level.org.springframework.security=DEBUG
 #logging.level.org.opensaml=DEBUG
-logging.level.stirling.software.proprietary.security=DEBUG
+#logging.level.stirling.software.proprietary.security=DEBUG
 logging.level.com.zaxxer.hikari=WARN
 logging.level.stirling.software.SPDF.service.PdfJsonConversionService=INFO
 logging.level.stirling.software.common.service.JobExecutorService=INFO
@@ -51,39 +52,9 @@ server.servlet.session.timeout:30m
 springdoc.api-docs.path=/v1/api-docs
 # Set the URL of the OpenAPI JSON for the Swagger UI
 springdoc.swagger-ui.url=/v1/api-docs
-
-# Spring AI OpenAI Configuration
-# Uses GPT-5-nano as primary model and GPT-5-mini as fallback (configured in settings.yml)
-spring.ai.openai.enabled=true
-#spring.ai.openai.api-key=# todo <API-KEY-HERE>
-spring.ai.openai.base-url=https://api.openai.com
-spring.ai.openai.chat.enabled=true
-spring.ai.openai.chat.options.model=gpt-5-nano
-# Note: Some models only support default temperature value of 1.0
-spring.ai.openai.chat.options.temperature=1.0
-# For newer models, use max-completion-tokens instead of max-tokens
-spring.ai.openai.chat.options.max-completion-tokens=4000
-spring.ai.openai.embedding.enabled=true
-spring.ai.openai.embedding.options.model=text-embedding-ada-002
-# Increase timeout for OpenAI API calls (default is 10 seconds)
-spring.ai.openai.chat.options.connection-timeout=60s
-spring.ai.openai.chat.options.read-timeout=60s
-spring.ai.openai.embedding.options.connection-timeout=60s
-spring.ai.openai.embedding.options.read-timeout=60s
-
-# Spring AI Ollama Configuration (disabled to avoid bean conflicts)
-spring.ai.ollama.enabled=false
-spring.ai.ollama.base-url=http://localhost:11434
-spring.ai.ollama.chat.enabled=false
-spring.ai.ollama.chat.options.model=llama3
-spring.ai.ollama.chat.options.temperature=1.0
-spring.ai.ollama.embedding.enabled=false
-spring.ai.ollama.embedding.options.model=nomic-embed-text
-
+springdoc.swagger-ui.path=/index.html
 # Force OpenAPI 3.0 specification version
-springdoc.swagger-ui.path=/swagger-ui.html
 springdoc.api-docs.version=OPENAPI_3_0
-
 posthog.api.key=phc_fiR65u5j6qmXTYL56MNrLZSWqLaDW74OrZH0Insd2xq
 posthog.host=https://eu.i.posthog.com
 

app/core/src/main/resources/settings.yml.template

@@ -11,7 +11,7 @@
 #############################################################################################################
 
 security:
-  enableLogin: true # set to 'true' to enable login
+  enableLogin: false # set to 'true' to enable login
   csrfDisabled: false # set to 'true' to disable CSRF protection (not recommended for production)
   loginAttemptCount: 5 # lock user account after 5 tries; when using e.g. Fail2Ban you can deactivate the function with -1
   loginResetTimeMinutes: 120 # lock account for 2 hours after x attempts
@@ -91,32 +91,6 @@ premium:
       author: username
       creator: Stirling-PDF
       producer: Stirling-PDF
-    chatbot:
-      enabled: false # Master toggle for Stirling PDF chatbot feature
-      alphaWarning: true # Display alpha-state warning before any processing
-      cache:
-        ttlMinutes: 720 # Cache entry lifetime (12h)
-        maxEntries: 200 # Maximum number of cached documents per node
-        maxDocumentCharacters: 600000 # Reject uploads exceeding this character count
-      models:
-        primary: gpt-5-nano # Default lightweight model
-        fallback: gpt-5-mini # Escalation model for complex prompts
-        embedding: text-embedding-3-small # Embedding model for vector store usage
-        temperature: 0.2 # Sampling temperature for LLM responses
-        topP: 0.95 # Top-p (nucleus) sampling for LLM responses
-      rag:
-        chunkSizeTokens: 512 # Token window used when chunking text
-        chunkOverlapTokens: 128 # Overlap between successive chunks
-        topK: 8 # Number of chunks to retrieve per query
-      ocr:
-        enabledByDefault: false # Whether OCR pre-processing is opted-in automatically
-      audit:
-        enabled: true # Emit audit records for chatbot activity
-      maxPromptCharacters: 4000 # Server-side guardrail for incoming prompts
-      minConfidenceNano: 0.65 # Minimum nano confidence to avoid escalation
-      usage:
-        perUserMonthlyTokens: 200000 # Monthly RAG + chat token budget per user
-        warnAtRatio: 0.7 # Warn users when usage exceeds 70%
   enterpriseFeatures:
     audit:
       enabled: true # Enable audit logging

app/core/src/main/resources/static/css/cookieconsentCustomisation.css

@@ -24,8 +24,8 @@
     --cc-toggle-on-knob-bg: var(--cc-btn-primary-color);
     --cc-toggle-off-knob-bg: var(--cc-btn-primary-color);
 
-    --cc-toggle-enabled-icon-color: var(--cc-btn-primary-color);
-    --cc-toggle-disabled-icon-color: var(--cc-btn-primary-color);
+    --cc-toggle-enabled-icon-color: var(--cc-btn-primary-color);   
+    --cc-toggle-disabled-icon-color: var(--cc-btn-primary-color);  
 
     --cc-toggle-readonly-bg: var(--md-sys-color-surface);
     --cc-toggle-readonly-knob-bg: var(--md-sys-color-outline);
@@ -34,10 +34,10 @@
     --cc-section-category-border: var(--md-sys-color-outline);
 
