audit: jpdfium split

impl migration to pdfium for split
Delete MergeBenchmark
2026-05-22 10:04:53 +01:00 · 2026-05-22 09:43:18 +01:00 · 2026-05-21 23:00:00 +01:00 · 2026-05-21 19:11:52 +01:00 · 2026-05-21 19:03:31 +01:00 · 2026-05-21 17:46:46 +01:00
3894 changed files with 109144 additions and 293814 deletions
@@ -20,8 +20,8 @@ set -e
 # - To build the project, use:
 #     ./gradlew build
 #
-# - To run the lint/format/secret checks, use:
-#     task pre-commit
+# - For running pre-commit hooks (if configured), use:
+#     pre-commit run --all-files
 #
 # Make sure you are in the project root directory after this script executes.
 # =============================================================================
@@ -70,6 +70,6 @@ echo ""
 echo "  To build the project: "
 echo -e "\e[34m    gradle build\e[0m"
 echo ""
-echo "  To run the lint/format/secret checks:"
-echo -e "\e[34m    task pre-commit\e[0m"
+echo "  To run pre-commit hooks (if configured):"
+echo -e "\e[34m    pre-commit run --all-files -c .pre-commit-config.yaml\e[0m"
 echo "=================================================================="
@@ -8,8 +8,6 @@
 build/
 */build/
 **/build/
-# ...but re-include the Quarkus runner-jar so docker/quarkus/Dockerfile can layer it on the base image
-!app/core/build/*-runner.jar
 out/
 target/
 **/target/
@@ -28,17 +26,16 @@ version_builds/
 node_modules/
 **/node_modules/
 frontend/node_modules/
-frontend/editor/dist/
-frontend/dist-portal/
-frontend/editor/playwright-report/
+frontend/dist/
+frontend/playwright-report/
 .npm/
 .yarn/

 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
-frontend/editor/src-tauri/target/
-frontend/editor/src-tauri/dist/
+frontend/src-tauri/target/
+frontend/src-tauri/dist/

 # IDE and editor
 .idea/
@@ -24,7 +24,7 @@ runs:
      id: generate-token
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      with:
-        client-id: ${{ inputs.app-id }}
+        app-id: ${{ inputs.app-id }}
        private-key: ${{ inputs.private-key }}
    - name: Configure Git
      run: |
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.13.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.13.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
@@ -1,8 +1,6 @@
 build: &build
  - build.gradle
  - app/(common|core|proprietary)/build.gradle
-  - Taskfile.yml
-  - .taskfiles/backend.yml

 openapi: &openapi
  - *build
@@ -10,6 +8,7 @@ openapi: &openapi

 docker-base: &docker-base
  - docker/base/Dockerfile
+  - ".github/workflows/push-docker-base.yml"

 docker: &docker
  - docker/embedded/Dockerfile
@@ -40,11 +39,6 @@ project: &project
  - frontend/**
  - docker/**
  - scripts/RestartHelper.java
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .taskfiles/docker.yml
-  - scripts/db-migration/**
-  - .github/workflows/db-migration-test.yml

 frontend: &frontend
  - frontend/**
@@ -60,22 +54,17 @@ frontend: &frontend
  - scripts/summarize_type3_signatures.py
  - scripts/type3_to_cff.py
  - scripts/update_type3_library.py
-  - Taskfile.yml
-  - .taskfiles/frontend.yml
-  - .taskfiles/e2e.yml

 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
 tauri: &tauri
-  - frontend/editor/src-tauri/**
-  - frontend/editor/src/desktop/**
-  - frontend/editor/tsconfig.desktop.vite.json
+  - frontend/src-tauri/**
+  - frontend/src/desktop/**
+  - frontend/tsconfig.desktop.json
  - frontend/package.json
  - frontend/package-lock.json
-  - frontend/editor/vite.config.ts
+  - frontend/vite.config.ts
  - .github/workflows/tauri-build.yml
-  - Taskfile.yml
-  - .taskfiles/desktop.yml

 # Files that affect the AI engine (Python tool models, fixers, tests). Gate
 # the engine validation job on changes to engine sources or to the Java
@@ -84,14 +73,12 @@ engine: &engine
  - engine/**
  - app/(common|core|proprietary)/src/main/java/**
  - .github/workflows/ai-engine.yml
-  - Taskfile.yml
-  - .taskfiles/engine.yml

 licenses-frontend: &licenses-frontend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - "frontend/package.json"
  - "frontend/package-lock.json"
-  - "frontend/editor/scripts/generate-licenses.js"
+  - "frontend/scripts/generate-licenses.js"

 licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -101,8 +88,8 @@ licenses-backend: &licenses-backend
 # Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
  - app/proprietary/**
-  - frontend/editor/src/proprietary/**
-  - frontend/editor/src/core/tests/enterprise/**
+  - frontend/src/proprietary/**
+  - frontend/src/core/tests/enterprise/**
  - testing/compose/docker-compose-keycloak-oauth.yml
  - testing/compose/docker-compose-keycloak-saml.yml
  - testing/compose/keycloak-realm-oauth.json
@@ -114,4 +101,4 @@ proprietary: &proprietary
  - configs/settings.yml.template
  - build.gradle
  - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml
+  - .github/workflows/build-enterprise.yml
@@ -25,8 +25,6 @@ updates:
      - "/docker/frontend"
      - "/docker/base"
      - "/docker/engine"
-      - "/docker/unoserver"
-      - "/engine"
    schedule:
      interval: "weekly"
    cooldown:
@@ -128,9 +126,9 @@ updates:

  - package-ecosystem: cargo
    directories:
-      - /frontend/editor/src-tauri
-      - /frontend/editor/src-tauri/thumbnail-handler
-      - /frontend/editor/src-tauri/provisioner
+      - /frontend/src-tauri
+      - /frontend/src-tauri/thumbnail-handler
+      - /frontend/src-tauri/provisioner
    schedule:
      interval: "weekly"
    cooldown:
@@ -51,7 +51,7 @@ labels:

  - label: 'Translation'
    files:
-      - 'frontend/editor/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
      - 'scripts/ignore_translation.toml'
      - 'scripts/remove_translation_keys.sh'
      - 'scripts/replace_translation_line.sh'
@@ -69,8 +69,8 @@ labels:

  - label: 'Tauri'
    files:
-      - 'frontend/editor/src-tauri/**'
-      - 'frontend/editor/src-tauri/.*'
+      - 'frontend/src-tauri/**'
+      - 'frontend/src-tauri/.*'

  - label: 'engine'
    files:
@@ -13,7 +13,7 @@ Usage:
 """

 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-US/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml

 import argparse
 import glob
@@ -184,7 +184,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
    if len(file_list) == 1:
        file_arr = file_list[0].split()

-    base_dir = Path.cwd() / "frontend" / "editor" / "public" / "locales"
+    base_dir = Path.cwd() / "frontend" / "public" / "locales"

    for file_path in file_arr:
        file_path = Path(file_path)
@@ -211,7 +211,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
            )
            continue

-        if basename_current_file == basename_reference_file and locale_dir == "en-US":
+        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
            continue

        if (
@@ -308,7 +308,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
        report.append("## ❌ Overall Check Status: **_Failed_**")
        report.append("")
        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-US/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
        )
    else:
        report.append("## ✅ Overall Check Status: **_Success_**")
@@ -372,7 +372,6 @@ if __name__ == "__main__":
                os.path.join(
                    os.getcwd(),
                    "frontend",
-                    "editor",
                    "public",
                    "locales",
                    "*",
@@ -0,0 +1 @@
+pre-commit
@@ -0,0 +1,121 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
+#
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+    # via pre-commit
+distlib==0.4.0 \
+    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
+    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
+    # via virtualenv
+filelock==3.29.0 \
+    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
+    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+    # via
+    #   python-discovery
+    #   virtualenv
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+    # via pre-commit
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+    # via pre-commit
+platformdirs==4.9.6 \
+    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
+    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+    # via -r .github/scripts/requirements_pre_commit.in
+python-discovery==1.2.2 \
+    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
+    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+    # via virtualenv
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via pre-commit
+virtualenv==21.2.4 \
+    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
+    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+    # via pre-commit
@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
-
-Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
-"""
-
-import binascii
-import sys
-import json
-import base64
-import hashlib
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from cryptography.exceptions import InvalidSignature
-
-ART_ROOT = Path(sys.argv[1])
-CONF = Path(
-    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
-)
-
-
-def load_pubkey():
-    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
-    # [2 algo][8 key-id][32 ed25519 public key].
-    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
-    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
-    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
-
-
-def hash_file(path: Path) -> bytes:
-    h = hashlib.blake2b(digest_size=64)
-    with path.open("rb") as f:
-        for chunk in iter(lambda: f.read(1 << 16), b""):
-            h.update(chunk)
-    return h.digest()
-
-
-def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
-    # tauri .sig = base64 of a minisign signature file (4 lines).
-    try:
-        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
-        sig_blob = base64.b64decode(lines[1])
-    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
-        return f"FAIL malformed sig ({type(e).__name__})"
-    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
-    if keyid != keyid_pub:
-        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
-    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
-    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
-    try:
-        pub.verify(sig, msg)
-    except InvalidSignature:
-        return f"FAIL signature invalid (algo={algo.decode()})"
-    # Global signature covers sig + trusted_comment.
-    gc = "global-sig FAIL"
-    try:
-        tc = lines[2].split("trusted comment: ", 1)[1]
-        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
-        gc = "global-sig OK"
-    except (InvalidSignature, IndexError, binascii.Error):
-        pass
-    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
-
-
-keyid_pub, pub = load_pubkey()
-print(f"updater pubkey keyid={keyid_pub.hex()}\n")
-sigs = sorted(ART_ROOT.rglob("*.sig"))
-if not sigs:
-    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
-    sys.exit(0)
-bad = 0
-for sig_file in sigs:
-    artifact = sig_file.with_suffix("")
-    if not artifact.exists():
-        print(f"  ? {sig_file.name}: artifact missing")
-        bad += 1
-        continue
-    res = verify(artifact, sig_file, keyid_pub, pub)
-    print(f"  {artifact.name}: {res}")
-    if not res.startswith("VALID") or "global-sig FAIL" in res:
-        bad += 1
-print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
-sys.exit(1 if bad else 0)
@@ -23,13 +23,9 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-pr:
    if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    outputs:
      should_deploy: ${{ steps.decide.outputs.should_deploy }}
      is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -39,7 +35,7 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -101,8 +97,8 @@ jobs:
          echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT

  deploy-v2-pr:
-    needs: [pick, check-pr]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-pr
+    runs-on: ubuntu-latest
    if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
    # Concurrency control - only one deployment per PR at a time
    concurrency:
@@ -112,14 +108,10 @@ jobs:
      contents: read
      issues: write
      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -187,12 +179,7 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0 # Fetch full history for commit hash detection

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -237,20 +224,8 @@ jobs:
            echo "Image needs to be built"
          fi

-      - name: Build and push V2 image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push V2 image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-image.outputs.exists == 'false'
+      - name: Build and push V2 image
+        if: steps.check-image.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -287,13 +262,12 @@ jobs:
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
              environment:
                DISABLE_ADDITIONAL_FEATURES: "false"
                SECURITY_ENABLELOGIN: "true"
                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
                UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
@@ -310,7 +284,7 @@ jobs:

          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
+            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}

            # Move docker-compose file to correct location
            mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml
@@ -377,8 +351,7 @@ jobs:

  cleanup-v2-deployment:
    if: github.event.action == 'closed'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
@@ -386,7 +359,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -34,12 +34,8 @@ permissions:
  pull-requests: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-comment:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      issues: write
    if: |
@@ -74,7 +70,7 @@ jobs:
      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -179,19 +175,15 @@ jobs:
            }

  deploy-pr:
-    needs: [pick, check-comment]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-comment
+    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -222,10 +214,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -240,12 +232,7 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_PDF_DESKTOP_UI: false

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
@@ -254,22 +241,7 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push PR-specific image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push PR-specific image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push PR-specific image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -283,19 +255,8 @@ jobs:
            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
          platforms: linux/amd64

-      - name: Build and push engine image (Depot)
-        if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
+      - name: Build and push engine image
+        if: needs.check-comment.outputs.enable_prototypes == 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: ./engine
@@ -388,7 +349,7 @@ jobs:
              environment:
                DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
@@ -510,11 +471,10 @@ jobs:

  handle-label-commands:
    if: ${{ github.event.issue.pull_request != null }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -1,70 +0,0 @@
-name: _runner-pick
-
-# Tiny reusable workflow that classifies the trigger as either a "fork PR
-# from an untrusted contributor" or a "trusted commit" so downstream jobs
-# can pick a runner class without each one duplicating the 200-char gate
-# expression in their own `runs-on:`.
-#
-# Caller pattern:
-#
-#   jobs:
-#     pick:
-#       uses: ./.github/workflows/_runner-pick.yml
-#
-#     real-work:
-#       needs: pick
-#       runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-#       steps: [...]
-#
-# Output:
-#   is_fork: "true" when the trigger is a pull_request from a fork or an
-#            untrusted author_association, "false" otherwise.
-
-on:
-  workflow_call:
-    outputs:
-      is_fork:
-        description: '"true" if the trigger is an untrusted fork PR.'
-        value: ${{ jobs.pick.outputs.is_fork }}
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    outputs:
-      is_fork: ${{ steps.decide.outputs.is_fork }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Classify the trigger
-        id: decide
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_REPO_FORK: ${{ github.event.pull_request.head.repo.fork }}
-          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
-        run: |
-          set -eu
-          if [ -z "${PR_NUMBER:-}" ]; then
-            # Not a pull_request event at all (push, schedule, workflow_dispatch,
-            # workflow_call from a non-PR trigger) -> trusted by default.
-            echo "is_fork=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          if [ "${HEAD_REPO_FORK}" = "true" ]; then
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          case "${AUTHOR_ASSOC}" in
-            OWNER|MEMBER|COLLABORATOR)
-              echo "is_fork=false" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "is_fork=true" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
@@ -1,9 +1,8 @@
 name: AI Engine CI

-# Validates the Python AI engine: regenerates tool models and runs the
-# engine quality gate (lint, type-check, format-check, tests). Called from
-# build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net.
+# Validates the Python AI engine: regenerates tool models, runs fixers,
+# lint, type-check, and tests. Called from build.yml on PRs and merge_group;
+# also runs directly on push to main as a post-merge safety net.
 on:
  workflow_call:
  push:
@@ -18,16 +17,14 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
@@ -43,104 +40,36 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Regenerate tool models
        run: task engine:tool-models

      - name: Verify tool models are up to date
-        id: tool-models-check
-        continue-on-error: true
-        run: git diff --exit-code engine/src/stirling/models/tool_models.py
-
-      - name: Comment on tool models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.tool-models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const body = [
-              marker,
-              '### Tool Models Check Failed',
-              '',
-              'The generated `engine/src/stirling/models/tool_models.py` is out of date with the Java OpenAPI spec and will need to be regenerated before it can be merged in.',
-              '',
-              'Run `task engine:tool-models` to regenerate, then commit the updated file.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if tool models check failed
-        if: steps.tool-models-check.outcome == 'failure'
        run: |
-          echo "============================================"
-          echo "  Tool Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "The generated engine/src/stirling/models/tool_models.py"
-          echo "is out of date with the Java OpenAPI spec and will"
-          echo "need to be regenerated before it can be merged in."
-          echo ""
-          echo "Run 'task engine:tool-models' to regenerate, then"
-          echo "commit the updated file."
-          echo "============================================"
-          exit 1
+          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
+            echo "tool_models.py is out of date."
+            echo "Run 'task engine:tool-models' locally and commit the updated file."
+            exit 1
+          fi

-      - name: Remove tool models check comment on success
-        if: steps.tool-models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run fixers
+        run: task engine:fix

-      - name: Quality-check engine
-        id: engine-check
-        run: task engine:check
-        continue-on-error: true
+      - name: Verify fixes are committed
+        id: fixer_changes
+        run: |
+          if ! git diff --quiet; then
+            git --no-pager diff --stat
+            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
+            exit 1
+          fi

-      - name: Comment on engine check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
+      - name: Comment on fixer failures
+        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
@@ -176,39 +105,11 @@ jobs:
              });
            }

-      - name: Fail if engine check failed
-        if: steps.engine-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Engine Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your Python code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task engine:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task engine:check'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
+      - name: Run linting
+        run: task engine:lint

-      - name: Remove engine check comment on success
-        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run type checking
+        run: task engine:typecheck
+
+      - name: Run tests
+        run: task engine:test
@@ -19,7 +19,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -26,7 +26,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -70,12 +70,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Update stirling-pdf-desktop PKGBUILD
        env:
@@ -106,7 +106,7 @@ jobs:

      - name: Publish stirling-pdf-desktop to AUR
        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
+        uses: KSXGitHub/github-actions-deploy-aur@v4.1.3
        with:
          pkgname: stirling-pdf-desktop
          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
@@ -16,7 +16,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -1,14 +1,8 @@
 name: Backend build, format check, and coverage

 # Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
+# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
-#
-# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
-#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
-#   proprietary  - default build, no saas
-#   saas         - proprietary + the saas subproject (build + JUnit only,
-#                  never any runtime/integration testing)
 on:
  workflow_call:

@@ -19,22 +13,16 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  build:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        jdk-version: [25]
-        flavor: [core, proprietary, saas]
+        spring-security: [true, false]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -58,16 +46,13 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check Java formatting (Spotless)
-        # Runs once per matrix combination - pick the cheapest leg
-        # (core - no proprietary, no saas) so we don't wait for the
-        # heavier flavors just to fail formatting.
-        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
+        if: matrix.jdk-version == 25 && matrix.spring-security == false
        id: spotless-check
        run: task backend:format:check
        continue-on-error: true
@@ -76,7 +61,7 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

-      - name: Comment on backend format check failure
+      - name: Comment on Java formatting failure
        # Only post a comment on PRs. github-script's PR helpers need an
        # issue/PR number, which doesn't exist on merge_group runs.
        if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
@@ -87,11 +72,15 @@ jobs:
            const marker = '<!-- java-formatting-check -->';
            const body = [
              marker,
-              '### Backend Format Check Failed',
+              '### Java Formatting Check Failed',
              '',
-              'There are formatting issues in your Java code that will need to be fixed before they can be merged in.',
+              'Your code has formatting issues. Run the following command to fix them:',
              '',
-              'Run `task backend:format` to auto-fix, then commit and push the changes.',
+              '```bash',
+              'task backend:format',
+              '```',
+              '',
+              'Then commit and push the changes.',
            ].join('\n');
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
@@ -115,61 +104,33 @@ jobs:
              });
            }