     --cc-cookie-category-block-bg: var(--cc-btn-secondary-bg);
-    --cc-cookie-category-block-border: var(--cc-btn-secondary-bg);
+    --cc-cookie-category-block-border: var(--cc-btn-secondary-bg); 
     --cc-cookie-category-block-hover-bg: var(--cc-btn-secondary-bg);
     --cc-cookie-category-block-hover-border: var(--cc-btn-secondary-bg);
-
+    
     --cc-cookie-category-expanded-block-bg: var(--cc-btn-secondary-bg);
     --cc-cookie-category-expanded-block-hover-bg: var(--cc-toggle-readonly-bg);
 
@@ -47,7 +47,7 @@
 */
     --cc-footer-bg: var(--cc-bg);
     --cc-footer-color: var(--cc-primary-color);
-    --cc-footer-border-color: var(--cc-bg);
+    --cc-footer-border-color: var(--cc-bg); 
 }
 .cm__body{
     max-width: 90% !important;
@@ -76,9 +76,4 @@
     .cm__btns{
         padding-top: 1rem !important;
     }
-}
-
-/* Lower z-index so cookie banner appears behind onboarding modals */
-#cc-main {
-    z-index: 100 !important;
-}
+}

app/core/src/test/java/stirling/software/SPDF/service/SignatureServiceTest.java

@@ -23,7 +23,7 @@ import stirling.software.common.configuration.InstallationPathConfig;
 class SignatureServiceTest {
 
     @TempDir Path tempDir;
-    private SharedSignatureService signatureService;
+    private SignatureService signatureService;
     private Path personalSignatureFolder;
     private Path sharedSignatureFolder;
     private final String ALL_USERS_FOLDER = "ALL_USERS";
@@ -53,7 +53,7 @@ class SignatureServiceTest {
                     .thenReturn(tempDir.toString());
 
             // Initialize the service with our temp directory
-            signatureService = new SharedSignatureService();
+            signatureService = new SignatureService();
         }
     }
 
@@ -165,7 +165,7 @@ class SignatureServiceTest {
     }
 
     @Test
-    void testGetSharedSignatureBytes_SharedFile() throws IOException {
+    void testGetSignatureBytes_PersonalFile() throws IOException {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -173,8 +173,28 @@ class SignatureServiceTest {
                     .when(InstallationPathConfig::getSignaturesPath)
                     .thenReturn(tempDir.toString());
 
-            // Test - core service only reads shared signatures
-            byte[] bytes = signatureService.getSharedSignatureBytes("shared.jpg");
+            // Test
+            byte[] bytes = signatureService.getSignatureBytes(TEST_USER, "personal.png");
+
+            // Verify
+            assertEquals(
+                    "personal signature content",
+                    new String(bytes),
+                    "Should return the correct content for personal file");
+        }
+    }
+
+    @Test
+    void testGetSignatureBytes_SharedFile() throws IOException {
+        // Mock static method for each test
+        try (MockedStatic<InstallationPathConfig> mockedConfig =
+                mockStatic(InstallationPathConfig.class)) {
+            mockedConfig
+                    .when(InstallationPathConfig::getSignaturesPath)
+                    .thenReturn(tempDir.toString());
+
+            // Test
+            byte[] bytes = signatureService.getSignatureBytes(TEST_USER, "shared.jpg");
 
             // Verify
             assertEquals(
@@ -185,7 +205,7 @@ class SignatureServiceTest {
     }
 
     @Test
-    void testGetSharedSignatureBytes_FileNotFound() {
+    void testGetSignatureBytes_FileNotFound() {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -196,13 +216,13 @@ class SignatureServiceTest {
             // Test and verify
             assertThrows(
                     FileNotFoundException.class,
-                    () -> signatureService.getSharedSignatureBytes("nonexistent.png"),
+                    () -> signatureService.getSignatureBytes(TEST_USER, "nonexistent.png"),
                     "Should throw exception for non-existent files");
         }
     }
 
     @Test
-    void testGetSharedSignatureBytes_InvalidFileName() {
+    void testGetSignatureBytes_InvalidFileName() {
         // Mock static method for each test
         try (MockedStatic<InstallationPathConfig> mockedConfig =
                 mockStatic(InstallationPathConfig.class)) {
@@ -213,28 +233,11 @@ class SignatureServiceTest {
             // Test and verify
             assertThrows(
                     IllegalArgumentException.class,
-                    () -> signatureService.getSharedSignatureBytes("../invalid.png"),
+                    () -> signatureService.getSignatureBytes(TEST_USER, "../invalid.png"),
                     "Should throw exception for file names with directory traversal");
         }
     }
 
-    @Test
-    void testGetSharedSignatureBytes_CannotAccessPersonalFiles() {
-        // Mock static method for each test
-        try (MockedStatic<InstallationPathConfig> mockedConfig =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedConfig
-                    .when(InstallationPathConfig::getSignaturesPath)
-                    .thenReturn(tempDir.toString());
-
-            // Test and verify - core service should NOT be able to read personal files
-            assertThrows(
-                    FileNotFoundException.class,
-                    () -> signatureService.getSharedSignatureBytes("personal.png"),
-                    "Core service should not have access to personal signatures");
-        }
-    }
-
     @Test
     void testGetAvailableSignatures_EmptyUsername() throws IOException {
         // Mock static method for each test

app/proprietary/build.gradle

@@ -41,8 +41,6 @@ dependencies {
     api 'org.springframework:spring-webmvc'
     api 'org.springframework.session:spring-session-core'
     api "org.springframework.security:spring-security-core:$springSecuritySamlVersion"
-    api "org.springframework.security:spring-security-web:$springSecuritySamlVersion"
-    api "org.springframework.security:spring-security-config:$springSecuritySamlVersion"
     api "org.springframework.security:spring-security-saml2-service-provider:$springSecuritySamlVersion"
     api 'org.springframework.boot:spring-boot-starter-jetty'
     api 'org.springframework.boot:spring-boot-starter-security'
@@ -52,16 +50,12 @@ dependencies {
     api 'org.springframework.boot:spring-boot-starter-cache'
     api 'com.github.ben-manes.caffeine:caffeine'
     api 'io.swagger.core.v3:swagger-core-jakarta:2.2.38'
-    implementation 'org.springframework.ai:spring-ai-starter-model-openai'
-    implementation 'org.springframework.ai:spring-ai-starter-model-ollama'
-    implementation 'org.springframework.ai:spring-ai-starter-vector-store-redis'
-    implementation 'redis.clients:jedis:5.1.0'
     implementation 'com.bucket4j:bucket4j_jdk17-core:8.15.0'
 
     // https://mvnrepository.com/artifact/com.bucket4j/bucket4j_jdk17
     implementation 'org.bouncycastle:bcprov-jdk18on:1.82'
 
-    // implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5:3.1.3.RELEASE' // Removed - UI moved to React frontend
+    implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5:3.1.3.RELEASE'
     api 'io.micrometer:micrometer-registry-prometheus'
     implementation 'com.unboundid.product.scim2:scim2-sdk-client:4.0.0'
 

app/proprietary/src/main/java/stirling/software/proprietary/config/ChatbotRedisConfig.java

@@ -1,102 +0,0 @@
-package stirling.software.proprietary.config;
-
-import org.apache.commons.pool2.impl.GenericObjectPoolConfig;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
-import lombok.extern.slf4j.Slf4j;
-
-import redis.clients.jedis.Connection;
-import redis.clients.jedis.DefaultJedisClientConfig;
-import redis.clients.jedis.HostAndPort;
-import redis.clients.jedis.JedisClientConfig;
-import redis.clients.jedis.JedisPooled;
-
-@Configuration
-@ConditionalOnProperty(value = "premium.proFeatures.chatbot.enabled", havingValue = "true")
-@Slf4j
-public class ChatbotRedisConfig {
-
-    @Value("${spring.data.redis.host:localhost}")
-    private String redisHost;
-
-    @Value("${spring.data.redis.port:6379}")
-    private int redisPort;
-
-    @Value("${spring.data.redis.password:}")
-    private String redisPassword;
-
-    @Value("${spring.data.redis.timeout:60000}")
-    private int redisTimeout;
-
-    @Value("${spring.data.redis.ssl.enabled:false}")
-    private boolean sslEnabled;
-
-    @Bean
-    public JedisPooled jedisPooled() {
-        try {
-            log.info("Creating JedisPooled connection to {}:{}", redisHost, redisPort);
-
-            // Create pool configuration
-            GenericObjectPoolConfig<Connection> poolConfig = new GenericObjectPoolConfig<>();
-            poolConfig.setMaxTotal(50);
-            poolConfig.setMaxIdle(25);
-            poolConfig.setMinIdle(5);
-            poolConfig.setTestOnBorrow(true);
-            poolConfig.setTestOnReturn(true);
-            poolConfig.setTestWhileIdle(true);
-
-            // Create host and port configuration
-            HostAndPort hostAndPort = new HostAndPort(redisHost, redisPort);
-
-            // Create client configuration with authentication if password is provided
-            JedisClientConfig clientConfig;
-            if (redisPassword != null && !redisPassword.trim().isEmpty()) {
-                clientConfig =
-                        DefaultJedisClientConfig.builder()
-                                .password(redisPassword)
-                                .connectionTimeoutMillis(redisTimeout)
-                                .socketTimeoutMillis(redisTimeout)
-                                .ssl(sslEnabled)
-                                .build();
-            } else {
-                clientConfig =
-                        DefaultJedisClientConfig.builder()
-                                .connectionTimeoutMillis(redisTimeout)
-                                .socketTimeoutMillis(redisTimeout)
-                                .ssl(sslEnabled)
-                                .build();
-            }
-
-            // Create JedisPooled with configuration
-            JedisPooled jedisPooled = new JedisPooled(poolConfig, hostAndPort, clientConfig);
-
-            // Test the connection
-            try {
-                jedisPooled.ping();
-                log.info("Successfully connected to Redis at {}:{}", redisHost, redisPort);
-            } catch (Exception pingException) {
-                log.warn(
-                        "Redis ping failed at {}:{} - {}. Redis might be unavailable.",
-                        redisHost,
-                        redisPort,
-                        pingException.getMessage());
-                // Close the pool if ping fails
-                try {
-                    jedisPooled.close();
-                } catch (Exception closeException) {
-                    // Ignore close exceptions
-                }
-                return null;
-            }
-
-            return jedisPooled;
-        } catch (Exception e) {
-            log.error("Failed to create JedisPooled connection", e);
-            // Return null to fall back to SimpleVectorStore
-            return null;
-        }
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/config/ChatbotVectorStoreConfig.java