-      - name: Fail if backend format check failed
+      - name: Fail if Java formatting issues found
        if: steps.spotless-check.outcome == 'failure'
        run: |
          echo "============================================"
-          echo "  Backend Format Check Failed"
+          echo "  Java Formatting Check Failed"
          echo "============================================"
          echo ""
-          echo "There are formatting issues in your Java code"
-          echo "that will need to be fixed before they can be"
-          echo "merged in."
+          echo "Your code has formatting issues."
+          echo "Run the following command to fix them:"
          echo ""
-          echo "Run 'task backend:format' to auto-fix, then"
-          echo "commit and push the changes."
+          echo "  task backend:format"
+          echo ""
+          echo "Then commit and push the changes."
          echo "============================================"
          exit 1

-      - name: Remove backend format check comment on success
-        if: steps.spotless-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
-      - name: Build with Gradle (flavor=${{ matrix.flavor }})
-        # STIRLING_FLAVOR is read by settings.gradle and expands into the
-        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
-        # so we don't have to set them by hand. The saas flavor pulls in
-        # the app/saas subproject (unit tests only - no runtime tests).
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
        run: task backend:build:ci
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          STIRLING_FLAVOR: ${{ matrix.flavor }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}

      - name: Check Test Reports Exist
        if: always()
        run: |
-          # Common + core + proprietary always build (proprietary is
-          # excluded only at runtime, not from the gradle subproject
-          # graph). Saas builds add a fourth report dir.
          declare -a dirs=(
            "app/core/build/reports/tests/"
            "app/core/build/test-results/"
@@ -178,9 +139,6 @@ jobs:
            "app/proprietary/build/reports/tests/"
            "app/proprietary/build/test-results/"
          )
-          if [ "${{ matrix.flavor }}" = "saas" ]; then
-            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
-          fi
          for dir in "${dirs[@]}"; do
            if [ ! -d "$dir" ]; then
              echo "Missing $dir"
@@ -192,7 +150,7 @@ jobs:
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
          path: |
            app/**/build/reports/jacoco/test
            app/**/build/reports/tests/
@@ -202,47 +160,7 @@ jobs:
          retention-days: 3
          if-no-files-found: warn

-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml to
-        # silence security scanners that pattern-match on the stdlib
-        # xml.etree.ElementTree.parse call.
-        if: always() && matrix.flavor == 'saas'
-        run: python -m pip install --quiet defusedxml
-
-      - name: JaCoCo coverage step summary
-        # Only the saas leg posts the JUnit summary - it's a strict
-        # superset of the core + proprietary legs (same .exec files plus
-        # the saas subproject). Posting from all three would mean three
-        # near-identical tables crowding out the aggregate report.
-        if: always() && matrix.flavor == 'saas'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
-            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload raw JUnit .exec for aggregate merge
-        # Same dedup rationale as the summary step: upload from the saas
-        # leg only (the most complete set, includes app/saas/.../test.exec)
-        # so the aggregate workflow merges the union rather than three
-        # overlapping subsets.
-        #
-        # Separate artifact from the HTML reports so the aggregate
-        # workflow can grab just the .exec files with a name pattern
-        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
-        # tarball.
-        if: always() && matrix.flavor == 'saas'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
-          path: app/*/build/jacoco/*.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
        # The action only supports the pull_request event (it posts a PR comment),
        # so skip it for merge_group runs and workflow_dispatch.
        if: github.event_name == 'pull_request'
@@ -17,23 +17,11 @@ name: Enterprise E2E (Playwright)

 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
  push:
    branches: ["main"]
  schedule:
    - cron: "0 4 * * *"
  workflow_dispatch:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 # No `concurrency:` block here on purpose. When this workflow is called via
 # workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
@@ -47,21 +35,16 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e-enterprise:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
      PREMIUM_ENABLED: "true"
      SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -78,7 +61,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (needed for playwright's vite preview webServer)
@@ -285,5 +268,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -46,7 +46,7 @@ jobs:
      proprietary: ${{ steps.changes.outputs.proprietary }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -68,18 +68,6 @@ jobs:
    uses: ./.github/workflows/backend-build.yml
    secrets: inherit

-  db-migration-test:
-    # Boots the current bootJar against H2 fixtures captured from past
-    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
-    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
-    # the `project` filter so doc-only PRs skip this ~5-minute job.
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/db-migration-test.yml
-    secrets: inherit
-
  check-generateOpenApiDocs:
    if: needs.files-changed.outputs.openapi == 'true'
    needs: [files-changed]
@@ -147,7 +135,6 @@ jobs:
    permissions:
      contents: read
      packages: read
-      id-token: write
    uses: ./.github/workflows/test-build-docker.yml
    secrets: inherit
    with:
@@ -185,24 +172,6 @@ jobs:
    uses: ./.github/workflows/dependency-review.yml
    secrets: inherit

-  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
-  # artifacts produced by the jobs above into one report, plus pulls
-  # in vitest + Playwright frontend coverage for the per-area matrix.
-  # `if: always()` so a producer failing partway still gets credit
-  # for whatever did record. Advisory only - intentionally NOT in
-  # all-checks-passed, so a flaky aggregate run never blocks merging.
-  coverage-aggregate:
-    if: always()
-    needs:
-      - build
-      - playwright-e2e-live
-      - docker-compose-tests
-      - frontend-validation
-    permissions:
-      contents: read
-    uses: ./.github/workflows/coverage-aggregate.yml
-    secrets: inherit
-
  # Single status check that branch protection should mark as required.
  # Succeeds when every upstream job is either `success` or `skipped` (path-
  # gated jobs that didn't apply this run). Any `failure` or `cancelled`
@@ -214,7 +183,6 @@ jobs:
    needs:
      - files-changed
      - build
-      - db-migration-test
      - check-generateOpenApiDocs
      - frontend-validation
      - playwright-e2e
@@ -229,17 +197,11 @@ jobs:
      - dependency-review
    runs-on: ubuntu-latest
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
      - name: Verify every required job passed (or was legitimately skipped)
        env:
          RESULTS: |
            files-changed=${{ needs.files-changed.result }}
            build=${{ needs.build.result }}
-            db-migration-test=${{ needs.db-migration-test.result }}
            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
            frontend-validation=${{ needs.frontend-validation.result }}
            playwright-e2e=${{ needs.playwright-e2e.result }}
@@ -11,11 +11,9 @@ permissions:
 jobs:
  check-licence:
    runs-on: ubuntu-latest
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -40,11 +38,11 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check licenses for compatibility
        run: task backend:licenses:check
        env:
@@ -10,17 +10,11 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-generate-openapi-docs:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -45,11 +39,11 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate OpenAPI documentation
        run: task backend:swagger
        env:
@@ -6,7 +6,7 @@ on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - ".github/scripts/check_language_toml.py"
      - ".github/workflows/check_toml.yml"

@@ -27,7 +27,7 @@ jobs:
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -76,7 +76,7 @@ jobs:
            exit 1
          fi
          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
@@ -166,16 +166,16 @@ jobs:

            // Determine reference file
            let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
+            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
              console.log("Using PR branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                ref: branch,
              });

-              referenceFilePath = "pr-branch-translation-en-US.toml";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              fs.writeFileSync(referenceFilePath, content);
            } else {
@@ -183,11 +183,11 @@ jobs:
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: repoOwner,
                repo: repoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                ref: "main",
              });

-              referenceFilePath = "main-branch-translation-en-US.toml";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              fs.writeFileSync(referenceFilePath, content);
            }
@@ -293,6 +293,6 @@ jobs:
        run: |
          echo "Cleaning up temporary files..."
          rm -rf pr-branch
-          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
          echo "Cleanup complete."
        continue-on-error: true # Ensure cleanup runs even if previous steps fail
@@ -1,230 +0,0 @@
-name: Aggregate backend coverage
-
-# Reusable workflow called from build.yml after every backend coverage
-# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
-# .exec, merges them into one JaCoCo report, and posts a combined step
-# summary alongside the per-source ones.
-#
-# Kept separate from the per-source jobs so:
-#   - the per-source jobs stay fast and independent (no cross-job waits)
-#   - this job can `if: always()` and still produce something useful when
-#     one of the producers fails partway through
-#   - frontend producers can be added later without touching the
-#     producers themselves
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  aggregate:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 15
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for coverage scripts
-        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
-        # XML through defusedxml - see the script headers for context.
-        run: python -m pip install --quiet defusedxml
-
-      # Pattern matches every artifact this PR's producers might upload:
-      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
-      #                                         leg of backend-build, which
-      #                                         is a strict superset of the
-      #                                         core + proprietary legs)
-      #   jacoco-exec-e2e-live
-      #   jacoco-exec-cucumber
-      # Each lands as a sibling dir under coverage-execs/, with the .exec
-      # files preserving their original relative paths.
-      - name: Download all .exec artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          pattern: jacoco-exec-*
-          path: coverage-execs/
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Inventory .exec files
-        id: inventory
-        # Splits the downloaded artifacts into two buckets:
-        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
-        #   * all       = the above plus JUnit (everything we test)
-        #
-        # Bucketing is by artifact-name prefix: download-artifact preserves
-        # the artifact name as the top-level dir, so JUnit's `.exec`s live
-        # under coverage-execs/jacoco-exec-junit-*/... while the others
-        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
-        #
-        # If nothing was uploaded (e.g. all producers crashed before
-        # writing) we exit gracefully so this advisory job never fails CI.
-        run: |
-          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
-          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
-          if [ "${#all_execs[@]}" -eq 0 ]; then
-            echo "::warning::No .exec artifacts found - skipping aggregate report"
-            echo "found_all=false" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          printf 'All %d .exec files:\n' "${#all_execs[@]}"
-          printf '  %s\n' "${all_execs[@]}"
-          IFS=','; all_joined="${all_execs[*]}"
-          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
-          echo "found_all=true" >> "$GITHUB_OUTPUT"
-          if [ "${#e2e_execs[@]}" -eq 0 ]; then
-            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-          else
-            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
-            printf '  %s\n' "${e2e_execs[@]}"
-            unset IFS
-            IFS=','; e2e_joined="${e2e_execs[*]}"
-            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Compile classes for JaCoCo class lookup
-        # jacocoReportFromExec only needs the compiled .class files
-        # under each subproject's build/classes/java/main/. `classes`
-        # (compileJava + processResources) is enough; we skipped the
-        # heavier `assemble` to avoid building bootJar / fat jars that
-        # add 60+ seconds per run for no gain to the report.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: ./gradlew classes -PnoSpotless
-
-      - name: Generate e2e-only JaCoCo report
-        # "Real user-flow" coverage: only counts code reached by an actual
-        # HTTP request from cucumber or live Playwright. Useful for
-        # questions like "how much of our backend does a user actually
-        # hit?". Skipped when neither producer uploaded a .exec.
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
-            -PreportDir=build/reports/jacoco/aggregate-e2e \
-            -PnoSpotless
-
-      - name: Generate combined JaCoCo report (everything)
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
-            -PreportDir=build/reports/jacoco/aggregate-all \
-            -PnoSpotless
-
-      - name: E2E-only step summary
-        # Rendered first so it gets prime real estate in the Summary
-        # tab - this is the number most readers actually want
-        # ("how much of the backend do real user flows cover?").
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: ALL-sources step summary
-        # Separate call (not a multi-input one) because the helper's
-        # rightmost "Aggregate" column would sum the two reports - which
-        # is meaningless when one is a strict superset of the other.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload combined aggregate report
-        if: steps.inventory.outputs.found_all == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-all-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-all/
-          retention-days: 14
-
-      - name: Upload e2e-only aggregate report
-        if: steps.inventory.outputs.found_e2e == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-e2e-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-e2e/
-          retention-days: 14
-
-      # --------------------------------------------------------------
-      # Per-area matrix: rolls backend + frontend coverage into one
-      # table indexed by core/proprietary/saas/desktop. Pulls the
-      # frontend artifacts now (after the JaCoCo step has done its
-      # work) so the per-source backend summaries still render first
-      # even if the matrix step fails.
-      # --------------------------------------------------------------
-      - name: Download vitest coverage artifact
-        # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence so a backend-only PR still produces the matrix with
-        # just backend rows populated.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: frontend-coverage
-          path: matrix-inputs/vitest/
-        continue-on-error: true
-
-      - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads as `playwright-frontend-coverage-<run_id>`.
-        # Same tolerance as vitest - matrix script handles missing inputs.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: matrix-inputs/playwright/
-        continue-on-error: true
-
-      - name: Coverage matrix step summary
-        if: always()
-        # Matrix references the two aggregate JaCoCo XMLs (already
-        # generated above) plus whichever frontend artifacts landed.
-        # Every input is optional; missing ones render as "-".
-        run: |
-          python scripts/coverage-matrix.py \
-            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
-            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
-            --vitest matrix-inputs/vitest/coverage-summary.json \
-            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
-            --title "Coverage matrix (per-area, e2e vs all)" \
-            --github-step-summary
@@ -1,95 +0,0 @@
-name: DB migration smoke test
-
-# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
-# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
-# Catches schema changes that would break existing user databases under
-# Hibernate's `ddl-auto=update` upgrade path.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  migration-test:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    timeout-minutes: 30
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: 25
-          distribution: temurin
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.5.1
-          cache-disabled: true
-
-      # No `-PnoSpotless` here yet because the upstream cache layer matches the
-      # backend build's; reuse keeps cold-cache cost identical.
-      - name: Build Stirling-PDF JAR
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:quarkusBuild -PnoSpotless --no-daemon
-
-      - name: Locate built JAR
-        id: jar
-        run: |
-          # Quarkus (quarkus.package.jar.type=uber-jar) emits a standalone runnable
-          # jar at app/core/build/<name>-runner.jar, replacing the Spring Boot bootJar
-          # that used to land in app/core/build/libs.
-          jar=$(find app/core/build -maxdepth 1 -name '*-runner.jar' 2>/dev/null | head -n 1)
-          if [[ -z "$jar" ]]; then
-            echo "::error::No *-runner.jar under app/core/build"
-            ls -lah app/core/build || true
-            exit 1
-          fi
-          # Absolute path - the migration script pushd's into a temp workdir
-          # before invoking java, which would dangle a relative path.
-          jar=$(realpath "$jar")
-          echo "path=$jar" >> "$GITHUB_OUTPUT"
-          echo "Built JAR: $jar"
-
-      - name: Run migration smoke test
-        env:
-          STIRLING_JAR: ${{ steps.jar.outputs.path }}
-        run: bash scripts/db-migration/run-migration-test.sh
-
-      - name: Upload app logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: db-migration-app-logs
-          # Path matches the preserved workdir in run-migration-test.sh -
-          # only failing fixtures leave a directory behind.
-          path: /tmp/stirling-migration-failed-*/app.log
-          retention-days: 7
-          if-no-files-found: warn
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -10,37 +10,22 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  deploy-v2-on-push:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    concurrency:
      group: deploy-v2-push-V2
      cancel-in-progress: true
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get commit hashes for frontend and backend
@@ -105,22 +90,8 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push frontend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push frontend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-frontend.outputs.exists == 'false'
+      - name: Build and push frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -134,22 +105,8 @@ jobs:
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

-      - name: Build and push backend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-backend.outputs.exists == 'false'
+      - name: Build and push backend image
+        if: steps.check-backend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -188,7 +145,7 @@ jobs:
              environment:
                DISABLE_ADDITIONAL_FEATURES: "true"
                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2"
                UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
                UI_APPNAMENAVBAR: "V2 Deployment"
@@ -11,32 +11,21 @@ on:
        required: false
        type: string
        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 4 because bench showed 16 was within noise of 4."
-        required: false
-        type: string
-        default: "4"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  docker-compose-tests:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') }}
+    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
      checks: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -61,7 +50,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Set up Docker Buildx
@@ -87,12 +76,6 @@ jobs:
        run: |
          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt

-      - name: Extract JaCoCo agent for cucumber coverage
-        # Stages build/jacoco/jacocoagent.jar where the coverage override
-        # file bind-mounts it into the cucumber container. The agent jar
-        # never goes into the published image - this is host-only.
-        run: ./gradlew copyJacocoAgent -PnoSpotless
-
      - name: Run Docker Compose Tests
        run: |
          chmod +x ./testing/test_webpages.sh
@@ -104,62 +87,6 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
-          # over the cucumber compose so the container starts with the
-          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
-          STIRLING_PDF_TEST_COVERAGE: "1"
-
-      - name: Generate cucumber JaCoCo report
-        # `if: always()` so a behave failure still produces partial
-        # coverage from whatever endpoints did run. The exec file only
-        # exists when the container shut down cleanly - guard so the step
-        # is silent on the (rare) crash path.
-        if: always()
-        id: cucumber-coverage
-        run: |
-          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=testing/cucumber-coverage/cucumber.exec \
-              -PreportDir=build/reports/jacoco/cucumber \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml -
-        # see the script header for context.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-
-      - name: Cucumber coverage step summary
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Cucumber (docker) JaCoCo coverage" \
-            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload cucumber JaCoCo report
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-cucumber-${{ github.run_id }}
-          path: build/reports/jacoco/cucumber/
-          retention-days: 7
-
-      - name: Upload raw cucumber .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-cucumber
-          path: testing/cucumber-coverage/cucumber.exec
-          retention-days: 7
-          if-no-files-found: warn

      - name: Upload Cucumber Report
        if: always()
@@ -5,27 +5,17 @@ name: Playwright E2E (live backend)
 # server.
 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e-live:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -42,139 +32,16 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (production bundle for vite preview)
        env:
          VITE_BUILD_FOR_PREVIEW: "1"
        run: task frontend:build
-      - name: Run live E2E tests (chromium) with coverage
+      - name: Run live E2E tests (chromium)
        id: live-tests
-        env:
-          # Attaches the JaCoCo agent to the bootRun JVM (see
-          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
-          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
-          # report step below sees a populated file.
-          COVERAGE: "1"
-          # Tells the Playwright fixture (test-base.ts) to capture per-test
-          # V8 JS coverage. Raw dumps land under
-          # .test-state/playwright/coverage-pw/ for the post-process step
-          # to aggregate. Chromium-only - other engines silently skip.
-          PW_COVERAGE: "1"
        run: task e2e:live
-      - name: Generate JaCoCo report from e2e:live .exec
-        if: always()
-        id: live-coverage
-        # `if: always()` so even a failed test run still produces a
-        # report from whatever flows did exercise the backend before
-        # the failure. The task itself tolerates a missing .exec
-        # (jacoco emits an empty report rather than crashing) but we
-        # guard with `test -s` to keep the job log clean.
-        run: |
-          if [ -s .test-state/playwright/jacoco.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=.test-state/playwright/jacoco.exec \
-              -PreportDir=build/reports/jacoco/e2e-live \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set up Python for coverage summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
-        # to dodge XXE / billion-laughs scanner findings.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-      - name: e2e:live coverage step summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live backend) JaCoCo coverage" \
-            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
-            --github-step-summary
-      - name: Upload e2e:live JaCoCo report
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-e2e-live-${{ github.run_id }}
-          path: build/reports/jacoco/e2e-live/
-          retention-days: 7
-
-      - name: Upload raw e2e:live .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-e2e-live
-          path: .test-state/playwright/jacoco.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Set up Python for frontend coverage summary
-        # Separate from the backend-coverage python step because the
-        # frontend path doesn't depend on a JaCoCo report - it produces
-        # a summary even on backend failure, as long as some Playwright
-        # tests ran far enough to dump V8 coverage.
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for frontend coverage summary
-        # Idempotent re-install: the backend-coverage step may have
-        # installed it already, but this leg can run on its own when the
-        # backend report step skips (e.g. .exec missing).
-        if: always()
-        run: python -m pip install --quiet defusedxml
-
-      - name: Aggregate Playwright frontend (V8) coverage
-        # Rolls per-test V8 dumps from the test-base fixture into one
-        # vitest-shaped coverage-summary.json. Tolerates a missing dump
-        # dir (firefox/webkit runs, or a failure before any test got
-        # far enough to dump).
-        if: always()
-        id: pw-frontend-coverage
-        run: |
-          if [ -d .test-state/playwright/coverage-pw ] && \
-             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            python scripts/playwright-coverage-summary.py \
-              .test-state/playwright/coverage-pw \
-              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
-            echo "summary=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
-            echo "summary=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Playwright frontend coverage step summary
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live) frontend coverage" \
-            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-            --github-step-summary
-
-      - name: Upload Playwright frontend coverage
-        # Bundle both the aggregated summary and the raw V8 dumps so
-        # someone debugging "why is this function showing as covered"
-        # can trace it back to the source dump.
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: |
-            .test-state/playwright/coverage-pw-summary/
-            .test-state/playwright/coverage-pw/
-          retention-days: 7
-
      - name: Print backend log on failure
        if: failure() && steps.live-tests.conclusion == 'failure'
        run: |
@@ -188,30 +55,10 @@ jobs:
          name: backend-log-live-${{ github.run_id }}
          path: .test-state/playwright/backend.log
          retention-days: 7
-      - name: List Playwright output locations (debug)
-        if: always()
-        run: |
-          echo "::group::Playwright output dirs"
-          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend/editor has
-          # none), so artifacts land under frontend/, not frontend/editor/.
-          ls -la frontend/playwright-report 2>/dev/null \
-            || echo "no playwright-report at frontend/"
-          ls -la frontend/test-results 2>/dev/null \
-            || echo "no test-results at frontend/"
-          find . -name node_modules -prune -o -name 'trace.zip' -print 2>/dev/null || true
-          echo "::endgroup::"
-      - name: Upload Playwright report + traces
+      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-live-${{ github.run_id }}
-          # test-results/ holds the per-test trace.zip (with browser console
-          # logs) + screenshots/video; playwright-report/ is the HTML report.
-          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend/editor has none).
-          path: |
-            frontend/playwright-report/
-            frontend/test-results/
+          path: frontend/playwright-report/
          retention-days: 7
-          if-no-files-found: warn
@@ -5,26 +5,16 @@ name: Playwright E2E (stubbed)
 # mocks API responses in the browser.
 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 8 to match the other playwright workflows; bench showed flat scaling above 8."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -36,7 +26,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (production bundle for vite preview)
@@ -50,5 +40,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -19,20 +19,16 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  files-changed:
    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -48,15 +44,15 @@ jobs:
  generate-frontend-license-report:
    if: needs.files-changed.outputs.licenses-frontend == 'true'
    name: Generate Frontend License Report
-    needs: [pick, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: files-changed
+    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -97,7 +93,7 @@ jobs:
        run: npm ci --ignore-scripts --audit=false --fund=false

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate frontend license report (internal PR)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
        env:
@@ -110,31 +106,31 @@ jobs:
          NPM_CONFIG_IGNORE_SCRIPTS: "true"
        working-directory: frontend
        run: |
-          mkdir -p editor/src/assets
-          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json

      - name: Postprocess with project script (BASE version)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        env:
          PR_IS_FORK: "true"
        run: |
-          node base/frontend/editor/scripts/generate-licenses.js \
-            --input frontend/editor/src/assets/3rdPartyLicenses.json
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json

      - name: Copy postprocessed artifacts back (fork PRs)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        run: |
-          mkdir -p frontend/editor/src/assets
-          if [ -f "base/frontend/editor/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/editor/src/assets/3rdPartyLicenses.json frontend/editor/src/assets/3rdPartyLicenses.json
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
          fi
-          if [ -f "base/frontend/editor/src/assets/license-warnings.json" ]; then
-            cp base/frontend/editor/src/assets/license-warnings.json frontend/editor/src/assets/license-warnings.json
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
          fi

      - name: Check for license warnings
        run: |
-          if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
          else
            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
@@ -182,10 +178,10 @@ jobs:
            echo ""
            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
                echo ""
                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/editor/src/assets/license-warnings.json || true
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
              fi
            else
              echo "✅ **Passed** – no license warnings detected."
@@ -211,7 +207,7 @@ jobs:
              const fs = require('fs');
              let warningDetails = '';
              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/editor/src/assets/license-warnings.json', 'utf8'));
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
              } catch (e) {
                warningDetails = 'Unable to read warning details';
@@ -251,7 +247,7 @@ jobs:
      - name: Commit changes (Push only)
        if: github.event_name == 'push'
        run: |
-          git add frontend/editor/src/assets/3rdPartyLicenses.json
+          git add frontend/src/assets/3rdPartyLicenses.json
          # Note: Do NOT commit license-warnings.json - it's only for PR review
          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV

@@ -269,7 +265,7 @@ jobs:

          The following licenses may require review for corporate compatibility:

-          $(cat frontend/editor/src/assets/license-warnings.json | jq -r '.warnings[].message')
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')

          Please review these licenses to ensure they are acceptable for your use case."
          fi
@@ -311,18 +307,16 @@ jobs:

  generate-backend-license-report:
    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: [pick, files-changed]
+    needs: files-changed
    name: Generate Backend License Report
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -349,10 +343,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check licenses and generate report
        id: license-check
        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
@@ -11,15 +11,11 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  frontend-validation:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -31,7 +27,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Quality-check frontend
        id: frontend-check
        run: task frontend:check:all
@@ -109,44 +105,9 @@ jobs:
                comment_id: existing.id,
              });
            }
-      - name: Vitest coverage
-        # Separate from `frontend:check:all` so the quality-gate run stays
-        # uninstrumented (faster signal) and coverage stays an informational
-        # follow-up. Continue-on-error keeps the workflow green even when
-        # a handful of test files refuse to import (e.g. missing icon
-        # specifiers) - the summary still gets posted with whatever
-        # vitest managed to instrument.
-        id: frontend-coverage
-        continue-on-error: true
-        run: task frontend:test:coverage
-      - name: Set up Python for coverage summary
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # See coverage-summary.py header - it parses XML through defusedxml
-        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
-        if: always()
-        run: python -m pip install --quiet defusedxml
-      - name: Vitest coverage step summary
-        if: always()
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Frontend Vitest coverage" \
-            --vitest frontend/editor/coverage/coverage-summary.json \
-            --github-step-summary
-      - name: Upload vitest coverage report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-coverage
-          path: frontend/editor/coverage/
-          retention-days: 7
-          if-no-files-found: warn
      - name: Upload frontend build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-build
-          path: frontend/editor/dist/
+          path: frontend/dist/
          retention-days: 3
@@ -15,7 +15,7 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -36,19 +36,15 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  determine-matrix:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -73,10 +69,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: |
@@ -112,10 +108,8 @@ jobs:
          fi

  build-jars:
-    needs: [pick, determine-matrix]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    needs: determine-matrix
+    runs-on: ubuntu-latest
    strategy:
      matrix:
        variant:
@@ -133,7 +127,7 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -148,7 +142,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Setup Node.js
        if: matrix.variant.build_frontend == true
@@ -159,7 +153,7 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Build JAR
        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
@@ -195,10 +189,9 @@ jobs:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
          allowed-endpoints: >
@@ -252,10 +245,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      # Build the universal JRE before desktop:prepare so the jlink:runtime
      # task short-circuits on its `test -d runtime/jre` status check.
@@ -427,7 +420,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -440,7 +433,7 @@ jobs:
          }
          EOF
          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
+          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json

      - name: Import release GPG signing key (Linux)
        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -488,10 +481,9 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}
-          updaterJsonKeepUniversal: true

      - name: Clear release GPG key from runner keyring (Linux)
        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -515,7 +507,7 @@ jobs:
          $allSigned = $true

          # Check MSI installer (outer wrapper - what users download)
-          $msiFiles = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
          if ($msiFiles.Count -eq 0) {
            Write-Host "[ERROR] No MSI found under target/"
            exit 1
@@ -583,37 +575,21 @@ jobs:
        if: always() && steps.digicert-setup.conclusion != 'failure'
        shell: bash
        run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target

-          echo "=== tauri bundle artifacts ==="
-          find . -path "*/bundle/*" \( -name "*.msi" -o -name "*.deb" \
-            -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.dmg" \
-            -o -name "*.app.tar.gz" -o -name "*.sig" \) 2>/dev/null | sort || true
-          echo "=============================="
-
-          # createUpdaterArtifacts:true signs the native installers in place;
-          # each <bundle> ships with a sibling <bundle>.sig consumed by latest.json.
+          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
-            find . -name "*.msi.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi.sig" \;
+            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
+            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            # DMG = manual install; .app.tar.gz (+ .sig) = updater payload.
-            # Raw .app is intentionally not shipped (hundreds of MB of uncompressed input).
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app.tar.gz" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz" \;
-            find . -name "*.app.tar.gz.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz.sig" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
-            # The raw .AppImage IS its updater payload (signed -> .AppImage.sig),
-            # not a .tar.gz wrapper - that's only produced under v1Compatible.
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.deb.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb.sig" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.rpm.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm.sig" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-            find . -name "*.AppImage.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage.sig" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
@@ -624,27 +600,18 @@ jobs:
          path: ./dist/*
          retention-days: 1

-  collect-and-release:
-    needs: [pick, determine-matrix, build, build-jars]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+  create-release:
+    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+    needs: [determine-matrix, build, build-jars]
+    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

-      # Sparse-check out the verifier + pubkey before the artifact downloads
-      # so the checkout cannot clobber ./artifacts.
-      - name: Checkout updater verifier
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          sparse-checkout: |
-            .github/scripts/verify-updater-signatures.py
-            frontend/editor/src-tauri/tauri.conf.json
-          sparse-checkout-cone-mode: false
-
      - name: Download all Tauri artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
@@ -672,146 +639,17 @@ jobs:
      - name: Display structure of downloaded files
        run: ls -R ./artifacts

-      # tauri-action only emits latest.json when it also publishes the release
-      # (tagName/releaseId set). We publish separately via action-gh-release,
-      # so build latest.json here from the per-platform .sig files.
-      - name: Generate updater latest.json
-        env:
-          VERSION: ${{ needs.determine-matrix.outputs.version }}
-          TAG: v${{ needs.determine-matrix.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: |
-          python3 - << 'PYEOF'
-          import json, os, sys
-          from pathlib import Path
-          from datetime import datetime, timezone
-
-          VERSION = os.environ['VERSION']
-          TAG = os.environ['TAG']
-          REPO = os.environ['REPO']
-
-          ART = Path('./artifacts/tauri')
-
-          # Tauri updater looks up {os}-{arch}-{installer} (e.g. linux-x86_64-deb)
-          # before bare {os}-{arch}, so per-format Linux keys let deb/rpm/appimage
-          # each self-update from their matching file. macOS universal serves both
-          # arches from the one .app.tar.gz.
-          PLATFORM_MAP = [
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.deb'],
-                  'targets': ['linux-x86_64-deb'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.rpm'],
-                  'targets': ['linux-x86_64-rpm'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.AppImage'],
-                  'targets': ['linux-x86_64-appimage'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-windows-x86_64.msi'],
-                  'targets': ['windows-x86_64-msi', 'windows-x86_64'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-macos-universal.app.tar.gz'],
-                  'targets': ['darwin-x86_64', 'darwin-aarch64'],
-              },
-          ]
-
-          # rglob() because download-artifact varies layout: one artifact -> flat,
-          # many -> nested under <artifact-name>/.
-          def find_signed(name):
-              for bundle_path in sorted(ART.rglob(name)):
-                  sig_path = bundle_path.with_name(bundle_path.name + '.sig')
-                  if sig_path.exists():
-                      return bundle_path, sig_path
-              return None
-
-          platforms = {}
-          skipped = []
-          for entry in PLATFORM_MAP:
-              picked = None
-              for name in entry['bundles']:
-                  picked = find_signed(name)
-                  if picked:
-                      break
-              if not picked:
-                  skipped.append(
-                      f"{entry['targets']} (no signed bundle among "
-                      f"{entry['bundles']} - TAURI_SIGNING_PRIVATE_KEY unset "
-                      f"or createUpdaterArtifacts disabled?)"
-                  )
-                  continue
-              bundle_path, sig_path = picked
-              signature = sig_path.read_text(encoding='utf-8').strip()
-              url = f"https://github.com/{REPO}/releases/download/{TAG}/{bundle_path.name}"
-              for target in entry['targets']:
-                  platforms[target] = {'signature': signature, 'url': url}
-              print(f"Added {entry['targets']} from {bundle_path.name}")
-
-          if skipped:
-              print("Skipped platforms:")
-              for s in skipped:
-                  print(f"  - {s}")
-
-          if not platforms:
-              print(
-                  "WARN: no signed updater bundles found - "
-                  "skipping latest.json generation"
-              )
-              sys.exit(0)
-
-          manifest = {
-              'version': VERSION,
-              'notes': f"See https://github.com/{REPO}/releases/tag/{TAG}",
-              'pub_date': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'),
-              'platforms': platforms,
-          }
-
-          out = Path('./artifacts/latest.json')
-          out.write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
-          print(f"Generated {out} with platforms: {sorted(platforms.keys())}")
-          PYEOF
-
-      - name: Upload merged artifacts for review
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: release-artifacts
-          path: ./artifacts/
-          retention-days: 7
-
-      # Gate publish on valid updater sigs. Runs after the review upload (so
-      # artifacts survive for debugging) and before action-gh-release.
-      - name: Verify updater signatures
-        run: |
-          python3 -m pip install --quiet 'cryptography==44.0.0'
-          python3 .github/scripts/verify-updater-signatures.py \
-            ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
-
-      # workflow_dispatch path requires platform=='all' so a single-platform
-      # dispatch can't overwrite an existing release's full latest.json with a
-      # partial one (action-gh-release defaults overwrite_files:true).
-      # release / V2-master always build the full matrix so no extra guard needed.
-      # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
-      # instead of silently shipping a broken auto-update.
      - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
-          fail_on_unmatched_files: true
-          # Installers + updater payloads + manifest. .sig contents are embedded
-          # in latest.json so the .sig files themselves are not uploaded.
          files: |
            ./artifacts/**/*.jar
            ./artifacts/**/*.msi
            ./artifacts/**/*.dmg
-            ./artifacts/**/*.app.tar.gz
            ./artifacts/**/*.deb
            ./artifacts/**/*.rpm
            ./artifacts/**/*.AppImage
-            ./artifacts/latest.json
          draft: false
          prerelease: false
@@ -13,16 +13,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-all-browsers:
    name: Playwright (chromium + firefox + webkit)
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -37,7 +33,7 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install all Playwright browsers
        run: task e2e:install

@@ -49,5 +45,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 14
@@ -2,7 +2,7 @@ name: Update Package Manager Manifests

 on:
  release:
-    types: [released]
+    types: [ released ]
  workflow_dispatch:
    inputs:
      version:
@@ -28,7 +28,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -79,12 +79,12 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          repository: Stirling-Tools/homebrew-stirling-pdf
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
@@ -1,7 +1,8 @@
 name: Pre-commit

-# Runs the repo-wide lint/format/secret checks via `task pre-commit`.
-# Called from build.yml on PRs and merge_group; also runnable on demand via workflow_dispatch.
+# Runs `pre-commit run` for ruff / codespell / gitleaks / EOF / trailing-ws.
+# Called from build.yml on PRs and merge_group; also runnable on demand via
+# workflow_dispatch for manual local-equivalent linting.
 on:
  workflow_call:
  workflow_dispatch:
@@ -12,9 +13,13 @@ permissions:
 jobs:
  pre-commit:
    runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -24,13 +29,23 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

-      - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          enable-cache: true
+          python-version: 3.12
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Run Pre-Commit Hooks
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt

-      - name: Run pre-commit checks
-        run: task pre-commit
+      - name: Run Pre-Commit
+        run: |
+          pre-commit run ruff --all-files -c .pre-commit-config.yaml
+          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
+          pre-commit run codespell --all-files -c .pre-commit-config.yaml
+          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
+          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
+          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
+          git diff --exit-code
@@ -43,7 +43,7 @@ jobs:
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -75,7 +75,7 @@ jobs:

      - name: Generate tags for base image
        id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
@@ -53,7 +53,7 @@ jobs:
      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -78,14 +78,14 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -129,7 +129,7 @@ jobs:
      - name: Generate tags for latest
        id: meta
        if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -178,7 +178,7 @@ jobs:

      - name: Generate tags for latest-fat
        id: meta-fat
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
@@ -222,7 +222,7 @@ jobs:

      - name: Generate tags for ultra-lite
        id: meta-lite
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
@@ -18,7 +18,7 @@ jobs:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -35,7 +35,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.29.5
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
        with:
          sarif_file: results.sarif
@@ -17,12 +17,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: 30 days stale issues
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-stale: 30
@@ -22,18 +22,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -48,7 +42,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Generate Swagger documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -63,7 +57,7 @@ jobs:
          SWAGGERHUB_USER: "Frooodle"

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -11,7 +11,7 @@ on:
      - "app/core/build.gradle"
      - "app/proprietary/build.gradle"
      - "README.md"
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
      - "scripts/ignore_translation.toml"

@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -58,27 +58,19 @@ jobs:

      - name: Install Python dependencies
        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          enable-cache: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt

      - name: Sync translation TOML files
        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

-      - name: Sort translation TOML files
+      - name: pre-commit run
        run: |
-          task pre-commit:toml-sort FIX=1
+          pre-commit run toml-sort-fix --all-files

      - name: Commit translation files
        run: |
-          git add frontend/editor/public/locales/*/translation.toml
+          git add frontend/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

      - name: Sync README.md
@@ -108,7 +100,7 @@ jobs:
            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:

            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
            - Ensured consistency and synchronization across all supported language files.
            - Highlighted any missing or incomplete translations.
            - **Format**: TOML
@@ -133,5 +125,5 @@ jobs:
          sign-commits: true
          add-paths: |
            README.md
-            frontend/editor/public/locales/*/translation.toml
+            frontend/public/locales/*/translation.toml
            scripts/ignore_translation.toml
@@ -4,10 +4,6 @@ name: Build Tauri Applications
 # Linux). Called from build.yml on PRs that touch desktop sources (gated
 # via the `tauri` filter in .github/config/.files.yaml). Also runnable
 # on demand via workflow_dispatch with a per-platform selector.
-#
-# Note: editing this file is itself enough to make the `tauri` path filter
-# match, which is how non-desktop PRs (e.g. backend-only fixes) opt into a
-# desktop smoke build.
 on:
  workflow_call:
    inputs:
@@ -41,7 +37,7 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -86,10 +82,9 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -136,10 +131,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Setup Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Build universal macOS JRE
        if: matrix.platform == 'macos-15'
@@ -157,9 +152,6 @@ jobs:
          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
        run: task desktop:prepare

-      - name: Run Tauri/Cargo tests
-        run: task desktop:test
-
      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
@@ -271,6 +263,10 @@ jobs:
          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported successfully."