@@ -1,52 +0,0 @@
-package stirling.software.proprietary.config;
-
-import org.springframework.ai.embedding.EmbeddingModel;
-import org.springframework.ai.vectorstore.SimpleVectorStore;
-import org.springframework.ai.vectorstore.VectorStore;
-import org.springframework.ai.vectorstore.redis.RedisVectorStore;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Primary;
-
-import lombok.extern.slf4j.Slf4j;
-
-import redis.clients.jedis.JedisPooled;
-
-@Configuration
-@ConditionalOnProperty(value = "premium.proFeatures.chatbot.enabled", havingValue = "true")
-@Slf4j
-public class ChatbotVectorStoreConfig {
-
-    private static final String DEFAULT_INDEX = "stirling-chatbot-index";
-    private static final String DEFAULT_PREFIX = "stirling:chatbot:";
-
-    @Bean
-    @Primary
-    public VectorStore chatbotVectorStore(
-            @Autowired(required = false) JedisPooled jedisPooled, EmbeddingModel embeddingModel) {
-        if (jedisPooled != null) {
-            try {
-                log.info("Initialising Redis vector store for chatbot usage");
-                return RedisVectorStore.builder(jedisPooled, embeddingModel)
-                        .indexName(DEFAULT_INDEX)
-                        .prefix(DEFAULT_PREFIX)
-                        .initializeSchema(true)
-                        .build();
-            } catch (RuntimeException ex) {
-                log.warn(
-                        "Redis vector store unavailable ({}). Falling back to SimpleVectorStore.",
-                        sanitize(ex.getMessage()));
-            }
-        } else {
-            log.info("No Redis connection detected; using SimpleVectorStore for chatbot.");
-        }
-
-        return SimpleVectorStore.builder(embeddingModel).build();
-    }
-
-    private String sanitize(String message) {
-        return message == null ? "unknown error" : message.replaceAll("\\s+", " ").trim();
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/config/SpringAIConfig.java

@@ -1,82 +0,0 @@
-package stirling.software.proprietary.config;
-
-import java.time.Duration;
-
-import org.springframework.ai.chat.model.ChatModel;
-import org.springframework.ai.embedding.EmbeddingModel;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.boot.web.client.RestTemplateBuilder;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Primary;
-import org.springframework.http.client.SimpleClientHttpRequestFactory;
-import org.springframework.web.client.RestClient;
-import org.springframework.web.client.RestTemplate;
-
-import lombok.extern.slf4j.Slf4j;
-
-/**
- * Spring AI Configuration for Stirling PDF Chatbot
- *
- * <p>This configuration enables Spring AI auto-configuration for chatbot features. The actual
- * ChatModel and EmbeddingModel beans are provided by Spring Boot's auto-configuration based on the
- * spring.ai.* properties in application-proprietary.properties
- *
- * <p>For OpenAI: - spring.ai.openai.enabled=true - spring.ai.openai.api-key=your-api-key
- *
- * <p>For Ollama (as fallback): - spring.ai.ollama.enabled=true -
- * spring.ai.ollama.base-url=http://localhost:11434
- */
-@Configuration
-@Slf4j
-public class SpringAIConfig {
-
-    public SpringAIConfig() {
-        log.info("Spring AI Configuration enabled for Stirling PDF Chatbot");
-        log.info(
-                "ChatModel and EmbeddingModel beans will be auto-configured based on spring.ai.* properties");
-    }
-
-    /** Primary ChatModel bean that delegates to OpenAI's auto-configured bean */
-    @Bean
-    @Primary
-    public ChatModel primaryChatModel(@Qualifier("openAiChatModel") ChatModel openAiChatModel) {
-        log.info("Using OpenAI ChatModel as primary");
-        return openAiChatModel;
-    }
-
-    /** Primary EmbeddingModel bean that delegates to OpenAI's auto-configured bean */
-    @Bean
-    @Primary
-    public EmbeddingModel primaryEmbeddingModel(
-            @Qualifier("openAiEmbeddingModel") EmbeddingModel openAiEmbeddingModel) {
-        log.info("Using OpenAI EmbeddingModel as primary");
-        return openAiEmbeddingModel;
-    }
-
-    /**
-     * Custom RestTemplate for Spring AI OpenAI client with increased timeouts. This helps prevent
-     * timeout errors when processing large documents or complex queries.
-     */
-    @Bean(name = "openAiRestTemplate")
-    public RestTemplate openAiRestTemplate(RestTemplateBuilder builder) {
-        log.info("Creating custom RestTemplate for OpenAI with 60s timeouts");
-        return builder.connectTimeout(Duration.ofSeconds(60))
-                .readTimeout(Duration.ofSeconds(60))
-                .build();
-    }
-
-    /**
-     * Custom RestClient for Spring AI OpenAI with increased timeouts. Spring AI 1.0.3+ prefers
-     * RestClient over RestTemplate.
-     */
-    @Bean(name = "openAiRestClient")
-    public RestClient openAiRestClient() {
-        log.info("Creating custom RestClient for OpenAI with 60s timeouts");
-        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
-        factory.setConnectTimeout(Duration.ofSeconds(60));
-        factory.setReadTimeout(Duration.ofSeconds(60));
-
-        return RestClient.builder().requestFactory(factory).build();
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/configuration/ChatbotAiClientConfiguration.java