+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+
      - name: Check DMG creation dependencies (macOS only)
        if: matrix.platform == 'macos-15'
        run: |
@@ -301,7 +297,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -359,7 +355,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          # Linux: build deb+rpm only here. AppImage runs in its own
          # continue-on-error step below so its persistent linuxdeploy
@@ -384,7 +380,7 @@ jobs:
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: --bundles appimage

@@ -402,7 +398,7 @@ jobs:
        if: matrix.platform == 'macos-15'
        run: |
          echo "🔍 Verifying notarization status..."
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          DMG_FILE=$(find . -name "*.dmg" | head -1)
          if [ -n "$DMG_FILE" ]; then
            echo "Found DMG: $DMG_FILE"
@@ -416,22 +412,20 @@ jobs:
      - name: Rename artifacts
        shell: bash
        run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
            # Only ship the MSI installer. The loose exe and WiX toolset exes
            # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
          else
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      # Verify the MSI AND the inner exe extracted from it are signed.
@@ -509,7 +503,7 @@ jobs:
      - name: Verify build artifacts
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Check for expected artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
@@ -540,7 +534,7 @@ jobs:
      - name: Test artifact sizes
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
@@ -561,7 +555,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -652,7 +646,7 @@ jobs:
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -12,19 +12,11 @@ on:
        required: false
        type: string
        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  # TODO: extract a pre-matrix `prepare` job that runs once and produces
  # shared artifacts for the three matrix entries below to consume:
  #   1. `task backend:build` — currently runs 3× in parallel with
@@ -40,14 +32,7 @@ jobs:
  # spring-security=true matrix entry if `task backend:build` and
  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
  test-build-docker-images:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
@@ -63,7 +48,7 @@ jobs:
            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -106,11 +91,11 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Build application
        run: task backend:build
        env:
@@ -120,16 +105,10 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true
          STIRLING_PDF_DESKTOP_UI: false

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

@@ -155,22 +134,7 @@ jobs:
            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
          fi

-      - name: Build ${{ matrix.docker-rev }} (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      - name: Build ${{ matrix.docker-rev }} (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build ${{ matrix.docker-rev }}
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -198,52 +162,24 @@ jobs:
          if-no-files-found: warn

  test-build-unoserver-image:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Build docker/unoserver/Dockerfile (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Build docker/unoserver/Dockerfile (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build docker/unoserver/Dockerfile
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -20,22 +20,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  deploy:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -51,7 +41,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1

      - name: Build with Gradle
        run: ./gradlew build
@@ -61,12 +51,7 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -81,20 +66,7 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push test image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64
-
-      - name: Build and push test image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push test image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -129,7 +101,7 @@ jobs:
              environment:
                DISABLE_ADDITIONAL_FEATURES: "true"
                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF Test"
                UI_HOMEDESCRIPTION: "Test Deployment"
                UI_APPNAMENAVBAR: "Test"
@@ -153,14 +125,13 @@ jobs:
  files-changed:
    if: always()
    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -174,11 +145,12 @@ jobs:

  test:
    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [pick, deploy, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, files-changed]
+    runs-on: ubuntu-latest
+
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -208,13 +180,13 @@ jobs:
          FORCE_COLOR: "3"

  cleanup:
-    needs: [pick, deploy, test]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -23,10 +23,6 @@ customFiles/
 configs/
 watchedFolders/
 clientWebUI/
-# Scratch dir used by local fixture-regeneration runs (see
-# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
-# Holds downloaded JARs and disposable workdirs. Never committed.
-.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
@@ -42,20 +38,10 @@ SwaggerDoc.json
 # Runtime storage for uploaded files and user data (not Java source code)
 app/core/storage/

-# Frontend build artifacts copied to Quarkus static resources
-# Generated by `npm build` + the copyFrontendAssets/copyFrontendIndexHtml tasks; never committed.
-# The React bundle goes to META-INF/resources/ (Quarkus serves these over HTTP); index.html is the
-# only generated file in static/ (ReactRoutingController serves it). See app/core/build.gradle.
-app/core/src/main/resources/META-INF/resources/
-app/core/src/main/resources/static/index.html
-# Migration cleanup: earlier builds emitted the whole bundle into static/. Keep these ignored so
-# any stale generated assets left in static/ are not accidentally committed.
+# Frontend build artifacts copied to backend static resources
+# These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
-# Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
-app/core/src/main/resources/static/*.html
-!app/core/src/main/resources/static/api-landing.html
-# Prerendered nested-route pages (e.g. settings/people.html)
-app/core/src/main/resources/static/settings/
+app/core/src/main/resources/static/index.html
 app/core/src/main/resources/static/locales/
 app/core/src/main/resources/static/Login/
 app/core/src/main/resources/static/classic-logo/
@@ -63,15 +49,11 @@ app/core/src/main/resources/static/modern-logo/
 app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/sw-folder-retry.js
 app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
-app/core/src/main/resources/static/**/*.gz
-app/core/src/main/resources/static/**/*.br
-# Note: Keep backend-managed files like fonts/, css/, js/, etc.
+# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.

 # Gradle
 .gradle
@@ -175,7 +157,7 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/editor/src-tauri/provisioner/target
+frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -226,7 +208,7 @@ out/
 *.asc

 # Allow test fixture certificates (synthetic, no real credentials)
-!frontend/editor/src/core/tests/test-fixtures/certs/**
+!frontend/src/core/tests/test-fixtures/certs/**

 # SSH Keys
 *.pub
@@ -268,7 +250,7 @@ node_modules/
 *compact*.json
 test_batch.json
 *.backup.*.json
-frontend/editor/public/locales/*/translation.backup*.json
+frontend/public/locales/*/translation.backup*.json

 # Development/build artifacts
 .gradle-cache/
@@ -285,27 +267,9 @@ docs/type3/signatures/

 **/application-dev-local.properties

-# AI agent session/local files - may contain tokens and secrets
+# Claude
 .claude/
-.agents/
-.cursor/
-.codex/
-.opencode/
-.copilot/
-.cline/
-.continue/
-.windsurf/
-.junie/
-.pi/
-.roo/
-.augment/
-.aider*
-CLAUDE.local.md
-skills-lock.json

 # Playwright MCP screenshots / traces
 .playwright-mcp/
 *.playwright-mcp.png
-
-# Local screenshot artifacts from *-screenshots.spec.ts
-frontend/editor/screenshots/
@@ -1,21 +0,0 @@
-# PostHog project-level key - phc_ prefix keys are public/client-side by design
-# (PostHog client-side tracking embeds them in the browser bundle). Committed
-# intentionally in #6150 so engine/.env has a working default, with real
-# credentials overridden via engine/.env.local.
-engine/.env:generic-api-key:41
-
-# MCP test fixtures / harness - no real secrets:
-# - test-only API key constant in an integration test
-# - JDBC URL + throwaway Keycloak creds in the local test compose
-# - placeholder / shell-variable Bearer headers in curl-based validation scripts
-app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
-testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
-testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
-testing/compose/validate-mcp-test.sh:curl-auth-header:92
-testing/compose/validate-mcp-test.sh:curl-auth-header:116
-
-# Storybook example showing curl with a fake Bearer token placeholder (sk_live_a3f8...).
-frontend/shared/components/CodeBlock.stories.tsx:curl-auth-header:4
-
-# Truncated placeholder API key in portal docs example (sk_live_8f2c...e10) - not a real secret.
-frontend/portal/src/components/docs/GettingStartedSection.tsx:generic-api-key:31
@@ -1,14 +1,52 @@
-# The actual checks live in .taskfiles/pre-commit.yml (with helper scripts under
-# scripts/pre-commit/) and are driven by Task. This hook just delegates to `task
-# pre-commit` so the git pre-commit hook, CI and a manual `task pre-commit` all
-# run the exact same thing. Requires `task` and `uv` on PATH. To auto-fix instead
-# of only checking, run `task pre-commit:fix`.
 repos:
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.11
    hooks:
-      - id: task-pre-commit
-        name: task pre-commit
-        entry: task pre-commit
-        language: system
-        pass_filenames: false
-        always_run: true
+      - id: ruff
+        args:
+          - --fix
+          - --line-length=127
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+      - id: ruff-format
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.2
+    hooks:
+      - id: codespell
+        args:
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment
+          - --skip="./.*,*.csv,*.json,*.ambr"
+          - --quiet-level=2
+        files: \.(html|css|js|py|md)$
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+      - id: trailing-whitespace
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+  - repo: https://github.com/pappasam/toml-sort
+    rev: v0.24.4
+    hooks:
+      - id: toml-sort-fix
+        files: frontend/public/locales/.*\.toml$
+        args: ['--in-place', '--all', '--ignore-case']
+  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
+  #   rev: v16.21.1
+  #   hooks:
+  #     - id: stylelint
+  #       additional_dependencies:
+  #         - stylelint@16.21.1
+  #         - stylelint-config-standard@38.0.0
+  #         - "@stylistic/stylelint-plugin@3.1.3"
+  #       files: \.(css)$
+  #       args: [--fix]
@@ -18,28 +18,16 @@ version: '3'
 tasks:
  dev:
    desc: "Start backend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-
-  dev:proprietary:
-    desc: "Start backend dev server in proprietary mode"
    ignore_error: true
    vars:
      PORT: '{{.PORT | default "8080"}}'
      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
    env:
      SERVER_PORT: '{{.PORT}}'
    cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}./gradlew :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
        platforms: [linux, darwin]

  dev:bundled:
@@ -51,31 +39,6 @@ tasks:
      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
        platforms: [linux, darwin]

-  dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
-      PROFILES: '{{.PROFILES | default "dev"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-      STIRLING_FLAVOR: saas
-      AIENGINE_URL: '{{.AIENGINE_URL}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
-        platforms: [linux, darwin]
-
  build:
    desc: "Full backend build"
    cmds:
@@ -1,9 +1,7 @@
 version: '3'

 vars:
-  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
-  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
+  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"

  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
  JPDFIUM_PLATFORMS:
@@ -33,7 +31,6 @@ tasks:
  provisioner:
    desc: "Build installer provisioner"
    platforms: [windows]
-    dir: editor
    cmds:
      - node scripts/build-provisioner.mjs

@@ -41,55 +38,41 @@ tasks:
    desc: "Start Tauri desktop dev mode"
    deps: [prepare]
    ignore_error: true
-    dir: editor
    cmds:
      - npx tauri dev --no-watch

  build:
    desc: "Build Tauri desktop app (production)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build

  build:dev:
    desc: "Build Tauri desktop app (dev, no bundling)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --no-bundle

  build:dev:mac:
    desc: "Build Tauri desktop .app bundle (macOS)"
    deps: [prepare]
-    dir: editor
    cmds:
-      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles app

  build:dev:windows:
    desc: "Build Tauri desktop NSIS installer (Windows)"
    deps: [prepare]
-    dir: editor
    cmds:
-      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles nsis

  build:dev:linux:
    desc: "Build Tauri desktop AppImage (Linux)"
    deps: [prepare]
-    dir: editor
    cmds:
-      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  test:
-    desc: "Run Tauri/Cargo tests"
-    deps: [prepare]
-    dir: editor/src-tauri
-    cmds:
-      - cargo test
+      - npx tauri build --bundles appimage

  clean:
    desc: "Clean Tauri/Cargo build artifacts"
-    dir: editor
    cmds:
      - task: jlink:clean
      - cd src-tauri && cargo clean
@@ -115,56 +98,32 @@ tasks:
        platforms: [windows]
      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
        platforms: [linux, darwin]
-      - mkdir -p frontend/editor/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/editor/src-tauri/libs/
+      - mkdir -p frontend/src-tauri/libs
+      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
    status:
-      - test -f frontend/editor/src-tauri/libs/stirling-pdf-*.jar
+      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar

  jlink:runtime:
    desc: "Create custom JRE with jlink"
    deps: [jlink:jar]
-    dir: editor/src-tauri
    cmds:
-      - rm -rf runtime/jre
-      - mkdir -p runtime
-      - |
-        JLINK_COMPRESS="$(jlink --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-        jlink \
-          --add-modules {{.JLINK_MODULES}} \
-          --strip-debug \
-          --compress="$JLINK_COMPRESS" \
-          --no-header-files \
-          --no-man-pages \
-          --output runtime/jre
-      # jlink emits its files mode 444 (read-only). Tauri's build-script
-      # resource copier preserves source permissions when staging
-      # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
-      # staged copies are read-only too. On any subsequent incremental
-      # build the copier tries to overwrite them and fails with a bare
-      # `Permission denied (os error 13)` (Rust's io::Error Display drops
-      # the path, so the failure is opaque). Make the source writable here
-      # so the staged destinations are writable and can be overwritten.
-      #
-      # Trade-off: this task runs for both `task desktop:dev` and
-      # `task desktop:build`, so production bundles also ship mode-644
-      # JRE files instead of 444. Functionally harmless on POSIX (the
-      # `other` bit is `r--` either way, and on macOS code signing is the
-      # real integrity check) and on Windows the DOS read-only attribute
-      # isn't load-bearing for the bundled JDK. If we ever need strict
-      # 444 in production, split the chmod into a dev-only step and have
-      # `desktop:build` run `jlink:clean` first to force a fresh build.
-      - cmd: chmod -R u+w runtime/jre
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
-        platforms: [windows]
+      - rm -rf src-tauri/runtime/jre
+      - mkdir -p src-tauri/runtime
+      - >-
+        jlink
+        --add-modules {{.JLINK_MODULES}}
+        --strip-debug
+        --compress=zip-6
+        --no-header-files
+        --no-man-pages
+        --output src-tauri/runtime/jre
    status:
-      - test -f runtime/jre/release
+      - test -d src-tauri/runtime/jre

  jlink:clean:
    desc: "Remove JLink runtime and bundled JARs"
-    dir: editor/src-tauri
    cmds:
-      - rm -rf libs runtime
+      - rm -rf src-tauri/libs src-tauri/runtime

  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
@@ -175,7 +134,6 @@ tasks:
    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
    deps: [jlink:jar]
    platforms: [darwin]
-    dir: editor
    env:
      JLINK_MODULES: "{{.JLINK_MODULES}}"
      OUTPUT_DIR: src-tauri/runtime/jre
@@ -20,11 +20,6 @@ tasks:
    cmds:
      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .

-  build:backend:
-    desc: "Build backend-only Docker image (no embedded frontend)"
-    cmds:
-      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
-
  build:frontend:
    desc: "Build frontend-only Docker image"
    cmds:
@@ -3,14 +3,14 @@ version: '3'
 tasks:
  install:
    desc: "Install Playwright browsers"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:install' ]
    cmds:
      - npx playwright install {{.CLI_ARGS}} --with-deps

  stubbed:
    desc: "Run stubbed E2E tests"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=stubbed {{.CLI_ARGS}}
@@ -34,9 +34,6 @@ tasks:
    ignore_error: true
    vars:
      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
-    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
-    # Off by default to keep local dev runs uninstrumented; CI flips it.
    env:
      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
      # Suppress the analytics opt-in modal that fires on first admin login.
@@ -61,19 +58,12 @@ tasks:
          set -e
          rm -rf "{{.BASE_DIR}}"
          mkdir -p "{{.BASE_DIR}}"
-          GRADLE_ARGS=":stirling-pdf:bootRun"
-          if [ -n "${COVERAGE:-}" ]; then
-            # copyJacocoAgent is wired as a dependency of bootRun when
-            # -PjacocoAgent=true, so we do not need to invoke it separately.
-            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
-            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
-          fi
          # Background gradle and record its PID so the runner can clean up
          # the exact process tree (wrapper + forked Spring Boot JVM) without
          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
          # synchronised.
-          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
+          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
          GRADLE_PID=$!
          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
          wait $GRADLE_PID
@@ -82,7 +72,7 @@ tasks:
  live:runner:
    internal: true
    deps: [ ':frontend:prepare' ]
-    dir: frontend/editor
+    dir: frontend
    vars:
      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
    cmds:
@@ -151,14 +141,14 @@ tasks:
      up first with:
        task e2e:oauth:up
        task e2e:saml:up
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=enterprise {{.CLI_ARGS}}

  cross-browser:
    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
@@ -212,55 +202,3 @@ tasks:
    desc: "Stop the SAML keycloak test environment"
    cmds:
      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
-
-  mcp:up:
-    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
-    summary: |
-      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
-      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:mcp:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:mcp:up -- --validate --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:manual:
-    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
-    summary: |
-      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
-      access token so you can drive your own MCP client (Inspector, curl, ...).
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
-      Add --nobuild if the images are already built:
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:apikey:
-    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
-    summary: |
-      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
-      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
-      Add --nobuild if images are already built:
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:validate:
-    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
-    cmds:
-      - bash testing/compose/validate-mcp-test.sh
-
-  mcp:validate-apikey:
-    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
-    cmds:
-      - bash testing/compose/validate-mcp-apikey.sh
-
-  mcp:down:
-    desc: "Stop the MCP keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v
@@ -33,7 +33,7 @@ tasks:
    env:
      PYTHONUNBUFFERED: "1"
    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}

  dev:
    desc: "Start engine dev server with hot reload"
@@ -1,10 +1,5 @@
 version: '3'