@@ -1,60 +0,0 @@
-package stirling.software.proprietary.configuration;
-
-import java.net.http.HttpClient;
-import java.time.Duration;
-import java.util.Optional;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.web.client.RestClientCustomizer;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.http.client.JdkClientHttpRequestFactory;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.Premium;
-import stirling.software.common.model.ApplicationProperties.Premium.ProFeatures;
-import stirling.software.common.model.ApplicationProperties.Premium.ProFeatures.Chatbot;
-
-@Configuration
-@ConditionalOnClass(RestClientCustomizer.class)
-@ConditionalOnProperty(value = "spring.ai.openai.enabled", havingValue = "true")
-public class ChatbotAiClientConfiguration {
-
-    @Bean
-    public RestClientCustomizer chatbotRestClientCustomizer(
-            ApplicationProperties applicationProperties) {
-        long connectTimeout = resolveConnectTimeout(applicationProperties);
-        long readTimeout = resolveReadTimeout(applicationProperties);
-        return builder -> builder.requestFactory(createRequestFactory(connectTimeout, readTimeout));
-    }
-
-    private JdkClientHttpRequestFactory createRequestFactory(
-            long connectTimeoutMillis, long readTimeoutMillis) {
-        HttpClient httpClient =
-                HttpClient.newBuilder()
-                        .connectTimeout(Duration.ofMillis(connectTimeoutMillis))
-                        .build();
-        JdkClientHttpRequestFactory factory = new JdkClientHttpRequestFactory(httpClient);
-        factory.setReadTimeout((int) readTimeoutMillis);
-        return factory;
-    }
-
-    private long resolveConnectTimeout(ApplicationProperties properties) {
-        long configured = resolveChatbot(properties).getModels().getConnectTimeoutMillis();
-        return configured > 0 ? configured : 30000L;
-    }
-
-    private long resolveReadTimeout(ApplicationProperties properties) {
-        long configured = resolveChatbot(properties).getModels().getReadTimeoutMillis();
-        return configured > 0 ? configured : 120000L;
-    }
-
-    private Chatbot resolveChatbot(ApplicationProperties properties) {
-        return Optional.ofNullable(properties)
-                .map(ApplicationProperties::getPremium)
-                .map(Premium::getProFeatures)
-                .map(ProFeatures::getChatbot)
-                .orElseGet(Chatbot::new);
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/controller/ChatbotController.java

@@ -1,126 +0,0 @@
-package stirling.software.proprietary.controller;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.proprietary.model.chatbot.ChatbotQueryRequest;
-import stirling.software.proprietary.model.chatbot.ChatbotResponse;
-import stirling.software.proprietary.model.chatbot.ChatbotSession;
-import stirling.software.proprietary.model.chatbot.ChatbotSessionCreateRequest;
-import stirling.software.proprietary.model.chatbot.ChatbotSessionResponse;
-import stirling.software.proprietary.model.chatbot.ChatbotUsageSummary;
-import stirling.software.proprietary.service.chatbot.ChatbotCacheService;
-import stirling.software.proprietary.service.chatbot.ChatbotFeatureProperties;
-import stirling.software.proprietary.service.chatbot.ChatbotFeatureProperties.ChatbotSettings;
-import stirling.software.proprietary.service.chatbot.ChatbotService;
-import stirling.software.proprietary.service.chatbot.ChatbotSessionRegistry;
-import stirling.software.proprietary.service.chatbot.exception.ChatbotException;
-
-@Slf4j
-@RestController
-@RequiredArgsConstructor
-@RequestMapping("/api/v1/internal/chatbot")
-public class ChatbotController {
-
-    private final ChatbotService chatbotService;
-    private final ChatbotSessionRegistry sessionRegistry;
-    private final ChatbotCacheService cacheService;
-    private final ChatbotFeatureProperties featureProperties;
-
-    @PostMapping("/session")
-    public ResponseEntity<ChatbotSessionResponse> createSession(
-            @RequestBody ChatbotSessionCreateRequest request) {
-        ChatbotSession session = chatbotService.createSession(request);
-        ChatbotSettings settings = featureProperties.current();
-        ChatbotSessionResponse response = toResponse(session, settings);
-        return ResponseEntity.status(HttpStatus.CREATED).body(response);
-    }
-
-    @PostMapping("/query")
-    public ResponseEntity<ChatbotResponse> query(@RequestBody ChatbotQueryRequest request) {
-        ChatbotResponse response = chatbotService.ask(request);
-        return ResponseEntity.ok(response);
-    }
-
-    @GetMapping("/session/{sessionId}")
-    public ResponseEntity<ChatbotSessionResponse> getSession(@PathVariable String sessionId) {
-        ChatbotSettings settings = featureProperties.current();
-        ChatbotSession session =
-                sessionRegistry
-                        .findById(sessionId)
-                        .orElseThrow(() -> new ChatbotException("Session not found"));
-        ChatbotSessionResponse response = toResponse(session, settings);
-        return ResponseEntity.ok(response);
-    }
-
-    @GetMapping("/document/{documentId}")
-    public ResponseEntity<ChatbotSessionResponse> getSessionByDocument(
-            @PathVariable String documentId) {
-        ChatbotSettings settings = featureProperties.current();
-        ChatbotSession session =
-                sessionRegistry
-                        .findByDocumentId(documentId)
-                        .orElseThrow(() -> new ChatbotException("Session not found"));
-        return ResponseEntity.ok(toResponse(session, settings));
-    }
-
-    @DeleteMapping("/session/{sessionId}")
-    public ResponseEntity<Void> closeSession(@PathVariable String sessionId) {
-        chatbotService.close(sessionId);
-        return ResponseEntity.noContent().build();
-    }
-
-    private List<String> sessionWarnings(ChatbotSettings settings, ChatbotSession session) {
-        List<String> warnings = new ArrayList<>();
-
-        if (session != null && session.isImageContentDetected()) {
-            warnings.add("Images detected - Images are not currently supported.");
-        }
-
-        warnings.add("Images are not yet supported. Only extracted text is sent for analysis.");
-        if (session != null && session.isOcrRequested()) {
-            warnings.add("OCR requested – uses credits .");
-        }
-
-        if (session != null && session.getUsageSummary() != null) {
-            ChatbotUsageSummary usage = session.getUsageSummary();
-            if (usage.isLimitExceeded()) {
-                warnings.add("Monthly chatbot allocation exceeded – requests may be throttled.");
-            } else if (usage.isNearingLimit()) {
-                warnings.add("You are approaching the monthly chatbot allocation.");
-            }
-        }
-
-        return warnings;
-    }
-
-    private ChatbotSessionResponse toResponse(ChatbotSession session, ChatbotSettings settings) {
-        return ChatbotSessionResponse.builder()
-                .sessionId(session.getSessionId())
-                .documentId(session.getDocumentId())
-                .alphaWarning(settings.alphaWarning())
-                .ocrRequested(session.isOcrRequested())
-                .imageContentDetected(session.isImageContentDetected())
-                .textCharacters(session.getTextCharacters())
-                .estimatedTokens(session.getEstimatedTokens())
-                .maxCachedCharacters(cacheService.getMaxDocumentCharacters())
-                .createdAt(session.getCreatedAt())
-                .warnings(sessionWarnings(settings, session))
-                .metadata(session.getMetadata())
-                .usageSummary(session.getUsageSummary())
-                .build();
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/controller/ChatbotExceptionHandler.java

@@ -1,57 +0,0 @@
-package stirling.software.proprietary.controller;
-
-import java.time.Instant;
-import java.util.Map;
-
-import org.eclipse.jetty.client.HttpResponseException;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.RestControllerAdvice;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.proprietary.service.chatbot.ChatbotService;
-import stirling.software.proprietary.service.chatbot.exception.ChatbotException;
-import stirling.software.proprietary.service.chatbot.exception.NoTextDetectedException;
-
-@RestControllerAdvice(assignableTypes = ChatbotController.class)
-@Slf4j
-// @ConditionalOnProperty(value = "premium.proFeatures.chatbot.enabled", havingValue = "true")
-@ConditionalOnBean(ChatbotService.class)
-public class ChatbotExceptionHandler {
-
-    @ExceptionHandler(NoTextDetectedException.class)
-    public ResponseEntity<Map<String, Object>> handleNoText(NoTextDetectedException ex) {
-        return buildResponse(HttpStatus.UNPROCESSABLE_ENTITY, ex.getMessage());
-    }
-
-    @ExceptionHandler(ChatbotException.class)
-    public ResponseEntity<Map<String, Object>> handleChatbot(ChatbotException ex) {
-        log.debug("Chatbot exception: {}", ex.getMessage());
-        return buildResponse(HttpStatus.BAD_REQUEST, ex.getMessage());
-    }
-
-    @ExceptionHandler(IllegalArgumentException.class)
-    public ResponseEntity<Map<String, Object>> handleIllegalArgument(IllegalArgumentException ex) {
-        return buildResponse(HttpStatus.BAD_REQUEST, ex.getMessage());
-    }
-
-    @ExceptionHandler(HttpResponseException.class)
-    public ResponseEntity<Map<String, Object>> handleProvider(HttpResponseException ex) {
-        log.warn("Chatbot provider error", ex);
-        return buildResponse(
-                HttpStatus.BAD_GATEWAY,
-                "Chatbot provider rejected the request: " + ex.getMessage());
-    }
-
-    private ResponseEntity<Map<String, Object>> buildResponse(HttpStatus status, String message) {
-        Map<String, Object> payload =
-                Map.of(
-                        "timestamp", Instant.now().toString(),
-                        "status", status.value(),
-                        "error", message);
-        return ResponseEntity.status(status).body(payload);
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java

@@ -120,37 +120,6 @@ public class ProprietaryUIDataController {
         // Add enableLogin flag so frontend doesn't need to call /app-config
         data.setEnableLogin(securityProps.getEnableLogin());
 
-        // Check if this is first-time setup with default credentials
-        // The isFirstLogin flag captures: default username/password usage and unchanged state
-        boolean isFirstTimeSetup = false;
-        boolean showDefaultCredentials = false;
-
-        List<User> allUsers = userRepository.findAll();
-        List<User> realUsers =
-                allUsers.stream()
-                        .filter(
-                                user ->
-                                        !Role.INTERNAL_API_USER
-                                                .getRoleId()
-                                                .equals(user.getUsername()))
-                        .toList();
-        long userCount = realUsers.size();
-
-        if (userCount == 0) {
-            isFirstTimeSetup = true;
-            showDefaultCredentials = true;
-        } else if (userCount == 1) {
-            Optional<User> adminUser = userRepository.findByUsernameIgnoreCase("admin");
-
-            if (adminUser.isPresent() && Boolean.TRUE.equals(adminUser.get().getIsFirstLogin())) {
-                isFirstTimeSetup = true;
-                showDefaultCredentials = true;
-            }
-        }
-
-        data.setFirstTimeSetup(isFirstTimeSetup);
-        data.setShowDefaultCredentials(showDefaultCredentials);
-
         OAUTH2 oauth = securityProps.getOauth2();
 
         if (oauth != null && oauth.getEnabled()) {
@@ -397,8 +366,7 @@ public class ProprietaryUIDataController {
         Map<Long, Date> teamLastRequest = new HashMap<>();
         for (Object[] result : teamActivities) {
             Long teamId = (Long) result[0];
-            Instant instant = (Instant) result[1];
-            Date lastActivity = instant != null ? Date.from(instant) : null;
+            Date lastActivity = (Date) result[1];
             teamLastRequest.put(teamId, lastActivity);
         }
 
@@ -442,8 +410,7 @@ public class ProprietaryUIDataController {
         Map<String, Date> userLastRequest = new HashMap<>();
         for (Object[] result : userSessions) {
             String username = (String) result[0];
-            Instant instant = (Instant) result[1];
-            Date lastRequest = instant != null ? Date.from(instant) : null;
+            Date lastRequest = (Date) result[1];
             userLastRequest.put(username, lastRequest);
         }
 
@@ -489,8 +456,6 @@ public class ProprietaryUIDataController {
         private Map<String, String> providerList;
         private String loginMethod;
         private boolean altLogin;
-        private boolean firstTimeSetup;
-        private boolean showDefaultCredentials;
     }
 