-# Tasks operate from the workspace root (frontend/). Editor commands pass
-# `editor` as the vite project root (positional after `build` / before the
-# mode flag) or use `--project editor/...` for tsc — so the editor lives
-# under frontend/editor/ without each task needing a cd.
-
 tasks:
  install:
    desc: "Install dependencies"
@@ -26,34 +21,19 @@ tasks:
    vars:
      MODE: '{{.MODE | default ""}}'
    cmds:
-      - npx tsx editor/scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
+      - npx tsx scripts/setup-env.ts{{if .MODE}} --{{.MODE}}{{end}}
    sources:
-      - editor/scripts/setup-env.mts
+      - scripts/setup-env.ts
    generates:
-      - editor/.env.local
-      - editor/.env{{if .MODE}}.{{.MODE}}{{end}}.local
+      - .env.local
+      - .env{{if .MODE}}.{{.MODE}}{{end}}.local

  prepare:icons:
    internal: true
    run: once
    deps: [install]
    cmds:
-      - node editor/scripts/generate-icons.js
-
-  prepare:og:
-    internal: true
-    run: when_changed
-    desc: "Regenerate OG/social-preview metadata from the tool registry"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs
-    sources:
-      - editor/src/core/types/toolId.ts
-      - editor/src/core/utils/urlMapping.ts
-      - editor/src/core/data/useTranslatedToolRegistry.tsx
-      - editor/public/og_images/*.png
-    generates:
-      - editor/src/core/data/ogImageMap.json
-      - editor/public/og-metadata.json
+      - node scripts/generate-icons.js

  prepare:
    desc: "Set up dev environment"
@@ -64,7 +44,6 @@ tasks:
      - task: prepare:env
        vars: { MODE: '{{.MODE}}' }
      - prepare:icons
-      - prepare:og

  # ============================================================
  # Development
@@ -81,7 +60,7 @@ tasks:
    env:
      BACKEND_URL: '{{.BACKEND_URL}}'
    cmds:
-      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
+      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}

  dev:
    desc: "Start frontend dev server"
@@ -128,12 +107,6 @@ tasks:
      - task: dev:_run
        vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }

-  dev:portal:
-    desc: "Start developer portal dev server"
-    deps: [install]
-    cmds:
-      - npx vite portal --port {{.PORT | default "5173"}}{{if .OPEN}} --open{{end}}
-
  # ============================================================
  # Build
  # ============================================================
@@ -142,19 +115,19 @@ tasks:
    desc: "Production build (default mode)"
    deps: [prepare]
    cmds:
-      - npx vite build editor
+      - npx vite build

  build:core:
    desc: "Build for core mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode core
+      - npx vite build --mode core

  build:proprietary:
    desc: "Build for proprietary mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode proprietary
+      - npx vite build --mode proprietary

  build:saas:
    desc: "Build for SaaS mode"
@@ -162,7 +135,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx vite build editor --mode saas
+      - npx vite build --mode saas

  build:desktop:
    desc: "Build for desktop mode"
@@ -170,31 +143,13 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx vite build editor --mode desktop
+      - npx vite build --mode desktop

  build:prototypes:
    desc: "Build for prototypes mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode prototypes
-
-  build:portal:
-    desc: "Build developer portal"
-    deps: [install]
-    cmds:
-      - npx vite build portal
-
-  storybook:
-    desc: "Start Storybook dev server"
-    deps: [install]
-    cmds:
-      - npx storybook dev -p 6006 {{.CLI_ARGS}}
-
-  storybook:build:
-    desc: "Build static Storybook"
-    deps: [install]
-    cmds:
-      - npx storybook build {{.CLI_ARGS}}
+      - npx vite build --mode prototypes

  # ============================================================
  # Code quality
@@ -203,23 +158,9 @@ tasks:
  lint:
    desc: "Run linting"
    deps: [install]
-    cmds:
-      - task: lint:eslint
-      - task: lint:dpdm
-
-  lint:eslint:
-    desc: "Run ESLint linting"
-    deps: [install]
    cmds:
      - npx eslint --max-warnings=0
-
-  lint:dpdm:
-    desc: "Run circular import linting"
-    deps: [install]
-    cmds:
-      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
-      # shell-agnostic. Covers editor, portal, and the shared design system.
-      - npx dpdm "editor/src/**/*.{ts,tsx}" "portal/src/**/*.{ts,tsx}" "shared/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
+      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1

  lint:fix:
    desc: "Auto-fix lint issues"
@@ -254,13 +195,13 @@ tasks:
    desc: "Typecheck core build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/src/core/tsconfig.json
+      - npx tsc --noEmit --project src/core/tsconfig.json

  typecheck:proprietary:
    desc: "Typecheck proprietary build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/src/proprietary/tsconfig.json
+      - npx tsc --noEmit --project src/proprietary/tsconfig.json

  typecheck:saas:
    desc: "Typecheck SaaS build variant"
@@ -268,7 +209,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx tsc --noEmit --project editor/src/saas/tsconfig.json
+      - npx tsc --noEmit --project src/saas/tsconfig.json

  typecheck:desktop:
    desc: "Typecheck desktop build variant"
@@ -276,37 +217,19 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx tsc --noEmit --project editor/src/desktop/tsconfig.json
-
-  typecheck:cloud:
-    desc: "Typecheck cloud shared layer (standalone)"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project editor/src/cloud/tsconfig.json
+      - npx tsc --noEmit --project src/desktop/tsconfig.json

  typecheck:scripts:
    desc: "Typecheck scripts"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/scripts/tsconfig.json
+      - npx tsc --noEmit --project scripts/tsconfig.json

  typecheck:prototypes:
    desc: "Typecheck prototypes build variant"
    deps: [prepare]
    cmds:
-      - npx tsc --noEmit --project editor/src/prototypes/tsconfig.json
-
-  typecheck:portal:
-    desc: "Typecheck developer portal build variant"
-    deps: [install]
-    cmds:
-      - npx tsc --noEmit --project portal/tsconfig.json
-
-  typecheck:shared:
-    desc: "Typecheck the shared design system"
-    deps: [install]
-    cmds:
-      - npx tsc --noEmit --project shared/tsconfig.json
+      - npx tsc --noEmit --project src/prototypes/tsconfig.json

  typecheck:all:
    desc: "Typecheck all build variants"
@@ -315,11 +238,8 @@ tasks:
      - task: typecheck:proprietary
      - task: typecheck:saas
      - task: typecheck:desktop
-      - task: typecheck:cloud
      - task: typecheck:scripts
      - task: typecheck:prototypes
-      - task: typecheck:portal
-      - task: typecheck:shared

  # ============================================================
  # Quality Gate
@@ -333,24 +253,14 @@ tasks:
      - task: format:check
      - task: test

-  og:check:
-    desc: "Fail if committed OG/social-preview metadata is out of date"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs --check
-
  check:all:
    desc: "Full CI quality gate"
    cmds:
-      # Runs first, before prepare regenerates: guards the committed og-metadata.json /
-      # ogImageMap.json that the Cloudflare Pages (plain `vite build`) deploy relies on.
-      - task: og:check
      - task: typecheck:all
      - task: lint
      - task: format:check
      - task: build
-      - task: build:portal
      - task: test
-      - task: storybook:build

  # ============================================================
  # Test
@@ -358,36 +268,21 @@ tasks:

  test:
    desc: "Run tests"
-    deps: [prepare]
+    deps: [install]
    cmds:
-      - npx vitest run --root editor
+      - npx vitest run

  test:watch:
    desc: "Run tests in watch mode"
-    deps: [prepare]
+    deps: [install]
    cmds:
-      - npx vitest --watch --root editor
+      - npx vitest --watch

  test:coverage:
-    desc: "Run tests with coverage (one-shot; CI-friendly)."
-    deps: [prepare]
+    desc: "Run tests with coverage"
+    deps: [install]
    cmds:
-      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
-      # mode). Explicit reporter list because v8 + json-summary is what the
-      # coverage-summary.py helper consumes; html/text are kept for humans.
-      #
-      # reportsDirectory is pinned to ./coverage relative to vitest's root
-      # (--root editor), so output lands at frontend/editor/coverage/. The
-      # CI upload step reads from that path. An earlier attempt with
-      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
-      # pinning future-proofs against vitest changing the default.
-      - >
-        npx vitest run --root editor --coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage
+      - npx vitest --coverage

  # ============================================================
  # Code Generation
@@ -397,16 +292,4 @@ tasks:
    desc: "Generate frontend license report"
    deps: [install]
    cmds:
-      - node editor/scripts/generate-licenses.js
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean build artifacts and caches"
-    cmds:
-      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, editor/dist, dist, dist-portal
-        platforms: [windows]
-      - cmd: rm -rf node_modules/.vite editor/dist dist dist-portal
-        platforms: [linux, darwin]
+      - node scripts/generate-licenses.js
@@ -1,159 +0,0 @@
-version: '3'
-
-# Repo-wide lint/format/secret checks - the single source of truth that the git
-# pre-commit hook (.pre-commit-config.yaml) and CI (pre_commit.yml) both call.
-
-vars:
-  GITLEAKS: '8.30.0'
-
-  # File selections as git pathspecs: git does the include/exclude matching, so
-  # there is no grep/xargs and it behaves identically on every platform.
-  PY_FILES: >-
-    'scripts/*.py'
-    '.github/scripts/*.py'
-    'app/core/src/main/resources/static/python/*.py'
-    ':(exclude)*split_photos.py'
-  SPELL_FILES: >-
-    '*.html'
-    '*.css'
-    '*.js'
-    '*.py'
-    '*.md'
-    ':(exclude).vscode/*'
-    ':(exclude).devcontainer/*'
-    ':(exclude)app/core/src/main/resources/*'
-    ':(exclude)app/proprietary/src/main/resources/*'
-    ':(exclude)frontend/editor/public/vendor/*'
-    ':(exclude)*Dockerfile*'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-  WS_FILES: >-
-    '*.js'
-    '*.java'
-    '*.py'
-    '*.yml'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-    ':(exclude).github/workflows/*'
-  LOCALE_TOML: 'frontend/editor/public/locales/*/translation.toml'
-
-  GITLEAKS_BIN: '.task/bin/gitleaks-{{.GITLEAKS}}{{if eq OS "windows"}}.exe{{end}}'
-
-tasks:
-  default:
-    desc: "Check formatting, spelling, and secrets across the repo"
-    cmds:
-      - task: ruff
-      - task: ruff-format
-      - task: codespell
-      - task: gitleaks
-      - task: whitespace
-      - task: toml-sort
-
-  fix:
-    desc: "Auto-fix formatting, spelling, and secrets issues across the repo"
-    cmds:
-      # Auto-fixers first, then the report-only tools (codespell, gitleaks) so a
-      # finding there does not stop the fixers from running.
-      - task: ruff
-        vars: { FIX: '1' }
-      - task: ruff-format
-        vars: { FIX: '1' }
-      - task: whitespace
-        vars: { FIX: '1' }
-      - task: toml-sort
-        vars: { FIX: '1' }
-      - task: codespell
-      - task: gitleaks
-
-  install:
-    desc: "Install the pinned pre-commit Python tools (ruff, codespell, toml-sort)"
-    run: once
-    cmds:
-      - uv sync --project scripts/pre-commit --locked
-    sources:
-      - scripts/pre-commit/uv.lock
-      - scripts/pre-commit/pyproject.toml
-    status:
-      - test -d scripts/pre-commit/.venv
-
-  clean:
-    desc: "Remove the cache/build artifacts"
-    cmds:
-      - task: '{{if eq OS "windows"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    cmds:
-      - rm -rf scripts/pre-commit/.venv .task/bin/gitleaks-*
-
-  # On Windows, use PowerShell so it matches the same paths and tolerates absent
-  # files without erroring.
-  clean-windows:
-    internal: true
-    ignore_error: true
-    cmds:
-      - powershell -NoProfile -Command "Remove-Item -Recurse -Force -ErrorAction SilentlyContinue scripts/pre-commit/.venv, .task/bin/gitleaks-*"
-
-  # Individual checks (hidden from `task --list`, but callable, e.g.
-  # `task pre-commit:toml-sort FIX=1`). Pass FIX=1 to auto-fix where supported.
-  ruff:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
-
-  ruff-format:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
-
-  codespell:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment,vertx --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
-
-  toml-sort:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync toml-sort --all --ignore-case {{if .FIX}}--in-place{{else}}--check{{end}} {{.LOCALE_TOML}}
-
-  whitespace:
-    cmds:
-      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}$(git ls-files {{.WS_FILES}})
-
-  gitleaks:
-    deps: [gitleaks-bin]
-    # Scan staged changes only, matching the old hook: the git-mode fingerprints
-    # in .gitleaksignore (file:rule:line) still apply, and with nothing staged
-    # this is a no-op. Secrets are never auto-fixed, so FIX has no effect.
-    cmds:
-      - "{{.GITLEAKS_BIN}} git --pre-commit --redact --staged --verbose"
-
-  gitleaks-bin:
-    internal: true
-    desc: "Ensure the pinned gitleaks binary is cached in .task/bin"
-    status:
-      - test -f {{.GITLEAKS_BIN}}
-    vars:
-      GL_ARCH: '{{if eq ARCH "amd64"}}x64{{else if eq ARCH "arm64"}}arm64{{else if eq ARCH "386"}}x32{{else}}{{ARCH}}{{end}}'
-      GL_PLATFORM: '{{OS}}_{{.GL_ARCH}}'
-      GL_URL: 'https://github.com/gitleaks/gitleaks/releases/download/v{{.GITLEAKS}}/gitleaks_{{.GITLEAKS}}_{{.GL_PLATFORM}}'
-      # SHA-256 of each release asset, from gitleaks_{{.GITLEAKS}}_checksums.txt.
-      GL_SHA: >-
-        {{if eq .GL_PLATFORM "linux_x64"}}79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e
-        {{- else if eq .GL_PLATFORM "linux_arm64"}}b4cbbb6ddf7d1b2a603088cd03a4e3f7ce48ee7fd449b51f7de6ee2906f5fa2f
-        {{- else if eq .GL_PLATFORM "darwin_x64"}}ca221d012d247080c2f6f61f4b7a83bffa2453806b0c195c795bbe9a8c775ed5
-        {{- else if eq .GL_PLATFORM "darwin_arm64"}}b251ab2bcd4cd8ba9e56ff37698c033ebf38582b477d21ebd86586d927cf87e7
-        {{- else if eq .GL_PLATFORM "windows_x64"}}54fe94f644b832dd08e8c3a5915efb3bfa862386d59fb27ca0792cb687a83573
-        {{- end}}
-    cmds:
-      - cmd: bash scripts/pre-commit/install-gitleaks.sh "{{.GL_URL}}.tar.gz" "{{.GL_SHA}}" "{{.GITLEAKS_BIN}}"
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -File scripts/pre-commit/install-gitleaks.ps1 -Url "{{.GL_URL}}.zip" -Sha "{{.GL_SHA}}" -Dest "{{.GITLEAKS_BIN}}"
-        platforms: [windows]
@@ -10,14 +10,14 @@ When adding tools, follow this systematic approach using the established pattern

 Create these files in the correct directories:
 ```
-frontend/editor/src/hooks/tools/[toolName]/
+frontend/src/hooks/tools/[toolName]/
  ├── use[ToolName]Parameters.ts     # Parameter definitions and validation
  └── use[ToolName]Operation.ts      # Tool operation logic using useToolOperation

-frontend/editor/src/components/tools/[toolName]/
+frontend/src/components/tools/[toolName]/
  └── [ToolName]Settings.tsx         # Settings UI component (if needed)

-frontend/editor/src/tools/
+frontend/src/tools/
  └── [ToolName].tsx                 # Main tool component
 ```

@@ -128,7 +128,7 @@ export default [ToolName] as ToolComponent;
 ## 3. Register Tool in System
 Update these files to register your new tool:

-**Tool Registry** (`frontend/editor/src/data/useTranslatedToolRegistry.tsx`):
+**Tool Registry** (`frontend/src/data/useTranslatedToolRegistry.tsx`):
 1. Add imports at the top:
 ```typescript
 import [ToolName] from "../tools/[ToolName]";
@@ -155,7 +155,7 @@ import [ToolName]Settings from "../components/tools/[toolName]/[ToolName]Setting
 ## 4. Add Tooltips (Optional but Recommended)
 Create user-friendly tooltips to help non-technical users understand your tool. **Use simple, clear language - avoid technical jargon:**

-**Tooltip Hook** (`frontend/editor/src/components/tooltips/use[ToolName]Tips.ts`):
+**Tooltip Hook** (`frontend/src/components/tooltips/use[ToolName]Tips.ts`):
 ```typescript
 import { useTranslation } from 'react-i18next';
 import { TooltipContent } from '../../types/tips';
@@ -200,9 +200,9 @@ const [ToolName] = (props: BaseToolProps) => {
 ```

 ## 5. Add Translations
-Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.
+Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.

-**File to update:** `frontend/editor/public/locales/en-US/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.toml`

 **Required Translation Keys**:
 ```toml
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-US` files** - other langu
 ```

 **Translation Notes:**
- **Only update `en-US/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions
@@ -139,9 +139,9 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie

 #### Environment Variables
 - All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/editor/.env` — core, proprietary, and shared vars
-  - `frontend/editor/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/editor/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
+  - `frontend/.env` — core, proprietary, and shared vars
+  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
+  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
 - These files are committed to Git and must not contain private keys
 - Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
 - Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
@@ -152,7 +152,7 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 #### Import Paths - CRITICAL
 **ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.

-For a broader explanation of the frontend layering and override architecture, see [frontend/editor/DeveloperGuide.md](frontend/editor/DeveloperGuide.md).
+For a broader explanation of the frontend layering and override architecture, see [frontend/DeveloperGuide.md](frontend/DeveloperGuide.md).

 ```typescript
 // ✅ CORRECT - Use @app/* for all imports
@@ -169,31 +169,7 @@ import { useFileContext } from "@proprietary/contexts/FileContext";
 - Building layer-specific override that wraps a lower layer's component
 - Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version

-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/saas/desktop/cloud) and handles the fallback cascade — see "Frontend `cloud/` Layer" below for the full per-flavor order.
-
-#### Frontend `cloud/` Layer
-
-`@app/*` resolves through a per-flavor cascade — first existing file wins (shadow/override):
-
- **core** → core
- **proprietary** → proprietary → core
- **saas** → saas → cloud → proprietary → core
- **desktop** → desktop → cloud → proprietary → core
- **cloud** → cloud → proprietary → core
-
-What goes where:
-
- **core** — OSS base.
- **proprietary** — licensed / offline features.
- **cloud** — the SHARED hosted/SaaS experience used by BOTH saas + desktop: PAYG, wallet, plan, billing, usage meters, cloud config/team/onboarding.
- **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
- **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.
-
-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
-
-Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).
-
-**Cloud feature flags on desktop.** The local `AppConfigContext` reads `/api/v1/config/app-config` from the LOCAL bundled backend, so cloud-only flags (`aiEngineEnabled`, `premiumEnabled`, …) are never seen on desktop. To read the cloud's view, use `useSaasAppConfig()` (`desktop/hooks/useSaasAppConfig.ts`, backed by the general `saasAppConfigService` — SaaS-mode-only, public endpoint, native HTTP, 5-min cache). It returns `null` outside SaaS mode, so cloud features stay off in local/self-hosted and the server keeps the on/off switch (no desktop release needed to flip a flag). Gate a feature behind a per-platform seam — e.g. `useAiEngineEnabled()` (core reads `useAppConfig()`, desktop reads `useSaasAppConfig()`) — rather than hardcoding the flag on.
+The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.