     @Data

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/SignatureController.java

@@ -1,102 +0,0 @@
-package stirling.software.proprietary.controller.api;
-
-import java.io.IOException;
-import java.util.List;
-
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.annotations.api.UserApi;
-import stirling.software.proprietary.model.api.signature.SavedSignatureRequest;
-import stirling.software.proprietary.model.api.signature.SavedSignatureResponse;
-import stirling.software.proprietary.security.service.UserService;
-import stirling.software.proprietary.service.SignatureService;
-
-/**
- * Controller for managing user signatures in proprietary/authenticated mode only. Requires user
- * authentication and enforces per-user storage limits. All endpoints require authentication
- * via @PreAuthorize("isAuthenticated()").
- */
-@UserApi
-@Slf4j
-@RestController
-@RequestMapping("/api/v1/proprietary/signatures")
-@RequiredArgsConstructor
-@PreAuthorize("isAuthenticated()")
-public class SignatureController {
-
-    private final SignatureService signatureService;
-    private final UserService userService;
-
-    /**
-     * Save a new signature for the authenticated user. Enforces storage limits and authentication
-     * requirements.
-     */
-    @PostMapping
-    public ResponseEntity<SavedSignatureResponse> saveSignature(
-            @RequestBody SavedSignatureRequest request) {
-        try {
-            String username = userService.getCurrentUsername();
-
-            // Validate request
-            if (request.getDataUrl() == null || request.getDataUrl().isEmpty()) {
-                log.warn("User {} attempted to save signature without dataUrl", username);
-                return ResponseEntity.badRequest().build();
-            }
-
-            SavedSignatureResponse response = signatureService.saveSignature(username, request);
-            log.info("User {} saved signature {}", username, request.getId());
-            return ResponseEntity.ok(response);
-        } catch (IllegalArgumentException e) {
-            log.warn("Invalid signature save request: {}", e.getMessage());
-            return ResponseEntity.badRequest().build();
-        } catch (IOException e) {
-            log.error("Failed to save signature", e);
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
-        }
-    }
-
-    /**
-     * List all signatures accessible to the authenticated user. Includes both personal and shared
-     * signatures.
-     */
-    @GetMapping
-    public ResponseEntity<List<SavedSignatureResponse>> listSignatures() {
-        try {
-            String username = userService.getCurrentUsername();
-            List<SavedSignatureResponse> signatures = signatureService.getSavedSignatures(username);
-            return ResponseEntity.ok(signatures);
-        } catch (IOException e) {
-            log.error("Failed to list signatures for user", e);
-            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).build();
-        }
-    }
-
-    /**
-     * Delete a signature owned by the authenticated user. Users can only delete their own personal
-     * signatures, not shared ones.
-     */
-    @DeleteMapping("/{signatureId}")
-    public ResponseEntity<Void> deleteSignature(@PathVariable String signatureId) {
-        try {
-            String username = userService.getCurrentUsername();
-            signatureService.deleteSignature(username, signatureId);
-            log.info("User {} deleted signature {}", username, signatureId);
-            return ResponseEntity.noContent().build();
-        } catch (IOException e) {
-            log.warn("Failed to delete signature {} for user: {}", signatureId, e.getMessage());
-            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
-        }
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/form/FormFillController.java

@@ -34,19 +34,7 @@ import stirling.software.proprietary.util.FormUtils;
 
 @RestController
 @RequestMapping("/api/v1/form")
-@Tag(
-        name = "Forms",
-        description =
-                """
-                Work with PDF form fields: read them, fill them, edit them, or remove them.
-                Treats a PDF as a structured form instead of just flat pages.
-
-                Typical uses:
-                • Inspect which form fields exist in a PDF
-                • Autofill forms from your own systems (e.g. CRM, ERP)
-                • Change or delete form fields before sending out a final, non-editable copy
-                • Unlock read-only form fields when you need to update them
-                """)
+@Tag(name = "Forms", description = "PDF form APIs")
 @RequiredArgsConstructor
 public class FormFillController {
 

app/proprietary/src/main/java/stirling/software/proprietary/model/api/signature/SavedSignatureRequest.java

@@ -1,18 +0,0 @@
-package stirling.software.proprietary.model.api.signature;
-
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-public class SavedSignatureRequest {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/api/signature/SavedSignatureResponse.java

@@ -1,22 +0,0 @@
-package stirling.software.proprietary.model.api.signature;
-
-import lombok.AllArgsConstructor;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@NoArgsConstructor
-@AllArgsConstructor
-public class SavedSignatureResponse {
-    private String id;
-    private String label;
-    private String type; // "canvas", "image", "text"
-    private String scope; // "personal", "shared"
-    private String dataUrl; // For canvas and image types (or URL to fetch image)
-    private String signerName; // For text type
-    private String fontFamily; // For text type
-    private Integer fontSize; // For text type
-    private String textColor; // For text type
-    private Long createdAt;
-    private Long updatedAt;
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotDocumentCacheEntry.java

@@ -1,30 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import java.time.Instant;
-import java.util.Collections;
-import java.util.Map;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ChatbotDocumentCacheEntry {
-
-    private String cacheKey;
-    private String sessionId;
-    private String documentId;
-    private Map<String, String> metadata;
-    private boolean ocrApplied;
-    private boolean imageContentDetected;
-    private long textCharacters;
-    private Instant storedAt;
-
-    public Map<String, String> getMetadata() {
-        return metadata == null ? Collections.emptyMap() : metadata;
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotHistoryEntry.java

@@ -1,7 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import java.time.Instant;
-
-/** Simple record representing a stored chatbot conversation turn. */
-public record ChatbotHistoryEntry(
-        String role, String content, String documentId, String documentName, Instant timestamp) {}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotQueryRequest.java

@@ -1,17 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ChatbotQueryRequest {
-
-    private String sessionId;
-    private String prompt;
-    private boolean allowEscalation;
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotResponse.java

@@ -1,41 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import java.time.Instant;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ChatbotResponse {
-
-    private String sessionId;
-    private String modelUsed;
-    private double confidence;
-    private String answer;
-    private boolean escalated;
-    private boolean servedFromNanoOnly;
-    private boolean cacheHit;
-    private Instant respondedAt;
-    private List<String> warnings;
-    private Map<String, Object> metadata;
-    private long promptTokens;
-    private long completionTokens;
-    private long totalTokens;
-    private ChatbotUsageSummary usageSummary;
-
-    public List<String> getWarnings() {
-        return warnings == null ? Collections.emptyList() : warnings;
-    }
-
-    public Map<String, Object> getMetadata() {
-        return metadata == null ? Collections.emptyMap() : metadata;
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotSession.java

@@ -1,37 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import java.time.Instant;
-import java.util.Collections;
-import java.util.Map;
-import java.util.UUID;
-
-import lombok.Builder;
-import lombok.Data;
-
-@Data
-@Builder
-public class ChatbotSession {
-
-    private String sessionId;
-    private String documentId;
-    private String userId;
-    private Map<String, String> metadata;
-    private boolean ocrRequested;
-    private boolean warningsAccepted;
-    private boolean alphaWarningRequired;
-    private boolean imageContentDetected;
-    private long textCharacters;
-    private long estimatedTokens;
-    private String cacheKey;
-    private String vectorStoreId;
-    private Instant createdAt;
-    private ChatbotUsageSummary usageSummary;
-
-    public static String randomSessionId() {
-        return UUID.randomUUID().toString();
-    }
-
-    public Map<String, String> getMetadata() {
-        return metadata == null ? Collections.emptyMap() : metadata;
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotSessionCreateRequest.java

@@ -1,24 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import java.util.Map;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ChatbotSessionCreateRequest {
-
-    private String sessionId;
-    private String documentId;
-    private String userId;
-    private String text;
-    private Map<String, String> metadata;
-    private boolean ocrRequested;
-    private boolean warningsAccepted;
-    private boolean imagesDetected;
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotSessionResponse.java

@@ -1,39 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import java.time.Instant;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ChatbotSessionResponse {
-
-    private String sessionId;
-    private String documentId;
-    private boolean alphaWarning;
-    private boolean ocrRequested;
-    private boolean imageContentDetected;
-    private long maxCachedCharacters;
-    private long textCharacters;
-    private long estimatedTokens;
-    private Instant createdAt;
-    private List<String> warnings;
-    private Map<String, String> metadata;
-    private ChatbotUsageSummary usageSummary;
-
-    public List<String> getWarnings() {
-        return warnings == null ? Collections.emptyList() : warnings;
-    }
-
-    public Map<String, String> getMetadata() {
-        return metadata == null ? Collections.emptyMap() : metadata;
-    }
-}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotUsageSummary.java

@@ -1,22 +0,0 @@
-package stirling.software.proprietary.model.chatbot;
-
-import lombok.AllArgsConstructor;
-import lombok.Builder;
-import lombok.Data;
-import lombok.NoArgsConstructor;
-
-@Data
-@Builder
-@NoArgsConstructor
-@AllArgsConstructor
-public class ChatbotUsageSummary {
-
-    private long allocatedTokens;
-    private long consumedTokens;
-    private long remainingTokens;
-    private double usageRatio;
-    private boolean nearingLimit;
-    private boolean limitExceeded;
-    private long lastIncrementTokens;
-    private String window;
-}

app/proprietary/src/main/java/stirling/software/proprietary/security/CustomLogoutSuccessHandler.java

@@ -238,12 +238,6 @@ public class CustomLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
             path = "errorOAuth=oAuth2AutoCreateDisabled";
         } else if (request.getParameter("oAuth2AdminBlockedUser") != null) {
             path = "errorOAuth=oAuth2AdminBlockedUser";
-        } else if (request.getParameter("oAuth2RequiresLicense") != null) {
-            path = "errorOAuth=oAuth2RequiresLicense";
-        } else if (request.getParameter("saml2RequiresLicense") != null) {
-            path = "errorOAuth=saml2RequiresLicense";
-        } else if (request.getParameter("maxUsersReached") != null) {
-            path = "errorOAuth=maxUsersReached";
         } else if (request.getParameter("userIsDisabled") != null) {
             path = "errorOAuth=userIsDisabled";
         } else if ((errorMessage = request.getParameter("error")) != null) {

app/proprietary/src/main/java/stirling/software/proprietary/security/InitialSecuritySetup.java

@@ -62,7 +62,6 @@ public class InitialSecuritySetup {
     private void initializeUserLicenseSettings() {
         licenseSettingsService.initializeGrandfatheredCount();
         licenseSettingsService.updateLicenseMaxUsers();
-        licenseSettingsService.grandfatherExistingOAuthUsers();
     }
 
     private void configureJWTSettings() {

app/proprietary/src/main/java/stirling/software/proprietary/security/config/PremiumEndpointAspect.java

@@ -23,7 +23,7 @@ public class PremiumEndpointAspect {
     public Object checkPremiumAccess(ProceedingJoinPoint joinPoint) throws Throwable {
         if (!runningProOrHigher) {
             throw new ResponseStatusException(
-                    HttpStatus.FORBIDDEN, "This endpoint requires a Server or Enterprise license");
+                    HttpStatus.FORBIDDEN, "This endpoint requires a Pro or higher license");
         }
         return joinPoint.proceed();
     }