 #### Component Override Pattern (Stub/Shadow)
 Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
@@ -267,7 +243,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `frontend/editor/src/core/contexts/FileContext.tsx`
+**Location**: `frontend/src/core/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -292,7 +268,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -380,7 +356,7 @@ return useToolOperation({
 ### Frontend Directory Structure
 The frontend is organized with a clear separation of concerns:

- **`frontend/editor/src/core/`**: Main application code (shared, production-ready components)
+- **`frontend/src/core/`**: Main application code (shared, production-ready components)
  - **`core/components/`**: React components organized by feature
    - `core/components/tools/`: Individual PDF tool implementations
    - `core/components/viewer/`: PDF viewer components
@@ -398,17 +374,17 @@ The frontend is organized with a clear separation of concerns:
  - **`core/data/`**: Static data (tool taxonomy, etc.)
  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)

- **`frontend/editor/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/editor/src/proprietary/`**: Proprietary/licensed features
- **`frontend/editor/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/editor/public/`**: Static assets served directly
+- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/src/proprietary/`**: Proprietary/licensed features
+- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/public/`**: Static assets served directly
  - `public/locales/`: Translation JSON files

 ### Component Architecture
- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/editor/public/` (modern)
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/editor/public/locales/` (converted from .properties)
+  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
  - Conversion Script: `scripts/convert_properties_to_json.py`

 ### Configuration Modes
@@ -433,7 +409,7 @@ The frontend is organized with a clear separation of concerns:
 4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
 5. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/editor/public/locales/` or use conversion script
+   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
 6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status
@@ -450,8 +426,8 @@ The frontend is organized with a clear separation of concerns:

 ## Translation Rules

- **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
- Translation files are located in `frontend/editor/public/locales/`
+- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
+- Translation files are located in `frontend/public/locales/`

 ## Important Notes

@@ -482,26 +458,3 @@ The frontend is organized with a clear separation of concerns:
 - Confirm approach before making structural changes
 - Request guidance on preferences (cross-platform vs specific tools, etc.)
 - Verify understanding of requirements before proceeding
-
-
-## Stack reality check (don't trust LLM training data) <!-- bleeding-edge-stack-note -->
-
-This codebase is on bleeding-edge versions of its core JVM stack: **Spring Boot 4.0.6**,
-**Jackson 3 (`tools.jackson`)**, **JDK 21/25 source/target with JDK 25 toolchain**.
-All three are *post*-2024 releases and your training corpus is overwhelmingly Spring Boot 2/3 and
-Jackson 2 patterns — those patterns will compile, run differently, or hallucinate APIs that no
-longer exist.
-
-Before writing or editing Spring / Jackson / JDK code:
-
-1. Open an existing module in `app/core/` or `app/common/` and grep for the actual imports being
-   used — `import tools.jackson...` not `import com.fasterxml.jackson...`, and the new
-   `org.springframework.boot` 4.x package layout.
-2. If you're not sure whether an API exists in this stack version, **check the source on disk
-   first** (the dependency JARs are downloaded under `~/.gradle/caches/modules-2/`).
-3. Do not silently downgrade a Spring Boot 4 pattern to a Spring Boot 3 equivalent. If something
-   doesn't work, surface it to the human — don't guess.
-
-Same goes for Jackson 3's API surface (renamed `ObjectMapper` builder methods, new
-`tools.jackson.databind` namespace) and JDK 25 preview features. Ground your code in this repo's
-actual imports, not what worked three years ago.
@@ -52,17 +52,6 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)

-### Optional System Dependencies
-
-These are not required to run the app but enable specific features. The app detects them at startup and disables the relevant features if they are missing.
-
-| Dependency | Feature | Install |
-|---|---|---|
-| LibreOffice | File-to-PDF conversions | `brew install libreoffice` / `apt install libreoffice` |
-| Tesseract | OCR | `brew install tesseract` / `apt install tesseract-ocr` |
-| WeasyPrint | AI document creation | `brew install weasyprint` / `apt install weasyprint` |
-| qpdf | PDF optimisation | `brew install qpdf` / `apt install qpdf` |
-
 ### Setup Steps

 1. Clone the repository:
@@ -139,26 +128,24 @@ See [the frontend README](frontend/README.md#tauri) for detailed build instructi
 Stirling-PDF/
 ├── .github/               # GitHub-specific files (workflows, issue templates)
 ├── configs/               # Configuration files used by stirling at runtime (generated at runtime)
-├── frontend/              # Frontend workspace (Stirling 2.0)
-│   ├── editor/            # PDF editor app (the original React SPA)
-│   │   ├── src/
-│   │   │   ├── components/    # React components
-│   │   │   ├── tools/         # Tool-specific React components
-│   │   │   ├── hooks/         # Custom React hooks
-│   │   │   ├── services/      # API and utility services
-│   │   │   ├── types/         # TypeScript type definitions
-│   │   │   └── utils/         # Utility functions
-│   │   ├── src-tauri/     # Tauri desktop app configuration
-│   │   │   ├── src/           # Rust backend code
-│   │   │   ├── libs/          # JAR files (generated by build scripts)
-│   │   │   ├── runtime/       # Bundled JRE (generated by build scripts)
-│   │   │   ├── Cargo.toml     # Rust dependencies
-│   │   │   └── tauri.conf.json # Tauri configuration
-│   │   ├── public/
-│   │   │   └── locales/       # Internationalization files (JSON)
-│   │   └── vite.config.ts     # Vite configuration
-│   ├── package.json       # Shared workspace dependencies
-│   └── eslint.config.mjs  # Shared lint config
+├── frontend/              # React SPA frontend (Stirling 2.0)
+│   ├── src/
+│   │   ├── components/    # React components
+│   │   ├── tools/         # Tool-specific React components
+│   │   ├── hooks/         # Custom React hooks
+│   │   ├── services/      # API and utility services
+│   │   ├── types/         # TypeScript type definitions
+│   │   └── utils/         # Utility functions
+│   ├── src-tauri/         # Tauri desktop app configuration
+│   │   ├── src/           # Rust backend code
+│   │   ├── libs/          # JAR files (generated by build scripts)
+│   │   ├── runtime/       # Bundled JRE (generated by build scripts)
+│   │   ├── Cargo.toml     # Rust dependencies
+│   │   └── tauri.conf.json # Tauri configuration
+│   ├── public/
+│   │   └── locales/       # Internationalization files (JSON)
+│   ├── package.json       # Frontend dependencies
+│   └── vite.config.ts     # Vite configuration
 ├── customFiles/           # Custom static files and templates (generated at runtime used to replace existing files)
 ├── docs/                  # Documentation files
 ├── exampleYmlFiles/       # Example YAML configuration files
@@ -458,7 +445,7 @@ For Stirling 2.0, new features are built as React components:

 1. **Create the React Component:**
   ```typescript
-   // frontend/editor/src/tools/NewTool.tsx
+   // frontend/src/tools/NewTool.tsx
   import { useState } from 'react';
   import { Button, FileInput, Container } from '@mantine/core';

@@ -587,7 +574,7 @@ When adding a new feature or modifying existing ones in Stirling-PDF, you'll nee
 Find the existing `messages.properties` files in the `stirling-pdf/src/main/resources` directory. You'll see files like:

 - `messages.properties` (default, usually English)
- `messages_en_US.properties`
+- `messages_en_GB.properties`
 - `messages_fr_FR.properties`
 - `messages_de_DE.properties`
 - etc.
@@ -10,18 +10,14 @@ if that directory exists, is licensed under the license defined in "app/propriet
 if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
-* All content that resides under the "frontend/editor/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/proprietary/LICENSE".
-* All content that resides under the "frontend/editor/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/desktop/LICENSE".
-* All content that resides under the "frontend/editor/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/saas/LICENSE".
-* All content that resides under the "frontend/editor/src/cloud/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/cloud/LICENSE".
-* All content that resides under the "frontend/editor/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
-* All content that resides under the "frontend/portal/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/portal/LICENSE".
+* All content that resides under the "frontend/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
+* All content that resides under the "frontend/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
+* All content that resides under the "frontend/src/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
+* All content that resides under the "frontend/src/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.

@@ -1,563 +0,0 @@
-# Stirling-PDF: Spring Boot → Quarkus Migration — Continuation Handoff
-
-> **Purpose:** everything needed to resume this migration in a fresh session. Read this top-to-bottom
-> before touching anything. Companion doc `migration-report.md` has the higher-level summary; this
-> file is the working/continuation guide with the concrete state, commands, fixed bugs, remaining
-> bugs, and the recurring patterns you need to apply.
-
---
-
-## 0. TL;DR status
-
- **2026-06-19 — merged `main` (136 commits) into `migration/run-02`.** Resolved 69 conflicts and
-  did **full Spring removal + Quarkus migration of every newly pulled-in file** (36 Spring-bearing
-  files: 21 proprietary + 15 saas). Net effect on main: legacy credits engine deleted (#6687,
-  replaced by PAYG #6589); the proprietary **policy** subsystem and the new **PAYG** subsystem
-  migrated to CDI/JAX-RS/Panache. Verified: 0 conflict markers, 0 `org.springframework` imports in
-  any main source. **`core` + `proprietary` compile; `proprietary` Quarkus-augments + boots + serves
-  real traffic; `saas` now compiles AND augments too** (previously ~28 CDI issues). Cross-file fix:
-  `PolicyExecutor`/`DownstreamEntitlementError` now carry HTTP status+body via
-  `jakarta.ws.rs.WebApplicationException` (was Spring `RestClientResponseException`);
-  `AiWorkflowService.paygLimitResponseOrNull` rewired to it. Repo `save()` shim added to the Panache
-  repos whose callers/tests expect Spring-Data `save()`.
- **Branch:** `migration/run-01` (all work committed locally, **nothing pushed** — `origin` is the
-  public `Stirling-Tools/Stirling-PDF` repo; do not push without the owner's say-so).
- **Default flavor (`proprietary`):** compiles, Quarkus-augments, boots, and serves real traffic in
-  Docker. ✅
- **Cucumber API e2e (full-tool Docker image):** baselines, newest first:
-  - **Run 2 (login off, this session's fixes, no JWT mechanism): 223 / 258 pass**, 35 failed, 80
-    skipped. Up from the prior **183 / 258** baseline (+40). Eliminated buckets: split
-    `PDF corrupted` 8→0, `FileAlreadyExists` 8→0, `Admin login failed (500)` 17→0.
-  - **Run 3 (login off + `V2=true` + the new JWT Bearer mechanism): the 80 JWT/admin scenarios now
-    RUN (0 skipped)** because the `login → /me` probe passes. See §6.E / "Session 2". Final tally
-    recorded in §9.
- **Stack:** Quarkus 3.33.2 LTS, **Java 25** (mandatory — see §2), Hibernate ORM Panache,
-  quarkus-rest (RESTEasy Reactive), quarkus-oidc, quarkus-undertow (servlet, for filters), OpenSAML 5.
- **`saas` flavor:** compiles but full augmentation has ~28 CDI issues (design-level follow-up).
- **JWT Bearer login:** ✅ works end-to-end (token issue + validate → `SecurityIdentity`, role
-  mapping, `@RolesAllowed`). **OAuth2/OIDC + SAML2 SSO:** ✅ both work end-to-end against the
-  `testing/compose` Keycloak stacks; `validate-oauth-test.sh` and `validate-saml-test.sh` both pass
-  (see §6.F). The default e2e Docker image + build helper are committed at `docker/quarkus/` (§3.3).
-
---
-
-## 1. Repo / flavor layout
-
-Multi-module Gradle build, three selectable flavors via `STIRLING_FLAVOR` (or `ENABLE_SAAS` /
-`DISABLE_ADDITIONAL_FEATURES`):
-
-| Flavor | Modules included | Notes |
-|--------|------------------|-------|
-| `core` | `:common`, `:stirling-pdf` (core) | OSS only |
-| `proprietary` (**default**) | + `:proprietary` | what all the e2e work targets |
-| `saas` | + `:saas` | opt-in: `STIRLING_FLAVOR=saas`; not yet augmentable |
-
-Module → directory:
- `:stirling-pdf` → `app/core` (the runnable Quarkus app; applies the `io.quarkus` gradle plugin)
- `:common` → `app/common` (library; CDI beans / JAX-RS / entities)
- `:proprietary` → `app/proprietary` (library)
- `:saas` → `app/saas` (library, only on saas flavor)
-
-Quarkus only discovers beans/entities in dependency jars that carry a **Jandex index**; the library
-modules are indexed via `quarkus.index-dependency.*` in
-`app/core/src/main/resources/application.properties`.
-
---
-
-## 2. Java 25 is mandatory (don't regress this)
-
- The build uses a **JDK 25 toolchain** (`build.gradle` `subprojects { java { toolchain = 25 } }`).
- The app is compiled to **class-file version 69 (Java 25)** — it will NOT run on JDK 21.
- **The host's default `java` on the PATH is JDK 21.** Use the toolchain JDK 25 explicitly:
-  - `JAVA_HOME` points to a Temurin 25 JDK (`C:\Users\systo\scoop\apps\temurin25-jdk\current`).
-  - In Git Bash run the jar with `"$JAVA_HOME/bin/java" -jar ...` (host `java` = 21 → `UnsupportedClassVersionError`).
- The Docker base image `stirlingtools/stirling-pdf-base:1.0.2` ships **Temurin 25.0.2** — so the
-  container runtime is JDK 25 already. Keep it that way; do not switch the base image to a JRE < 25.
- Gradle build images / CI also pin `gradle:9.3.1-jdk25` and `eclipse-temurin:25-jre-noble`.
-
---
-
-## 3. Build → package → run → test (the exact loop)
-
-### 3.1 Build the runnable jar
-```bash
-./gradlew :stirling-pdf:quarkusBuild -x test --console=plain
-```
- Produces the **runnable uber-jar** at: `app/core/build/stirling-pdf-2.12.0-runner.jar`
-  - `Main-Class: stirling.software.SPDF.SPDFApplication`.
- ⚠️ **GOTCHA:** `app/core/build/libs/stirling-pdf-2.12.0.jar` is the *plain* (non-runnable) jar with
-  an empty manifest. The upstream `docker/embedded/Dockerfile` copies `libs/*.jar` — that's now the
-  WRONG jar. Always use the `-runner.jar`. (`quarkus.package.jar.type=uber-jar` is set in
-  application.properties.)
- ⚠️ If the build fails with `Unable to delete .../-runner.jar`, a previous `java -jar` is still
-  holding it. Kill it: PowerShell `Get-CimInstance Win32_Process -Filter "Name='java.exe'" | ?{ $_.CommandLine -like '*stirling-pdf-2.12.0-runner*' } | %{ Stop-Process -Id $_.ProcessId -Force }`.
-
-### 3.2 Run standalone for a quick boot check (host JDK 25, fastest)
-```bash
-SECURITY_ENABLELOGIN=false QUARKUS_HTTP_PORT=8095 \
-QUARKUS_DATASOURCE_JDBC_URL="jdbc:h2:mem:t;DB_CLOSE_DELAY=-1;MODE=PostgreSQL" \
-nohup "$JAVA_HOME/bin/java" -jar app/core/build/stirling-pdf-2.12.0-runner.jar > /tmp/boot.log 2>&1 &
-# success line in log: "Stirling-PDF running on port: 8095"  (this app does NOT print Quarkus' "Listening on")
-```
-Health: `curl localhost:8095/api/v1/info/status` → `{"version":"2.12.0","status":"UP"}`.
-
-### 3.3 The "normal" Docker image (full tools) — what the cucumber e2e uses
-The upstream `docker/embedded/Dockerfile` is **Spring-Boot-specific** (uses
-`java -Djarmode=tools -jar app.jar extract --layers` + `spring-boot-loader` layers) and does NOT
-work with the Quarkus jar. For e2e I built an ad-hoc image layering the runner-jar on the prebuilt
-**base image** (which already has Java 25 + LibreOffice + Tesseract + qpdf + Ghostscript + Calibre +
-Python). **This Dockerfile lives in a temp dir and needs to be committed into the repo** (see §6 TODO).
-
-Build context (currently ephemeral at the bash path `/tmp/sp-full` =
-`C:\Users\systo\AppData\Local\Temp\sp-full`): `app.jar` (the runner jar), `fonts/*.ttf`, and this
-Dockerfile:
-```dockerfile
-FROM stirlingtools/stirling-pdf-base:1.0.2          # Java 25 + all tools
-WORKDIR /app
-COPY --chown=1000:1000 app.jar /app/app.jar
-COPY fonts/*.ttf /usr/share/fonts/truetype/
-RUN fc-cache -f \
-    && mkdir -p /storage \
-    && chown stirlingpdfuser:stirlingpdfgroup /storage /app \
-    && ln -sf /configs /app/configs && ln -sf /logs /app/logs \
-    && ln -sf /customFiles /app/customFiles && ln -sf /pipeline /app/pipeline \
-    && ln -sf /storage /app/storage \
-    && chown -h stirlingpdfuser:stirlingpdfgroup /app/configs /app/logs /app/customFiles /app/pipeline /app/storage
-ENV HOME=/home/stirlingpdfuser STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
-    TMPDIR=/tmp/stirling-pdf TEMP=/tmp/stirling-pdf TMP=/tmp/stirling-pdf \
-    SAL_TMP=/tmp/stirling-pdf/libre DBUS_SESSION_BUS_ADDRESS=/dev/null \
-    JAVA_OPTS="-XX:+UseG1GC -Djava.awt.headless=true" \
-    QUARKUS_HTTP_HOST=0.0.0.0 QUARKUS_HTTP_PORT=8080
-EXPOSE 8080/tcp
-STOPSIGNAL SIGTERM
-USER stirlingpdfuser
-ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
-```
-Stage + build + run:
-```bash
-# stage (bash /tmp resolves to %LOCALAPPDATA%\Temp)
-mkdir -p /tmp/sp-full/fonts
-cp app/core/build/stirling-pdf-2.12.0-runner.jar /tmp/sp-full/app.jar
-cp app/core/src/main/resources/static/fonts/*.ttf /tmp/sp-full/fonts/
-# (write the Dockerfile above to C:\Users\systo\AppData\Local\Temp\sp-full\Dockerfile)
-cd /tmp/sp-full && docker build -t stirling-pdf-quarkus:full .
-docker rm -f sp-e2e
-docker run -d --name sp-e2e -p 8080:8080 \
-  -e SECURITY_ENABLELOGIN=false -e METRICS_ENABLED=true \
-  -e SYSTEM_DEFAULTLOCALE=en-US -e SYSTEM_MAXFILESIZE=100 \
-  stirling-pdf-quarkus:full
-# wait for: curl localhost:8080/api/v1/info/status == 200
-```
-Base image was pulled with `docker pull stirlingtools/stirling-pdf-base:1.0.2`.
-
-### 3.4 Run the cucumber (behave) suite
- Tests live in `testing/cucumber/` — Python **behave** (BDD), pure HTTP via `requests` (no browser).
- **Target URL is hardcoded `http://localhost:8080`** in `features/steps/step_definitions.py`
-  (lines ~584/592/601) and `features/environment.py`. Easiest is to run the app on 8080.
- `behave.ini` excludes `features/(enterprise|payg)` and tag `~@manual` by default.
- `environment.py` probes `/api/v1/auth/login` (admin/stirling) at startup; if JWT/login is not
-  functional (login disabled / V2) it **skips** all `@jwt @login @me @refresh @token @mfa @apikey
-  @admin_settings @audit @signature @team @user_mgmt` scenarios → ~80 skips. That's expected.
-
-Install deps + run:
-```bash
-cd testing/cucumber
-pip install -r requirements.txt        # behave, requests, pypdf, reportlab, psycopg, pillow, ...
-TEST_CONTAINER_NAME=sp-e2e TEST_REPORT_DIR=/tmp python -m behave --no-capture --format progress2
-# single feature:  python -m behave features/general.feature
-# one scenario:    python -m behave features/general.feature:22 --format plain
-```
-The official CI driver is `testing/test.sh` (builds images via `docker/embedded/Dockerfile.*` and
-runs behave) — it will need the Dockerfile fixes from §6 before it works on Quarkus.
-
---
-
-## 4. Bugs FIXED this session (with the *why*, so you can spot siblings)
-
-### Session 2 (branch `claude/happy-chaplygin-906fe7`, fast-forwarded from `migration/run-01`)
-
-Newest first. These took the login-off suite **183 → 223** and then wired JWT so the **80 skipped
-JWT/admin scenarios run** (run 3, §9):
-
-1. **JWT Bearer → `SecurityIdentity` was never populated** → every user-scoped endpoint that reads
-   `SecurityIdentity.getPrincipal()` (folders, files, `/me`, user/team settings…) failed, and the
-   `environment.py` probe (`login → /me`) failed so ~80 scenarios auto-skipped. Added a custom
-   `HttpAuthenticationMechanism` + `IdentityProvider` in
-   `app/proprietary/.../security/identity/` (`JwtBearerAuthenticationMechanism`,
-   `JwtTokenIdentityProvider`): extract `Authorization: Bearer`, validate via the existing
-   `JwtService` (jjwt + keystore), build a `QuarkusSecurityIdentity` and map the `role` claim
-   (`ROLE_ADMIN` → also add `ADMIN` so `@RolesAllowed("ADMIN")` matches). Returns no identity when
-   no Bearer is present, so the X-API-KEY / login-off open-endpoint path is unaffected. **This is the
-   IdentityProvider that ~10 `// TODO: Migration required` comments across the security/storage code
-   asked for.** Run with `V2=true`.
-2. **No admin user was ever created** → all logins failed "No user found: admin". `InitialSecuritySetup`
-   was a Spring `@Component` (eagerly constructed, `@PostConstruct` ran every boot); the migration
-   made it a lazy `@ApplicationScoped` whose `@PostConstruct` never ran. Restored eager init via
-   `@Observes StartupEvent`. **Pattern: any migrated `@PostConstruct`-on-`@ApplicationScoped` startup
-   bean with no injector is dead code — grep for them.**
-3. **Eager init then exposed two latent bugs** (both real, both now fixed):
-   - `@Produces @ApplicationScoped DataSource` → Arc generated the client proxy in the JDK-sealed
-     `javax.sql` package → `NoClassDefFoundError` on first use. Fix: `@Singleton` (pseudo-scope, no
-     proxy). **Audit other `@Produces @ApplicationScoped` whose return type is a `java.*`/`javax.*`
-     type.**
-   - Panache `persist()` in the `StartupEvent` observer ran with no transaction (Spring Data wrapped
-     `save()` implicitly). Fix: `@Transactional` on the observer.
-4. **Login returned 500 instead of 401** for unknown user / bad password. `CustomUserDetailsService`
-   threw `IllegalArgumentException`, but `AuthController` catches the migration shim
-   `stirling.software.common.security.UsernameNotFoundException`. Made the service throw the shim
-   type. **Sibling: the locked-account path still throws `IllegalStateException` — wire it similarly
-   when needed.**
-5. **`@Transactional` missing on policy-store reads** (`JpaPolicyStore.all()`,
-   `findByTriggerType()`) → the scheduled folder-watch/schedule triggers threw
-   `ContextNotActiveException` off-request (§6.C). The reads are reached via the CDI proxy so a
-   method-level `@Transactional` applies even from the background virtual-thread executor.
-6. **Split scenarios sent a duplicate `fileInput` text part** (`| fileInput | fileInput |` in
-   `general.feature`) alongside the file part; Quarkus `@RestForm FileUpload` bound the *text* part
-   ("fileInput", 9 bytes) → "PDF corrupted". Spring ignored the stray part. Removed the redundant
-   rows (the file is already attached via the generate step). **Real clients send one part, so this
-   is a test artifact, not a server tolerance gap worth chasing.**
-7. **e2e Docker build is now first-class:** `docker/quarkus/Dockerfile` (+ `README.md`,
-   `build-and-run.sh`) layers the runner-jar on the base image, and `.dockerignore` re-includes
-   `app/core/build/*-runner.jar` (it was excluded by `**/build/`, so a clean `docker build` had been
-   silently relying on BuildKit cache).
-
-### Session 1
-
-1. **`MultipartFile.transferTo` didn't overwrite** (`a30d524ec`).
-   `app/common/.../model/MultipartFile.java` + `.../model/multipart/FileUploadMultipartFile.java`
-   used `Files.copy(in, dest)` without `REPLACE_EXISTING`. Callers do
-   `Files.createTempFile(...)` (creates the file) then `transferTo(thatPath)` → `FileAlreadyExistsException`.
-   Spring's `transferTo` overwrites. **Fixed** by adding `StandardCopyOption.REPLACE_EXISTING`.
-   Fixes the whole class of `/api/v1/misc/*` failures (scanner-effect, replace-invert, ocr,
-   update-metadata, unlock-pdf-forms, repair, extract-image-scans, add-page-numbers, …).
-
-2. **`maxDPI` defaulted to 0** (`a30d524ec`).
-   `ApplicationProperties.System.maxDPI` is a primitive `int` (→ 0 when not bound from settings).
-   Every DPI guard (`dpi > maxDPI`) then failed with *"maximum safe limit of 0"*. The
-   `settings.yml.template` default is 500. **Fixed** by `private int maxDPI = 500;`.
-   ⚠️ Root cause hint: this strongly suggests **settings.yml → ApplicationProperties config binding
-   is incomplete in the Quarkus migration**. Other primitive/unset fields may also be silently
-   wrong. Worth a dedicated audit (see §5).
-
-3. **Request-path `HttpServletRequest` → `UT000048` "No request is currently active"** (`860bd6e63`,
-   `4b572852c`). This was the dominant blocker. `quarkus-rest` (RESTEasy Reactive) runs handlers on
-   reactive/worker threads where the undertow servlet request context is NOT active, so ANY
-   `HttpServletRequest.getX()` throws. Fixed in:
-   - `GlobalExceptionHandler` (an `ExceptionMapper` that threw while handling *every* error, masking
-     the real cause) → `@Context UriInfo` + exception-safe `requestUri()`.
-   - `ControllerAuditAspect`, `AuditAspect` → route through the already-guarded
-     `AuditService.getCurrentRequest()` (returns null off-request) + a guarded `safeResponse()`.
-   - `AutoJobAspect`, `JobExecutorService` → inject `io.quarkus.vertx.http.runtime.CurrentVertxRequest`,
-     read query-param/method/path/attributes from the Vert.x request, degrade to null/no-op.
-   - `AuthController`, `UserController`, `ConfigController` → `@Context UriInfo` / `HttpHeaders` /
-     `io.vertx.core.http.HttpServerRequest`.
-   This unblocked the entire `@AutoJobPostMapping` chain (most PDF endpoints).
-
-4. **License singleton PK race** (`860bd6e63`). `UserLicenseSettings` has a manually-assigned
-   `@Id = 1L`. Spring Data `save()` on a non-new (pre-set-id) entity does a **MERGE (upsert)**; the
-   migration converted it to `persist()` (INSERT-only). The startup license sync raced the first
-   request, both inserted id=1 → `JdbcSQLIntegrityConstraintViolationException` → app crash. **Fixed**
-   in `UserLicenseSettingsService.getOrCreateSettings()` with a JVM lock +
-   `io.quarkus.narayana.jta.QuarkusTransaction.requiringNew()` create-once, then reload into the
-   caller's tx. **⚠️ This `save()`→`persist()`-should-be-`merge()` bug almost certainly exists for
-   OTHER manually-`@Id`'d entities — audit them (see §5).**
-
-5. **App couldn't boot without Redis** (`4665cceeb`).
-   - `quarkus.oidc.enabled=false` default (quarkus-oidc aborts startup without `auth-server-url`;
-     re-enable for an OAuth2 deployment).
-   - Valkey backplane beans eagerly injected the inactive `RedisDataSource`. Gated all 7 with
-     **build-time** `@io.quarkus.arc.properties.IfBuildProperty(name="cluster.backplane", stringValue="valkey")`
-     (NOT `@LookupIfProperty` — that leaves the bean in the build, so `RedisDataSource` still has a
-     consumer and Quarkus emits an eager startup observer that fails). Plus
-     `quarkus.redis.health.enabled=false`.
-
-6. **Runtime boot fixes** (`20b25ad76`): `quarkus.hibernate-orm.mapping.format.global=ignore` (JSON
-   columns), Quartz cron `0 0 0 * * MON` → `0 0 0 ? * MON` (Quartz rejects `*` in both day fields),
-   `@Scheduled(every="7d")` → `"P7D"`, `quarkus.arc.fail-on-intercepted-private-method=false`.
-
-7. **CDI augmentation** (`185ac88b3`): interceptor bindings made `@InterceptorBinding`
-   (`@EnterpriseEndpoint`, `@PremiumEndpoint`), a `tools.jackson.databind.ObjectMapper` producer
-   added in `AppConfig` (92 injection points), ambiguous beans resolved (`@DefaultBean`),
-   `Optional<X>`→`Instance<X>`, collection `List<X>`→`@All List<X>`, nested `SAML2` config producer.
-
-8. **Test layer** (`d51228af6`): a content-based exclude in root `build.gradle subprojects` skips any
-   test still importing `org.springframework`/`com.nimbusds` (self-maintaining), plus an explicit
-   list for tests asserting changed production signatures.
-
---
-
-## 5. Recurring patterns / gotchas (apply these everywhere)
-
- **HttpServletRequest is poison on reactive threads.** ~35 main-source files still reference
-  `HttpServletRequest` (see §6 list). For each in the request path, replace with:
-  - path/URI → `@Context jakarta.ws.rs.core.UriInfo` (`uriInfo.getRequestUri().getPath()`), or in a
-    non-JAX-RS bean inject `io.quarkus.vertx.http.runtime.CurrentVertxRequest`
-    (`currentVertxRequest.getCurrent().request().path()`), guarded in try/catch returning null/"".
-  - headers → `@Context jakarta.ws.rs.core.HttpHeaders` (`getHeaderString(name)`).
-  - remote addr / method → `@Context io.vertx.core.http.HttpServerRequest`.
-  - request attributes (`get/setAttribute`) → Vert.x `RoutingContext.get/put` via `CurrentVertxRequest`.
-  - In services that already have a guarded accessor, reuse `AuditService.getCurrentRequest()`.
- **Spring `save()` → Panache:** if the entity uses `@GeneratedValue` (new on insert) → `persist()`.
-  If the entity has a **manually-assigned `@Id`** (caller sets the id, "upsert" semantics) →
-  `getEntityManager().merge()` (NOT `persist()`), and consider concurrency.
- **Config gating:** runtime selection that must REMOVE a bean (so its deps don't get wired) →
-  build-time `@IfBuildProperty`/`@UnlessBuildProperty`. `@LookupIfProperty` only disables *lookup*,
-  the bean and its injection points stay in the build.
- **`quarkus.*` build-time props** (e.g. `quarkus.oidc.enabled`, `quarkus.hibernate-orm.*`,
-  `quarkus.arc.*`) can't be overridden by env at runtime — they require a rebuild.
- **settings.yml binding is suspect** (see maxDPI). Audit `ApplicationProperties` for primitive
-  fields that need non-zero/template defaults, and verify the settings.yml → ApplicationProperties
-  binding path actually works in Quarkus (it was Spring `@ConfigurationProperties` + a custom YAML
-  property source — see the `YamlPropertySourceFactory` / `ConfigInitializer` TODOs).
- **Augment gate:** `compileJava` passing ≠ working. `./gradlew :stirling-pdf:quarkusBuild` surfaces
-  CDI wiring errors; only *running* surfaces the `UT000048` / config / race bugs. Always run.
- **Jackson 2 vs 3 coexist:** ~100 files use `tools.jackson` (Jackson 3, from Spring Boot 4); REST
-  (de)serialization uses Quarkus' Jackson 2. Don't "fix" `tools.jackson` imports — there's a producer.
-
---
-
-## 6. REMAINING WORK (prioritized)
-
-### A. Make the e2e Docker build first-class
- [x] **DONE (Session 2):** `docker/quarkus/Dockerfile` (+ `README.md`, `build-and-run.sh`) committed,
-      uses the runner-jar, copies fonts; `.dockerignore` re-includes `app/core/build/*-runner.jar`.
- [ ] Rewrite/replace `docker/embedded/Dockerfile`, `Dockerfile.fat`, `Dockerfile.ultra-lite` for
-      Quarkus: drop the Spring-Boot `-Djarmode=tools extract --layers` + `spring-boot-loader` layer
-      copies; either copy the uber `-runner.jar` to `/app/app.jar` or use the Quarkus fast-jar
-      (`quarkus-app/`) layout. The stage-1 `gradle clean build -PbuildWithFrontend=true` still builds
-      the frontend (fine).
- [ ] Update `scripts/init.sh` / `init-without-ocr.sh` — they have Spring-loader fallbacks and AOT
-      machinery; the primary `java -jar /app.jar` path works for the uber-jar, but verify the AOT
-      cache + `restart-helper.jar` paths.
- [ ] Then `testing/test.sh` (the official cucumber driver) should work end-to-end.
-
-### B. Real per-endpoint bugs surfaced by cucumber (login-off suite)
-Last measured failure buckets (before the transferTo/maxDPI fixes — re-run to refresh):
- [ ] **`PdfCorruptedException` (~48)** on `convert/pdf/{word,vector,presentation,text,pdfa,...}`,
-      `convert/{html,cbz}/pdf`. Investigate `CustomPDFDocumentFactory` (PDF loading) — is it
-      misreporting valid PDFs as corrupted, or do these convert paths need LibreOffice/handling that
-      errors first and gets wrapped? Check one: `python -m behave features/convert_new.feature:NN --format plain`
-      then read `docker logs sp-e2e` for the real cause.
- [ ] **`ClassCastException: String cannot be cast to ...` (~6)** — form/param binding type mismatch.
-      Likely a `@RestForm`/`@QueryParam` bound to the wrong type, or a Map/JSON form field. Check
-      `form/fill`, `form_advanced.feature`.
- [ ] **Remaining `500`s** after A/B fixes — `misc/compress-pdf`, `general/split-pdf-by-chapters`,
-      `misc/add-image`, etc. Triage each via container logs.
- [ ] **`400`s (~5)** — multipart `@RestForm` binding gaps. The migration left several request DTOs
-      with `MultipartFile`/POJO-list fields not bound to RESTEasy `FileUpload` (AI/workflow/sign DTOs
-      explicitly flagged). See `migration-report.md` "Representative deferred code".
- [ ] **temp-file collisions other than transferTo** — also check `GeneralUtils.createTempFile`
-      (`app/common/.../util/GeneralUtils.java:79/85`) and any `Files.createFile`/`Files.copy`/
-      `Files.move` without `REPLACE_EXISTING`. `temp<rand>genericNonCustomisableName.pdf` and
-      `/tmp/stirling-pdf/stirling-pdf-<rand>.pdf` were two such names.
-
-### C. Background scheduled-task errors (log noise, not request-breaking)
- [ ] `FolderWatchTrigger` (reconcile) and `ScheduleTrigger` (sweep) throw
-      `jakarta.enterprise.context.ContextNotActiveException` ("neither a transaction nor a CDI
-      request context is active") because they hit Panache/`PolicyRepository` off-request. Add
-      `@Transactional` (and/or `@ActivateRequestContext`) to those scheduled methods, or wrap the EM
-      access in `QuarkusTransaction.requiringNew()`. Files:
-      `app/proprietary/.../policy/trigger/FolderWatchTrigger.java`,
-      `.../policy/trigger/ScheduleTrigger.java`, `.../policy/store/JpaPolicyStore.java`.
-
-### D. The remaining ~35 `HttpServletRequest` files (apply §5 pattern as they surface)
-Not all are in the hot path; fix the ones that throw `UT000048` when their endpoints are exercised.
-Get the list any time with:
-```bash
-grep -rln "HttpServletRequest" app/core/src/main app/proprietary/src/main app/common/src/main --include=*.java
-```
-Known-fixed already: GlobalExceptionHandler, ControllerAuditAspect, AuditAspect, AutoJobAspect,
-JobExecutorService, AuthController, UserController, ConfigController. Everything else is unverified.
-High-risk: security filters (`UserAuthenticationFilter`, rate-limit filters, `JwtAuthenticationFilter`),
-anything reading headers/cookies/remote-addr per request.
-
-### E. Auth / JWT / login — DONE (Session 2)
-The whole Quarkus auth-identity layer is now in place (`app/proprietary/.../security/identity/`):
- [x] **JWT Bearer** → `JwtBearerAuthenticationMechanism` + `JwtTokenIdentityProvider` (validate via
-      `JwtService`, map `role` claim). Run with `V2=true`.
- [x] **X-API-KEY** → `ApiKeyAuthenticationMechanism` + `ApiKeyAuthenticationRequest` +
-      `ApiKeyIdentityProvider` (resolve via `userService.getUserByApiKey`). Lets `X-API-KEY` requests
-      authenticate (e.g. `/me`), and lets the suite run `SECURITY_ENABLELOGIN=true`.
- [x] **User-as-principal** → `UserSecurityIdentityAugmentor` re-loads the `User` and sets it as the
-      `SecurityIdentity` principal; `User implements Principal`. This satisfies the ~7
-      `principal instanceof User` sites (folders, file storage, sessions, audit, UserController) — the
-      augmentor every `// TODO: Migration required` in security/storage asked for.
- [x] **Config binding** → `ApplicationPropertiesConfigOverlay` overlays env/config onto
-      `ApplicationProperties` at startup (the Spring `@ConfigurationProperties` bind was never
-      migrated, so `SECURITY_ENABLELOGIN` / `SECURITY_CUSTOMGLOBALAPIKEY` / `STORAGE_ENABLED` were
-      ignored — root cause of the maxDPI/loginAttemptCount class too). **Currently a focused subset
-      (auth/storage/SSO toggles); a complete generic bind (all ~445 fields + settings.yml) is still
-      TODO.**
- Validated on a login-ON probe (`SECURITY_ENABLELOGIN=true V2=true STORAGE_ENABLED=true
-  SECURITY_CUSTOMGLOBALAPIKEY=123456789`): open PDF endpoints (anon), JWT login+/me, X-API-KEY /me,
-  folder list/create all work. The 183 open endpoints stay open (no global `quarkus.http.auth.*`
-  policy), so login-ON does not regress them.
-
-### F. SAML / SSO — DONE (Session 2), both flows work end-to-end
-
-**Both `validate-oauth-test.sh` and `validate-saml-test.sh` pass, and both full login flows were
-verified end-to-end against the Keycloak compose** (login -> IdP -> callback/ACS -> auto-created
-user -> app JWT cookie -> `/me` 200). Run with `PREMIUM_KEY=<your enterprise license key>`. Tag the Quarkus image as
-`docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest` so the compose uses it (or repoint the
-`image:`); `start-saml-test.sh` generates the SP certs + fetches Keycloak's cert.
-
- **OAuth2 / OIDC** (`security/oauth2/`): `OAuth2LoginController` (JAX-RS) serves
-  `/oauth2/authorization/{id}` -> IdP authorize redirect; `OAuth2CallbackServlet` (`@WebServlet
-  /login/oauth2/code/*`) does the code exchange + userinfo + auto-create + JWT cookie. **Why a
-  servlet for the callback:** quarkus-undertow's default servlet owns the `/login/*` prefix and
-  query-strips/intercepts the extension-less callback before RESTEasy sees it; a registered
-  `@WebServlet` takes precedence. (Same reason the SAML SP endpoints are servlets.)
- **SAML2** (`security/saml2/`): `Saml2Service` (OpenSAML 5) initialises the library, loads SP
-  key/cert + IdP cert, builds SP metadata, builds+signs the redirect-binding AuthnRequest, and
-  validates the SAMLResponse signature (`SAMLSignatureProfileValidator` + `SignatureValidator`
-  against the IdP cert). `SamlMetadataServlet` -> `/saml2/service-provider-metadata/{id}`;
-  `SamlSpServlet` -> `/saml2/authenticate/{id}` (login init) + `/login/saml2/sso/{id}` (ACS).
-  **Gotcha:** the SP entityId must equal the SP-metadata URL (`{backendUrl}/saml2/service-provider-
-  metadata/{id}`), which is what Keycloak's SAML client is keyed on - NOT the bare
-  `SECURITY_SAML2_SP_ENTITYID` host (`SamlConfig` derives it). Keycloak's realm has
-  `saml.client.signature=false` (AuthnRequest signature optional) + `saml.server.signature=true`
-  (so the ACS validates the response against Keycloak's cert).
- Both flows finish by issuing the app JWT as the `stirling_jwt` cookie, which
-  `JwtBearerAuthenticationMechanism` now also reads (not just the `Authorization` header) -> feeds
-  the `UserSecurityIdentityAugmentor` (principal = User).
- Follow-ups: logout/SLO endpoints; encrypted-assertion handling; the `mcp` Keycloak compose;
-  desktop/Tauri RelayState (`TauriSamlUtils` preserved). Multi-provider (google/github) OAuth uses
-  the same pattern keyed by registrationId.
-
-### F-old. (superseded) original SAML/SSO scoping
-The `validate-*-test.sh` scripts are **endpoint-existence
-checks** (Keycloak up + Stirling serves the SSO endpoint), not full browser logins.
-
-Prereqs for any run: the compose files use `image: docker.stirlingpdf.com/.../stirling-pdf:latest`
-(the published Spring image) — **repoint to `stirling-pdf-quarkus:jwt`** (or wire
-`docker/quarkus/Dockerfile`). The SAML compose mounts `saml-private-key.key`/`saml-public-cert.crt`/
-`keycloak-saml-cert.pem` which **do not exist in the repo** — generate them (the SP signing
-key/cert; `start-saml-test.sh` may do this). SAML/OAuth need the **Enterprise license** env.
-
-**OAuth2 / OIDC** (more tractable — Quarkus has `quarkus-oidc`):
- [ ] Extend `ApplicationPropertiesConfigOverlay` for `security.oauth2.*` (client issuer/clientId/
-      clientSecret/scopes/useAsUsername) — currently only the `enabled` toggle is bound.
- [ ] Serve `GET /oauth2/authorization/{registrationId}` → 302 to the IdP authorize URL (login
-      initiation; the OAuth `validate` script checks this responds). Build from issuer + clientId +
-      redirect-uri `/login/oauth2/code/{registrationId}`.
- [ ] Serve the callback `GET /login/oauth2/code/{registrationId}` → exchange code (REST Client to
-      the token endpoint), fetch userinfo, auto-create/login the user (reuse `CustomOAuth2UserService`
-      logic), issue the app JWT via `JwtService`. `quarkus.oidc.enabled` is **build-time** and aborts
-      startup with no `auth-server-url`, so either hand-roll the flow (simplest, no build-time gate)
-      or enable oidc with a runtime-disabled default tenant.
-
-**SAML2** (larger — no Quarkus SAML extension; OpenSAML 5 from scratch):
- [ ] `Saml2Configuration` already loads the SP/IdP certs and computes entityId/ACS/SLO URLs and
-      customizes the AuthnRequest (all preserved). Build on it:
-  - [ ] `GET /saml2/service-provider-metadata/{registrationId}` → SP `EntityDescriptor` XML
-        (ACS=`/login/saml2/sso/{id}`, SP signing cert) marshalled via OpenSAML 5. (The SAML `validate`
-        script checks this.)
-  - [ ] login initiation → build+sign an `AuthnRequest` (use `customizeAuthnRequest`) and
-        redirect/POST to `samlConf.getIdpSingleLoginUrl()`.
-  - [ ] `POST /login/saml2/sso/{registrationId}` (ACS) → validate the SAML response/assertion against
-        the IdP cert, extract the NameID/attributes, auto-create/login the user, issue the app JWT.
-  - Host these as Jakarta `@WebServlet` (quarkus-undertow) or JAX-RS resources; gate on
-        `security.saml2.enabled`.
- [ ] Both flows then feed the existing `UserSecurityIdentityAugmentor` (principal=User) once they
-      establish the session/JWT.
-
-### G. `saas` flavor full augmentation (optional, non-default)
- [ ] `STIRLING_FLAVOR=saas ./gradlew :stirling-pdf:quarkusBuild` → ~28 Arc deployment problems
-      (Supabase second datasource via `quarkus.datasource."supabase".*`, `SecurityFilterChain`/
-      `JwtDecoder` → `quarkus.http.auth.*`+OIDC, credit `HandlerInterceptor`/`@RestControllerAdvice`
-      → JAX-RS `@Provider`/`ExceptionMapper`, `@ConfigurationProperties` → `@ConfigMapping`,
-      RestTemplate → REST Client). ~90 `// TODO: Migration required` across 34 saas files.
-
-### H. Test suite (unit/integration) re-enablement
- [ ] ~180 test files are excluded from compilation (content filter on `org.springframework`/
-      `com.nimbusds` imports + an explicit list in `build.gradle`). Port them to `@QuarkusTest`
-      incrementally; as a file's Spring imports go away it auto-re-enters the build.
-
-### I. Loose ends
- [ ] `/q/openapi` returns 500 (`UT000048`) — known quarkus-undertow + smallrye-openapi interaction;
-      swagger-ui works, live API works. Affects API-doc tooling only.
- [ ] Jackson 2/3 convergence (drop `tools.jackson`).
- [ ] ~437 `// TODO: Migration required` markers across the codebase document every deferred decision;
-      `grep -rn "TODO: Migration required" app/*/src/main` to enumerate.
-
---
-
-## 7. Quick reference — env vars used in e2e
-
-| Var | Value | Why |
-|-----|-------|-----|
-| `SECURITY_ENABLELOGIN` | `false` | run without auth (most API tests); set `true` for the JWT suite |
-| `METRICS_ENABLED` | `true` | enables `/api/v1/info/*` (info.feature) |
-| `SYSTEM_DEFAULTLOCALE` | `en-US` | matches default-language change |
-| `SYSTEM_MAXFILESIZE` | `100` | upload limit for tests |
-| `QUARKUS_HTTP_PORT` | `8080` | cucumber steps hardcode 8080 |
-| `QUARKUS_DATASOURCE_JDBC_URL` | `jdbc:h2:mem:...` | use a fresh in-mem DB for clean runs (avoids stale H2 file lock) |
-
-Default datasource (in `application.properties`) is **H2 file** at
-`./configs/stirling-pdf-DB-2.3.232` — fine in a container; for repeated host runs override to
-`jdbc:h2:mem:...` to dodge the file lock (`Database may be already in use`).
-
---
-
-## 8. Useful diagnostic one-liners
-
-```bash
-# container alive + real error (strip ANSI, drop known background noise)
-docker logs sp-e2e 2>&1 | sed 's/\x1b\[[0-9;]*m//g' \
-  | grep -iE "ERROR|Caused by|Exception" \
-  | grep -viE "Log4j|LogManager|ForkJoinPool|FolderWatch|ScheduleTrigger|policy-" | tail -30
-
-# categorize cucumber failures
-cd testing/cucumber && TEST_CONTAINER_NAME=sp-e2e python -m behave --no-capture --format plain --no-skipped > /tmp/behave.txt 2>&1
-grep -oE "Expected status code [0-9]+ but got [0-9]+" /tmp/behave.txt | sort | uniq -c | sort -rn
-grep -oE "features/[a-z_]+\.feature" /tmp/behave.txt | sort | uniq -c | sort -rn   # rough; use a junit reporter for precise
-
-# what still touches the servlet request
-grep -rln "HttpServletRequest" app/*/src/main --include=*.java
-
-# enumerate deferred work
-grep -rn "TODO: Migration required" app/*/src/main --include=*.java | wc -l
-```
-
---
-
-## 9. Measured cucumber results — newest first
-
-**Run 5 — LOGIN ON (`SECURITY_ENABLELOGIN=true V2=true STORAGE_ENABLED=true
-SECURITY_CUSTOMGLOBALAPIKEY=123456789`):**
-```
-18 features passed, 7 failed, 0 skipped
-304 scenarios passed, 34 failed, 0 skipped     <-- folders + user-scoped features now pass
-```
-X-API-KEY mechanism + User-principal augmentor + config overlay made login-ON work without
-regressing the open endpoints (0 folder failures). Trajectory: **183 → 223 → 272 → 291 → 304**.
-
-**Run 4 — login off + lockout fix:** `291 passed, 47 failed, 0 skipped`.
-
-**Run 3 — login off + `V2=true` + JWT Bearer mechanism (Session 2):**
-```
-17 features passed, 8 failed, 0 skipped
-272 scenarios passed, 66 failed, 0 skipped     <-- 0 skipped: all JWT/admin scenarios now run
-```
-The JWT mechanism unskipped all 80 and added +49 passing over run 2 with no regressions. Remaining
-66 failures, biggest buckets:
- **~38 = login-lockout cascade (FIXED, pending re-measure).** `loginAttemptCount` defaulted to 0
-  (template = 5) → admin locked after one failed-login test → every later admin scenario blocked
-  ("Admin login failed" 21×, "Folder list returned" 17×). Fixed the primitive default (same as
-  maxDPI). **Re-run to confirm; expect ~300+.**
- 10×(200→403) feature-gated/disabled (mostly not bugs).
- 5×(200→401) + 2×(401→403) — auth scenarios asserting specific codes; triage individually.
- 3×(200→500) — real per-endpoint bugs (e.g. `user/get-api-key`). Triage via container logs.
-
-**Run 2 — login off, Session 2 fixes, no JWT mechanism:**
-```
-16 features passed, 5 failed, 4 skipped
-223 scenarios passed, 35 failed, 80 skipped
-```
-
-**Run 1 — original baseline (login off):**
-```
-183 scenarios passed, 75 failed, 80 skipped
-```
-
-Trajectory this session: **183 → 223 (boot/login/test fixes) → 272 (JWT mechanism), 0 skipped.**
@@ -60,7 +60,7 @@ For full installation options (including desktop and Kubernetes), see our [Docum

 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

-This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task dev` to get started running the editor, run `task` to see the most common commands, or see the [Developer Guide](DeveloperGuide.md) for full details.
+This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task install` to get started, or see the [Developer Guide](DeveloperGuide.md) for full details.

 For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).

@@ -25,28 +25,8 @@ includes:
  e2e:
    taskfile: .taskfiles/e2e.yml
    dir: .
-  pre-commit:
-    taskfile: .taskfiles/pre-commit.yml
-    dir: .

 tasks:
-  # ============================================================
-  # Help (shown when you run `task` with no arguments)
-  # ============================================================
-
-  default:
-    desc: "List the most common commands"
-    silent: true
-    cmds:
-      - |
-        echo "Common commands (run 'task --list' to see all):"
-        echo ""
-        echo "  task dev            Start backend & frontend on free ports"
-        echo "  task backend:dev    Start backend on default port"
-        echo "  task frontend:dev   Start frontend on default port"
-        echo "  task desktop:dev    Start desktop app"
-        echo "  task check          Quality gate (lint, typecheck, test, etc.)"
-
  # ============================================================
  # Setup & Prerequisites
  # ============================================================
@@ -78,22 +58,9 @@ tasks:
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
          OPEN: "true"

-  dev:saas:
-    desc: "Start SaaS backend + frontend concurrently on free ports"
-    cmds:
-      - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas }
-
  dev:all:
    desc: "Start backend + frontend + engine concurrently on free ports"
-    cmds:
-      - task: dev:_all
-
-  dev:_all:
-    internal: true
    vars:
-      FRONTEND: '{{.FRONTEND | default "proprietary"}}'
-      BACKEND: '{{.BACKEND | default "proprietary"}}'
      PORTS:
        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -103,12 +70,11 @@ tasks:
      - task: engine:dev
        vars:
          PORT: '{{.ENGINE_PORT}}'
-      - task: 'backend:dev:{{.BACKEND}}'
+      - task: backend:dev
        vars:
          PORT: '{{.BACKEND_PORT}}'
          AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-          AIENGINE_ENABLED: "true"
-      - task: 'frontend:dev:{{.FRONTEND}}'
+      - task: frontend:dev:prototypes
        vars:
          PORT: '{{.FRONTEND_PORT}}'
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
@@ -192,6 +158,4 @@ tasks:
    desc: "Clean all build artifacts"
    cmds:
      - task: backend:clean
-      - task: frontend:clean
      - task: engine:clean
-      - task: pre-commit:clean
@@ -86,7 +86,7 @@ If you're using Tauri's built-in updater feature:

 ## Configuration Files

-### 1. Tauri Configuration (frontend/editor/src-tauri/tauri.conf.json)
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)

 The Windows signing configuration is already set up:

@@ -1,34 +0,0 @@
-###############################################################################
-# Stirling-PDF SaaS environment defaults.
-#
-# This file is committed and provides non-secret defaults loaded by
-# `task backend:dev:saas`. Put real values for secrets (passwords, project
-# refs, edge function secrets) in `.env.saas.local` - any variable set there
-# takes precedence over what's defined here.
-#
-# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
-###############################################################################
-
-# ---------- Supabase project ----------
-# Project reference (the subdomain part of <ref>.supabase.co). Required.
-# Set in .env.saas.local.
-SAAS_DB_PROJECT_REF=
-
-# Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
-SUPABASE_EDGE_FUNCTION_SECRET=
-
-# ---------- Database (saas profile) ----------
-# Direct JDBC URL to the Supabase Postgres. Required when running the plain
-# `saas` profile (i.e. without `--spring.profiles.include=dev`).
-# Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
-SAAS_DB_URL=
-SAAS_DB_USERNAME=postgres
-SAAS_DB_PASSWORD=
-
-# ---------- Database (dev profile overrides) ----------
-# Used when `--spring.profiles.include=dev` is active. The dev profile
-# defaults the URL/username to the shared dev Supabase project, but the
-# password must still be provided in .env.saas.local.
-SAAS_DEV_DB_URL=
-SAAS_DEV_DB_USERNAME=postgres
-SAAS_DEV_DB_PASSWORD=
@@ -1,3 +0,0 @@
-# Whitelist committed env defaults. `.env.saas.local` (and any other .env*)
-# stays ignored via the root .gitignore.
-!.env.saas
@@ -1,9 +1,5 @@
 {
  "allowedLicenses": [
-    {
-      "moduleName": "org.jboss:jboss-transaction-spi",
-      "moduleLicense": "Public Domain"
-    },
    {
      "moduleName": ".*",
      "moduleLicense": "BSD License"
@@ -48,10 +44,6 @@
      "moduleName": ".*",
      "moduleLicense": "The MIT License"
    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "MIT-0"
-    },
    {
      "moduleName": "com.github.jai-imageio:jai-imageio-core",
      "moduleLicense": "LICENSE.txt"
@@ -1,4 +1,7 @@
-// REMOVED: bootRun{enabled=false} - Spring Boot plugin task. :common is a Quarkus library module.
+// Configure bootRun to disable it or point to a main class
+bootRun {
+    enabled = false
+}
 spotless {
    java {
        target 'src/**/java/**/*.java'
@@ -27,29 +30,8 @@ spotless {
 }
 dependencies {
    api 'com.google.guava:guava:33.6.0-jre'
-
-    // spring-boot-starter-webmvc -> Quarkus REST stack (api-scoped so downstream modules inherit it).
-    api 'io.quarkus:quarkus-rest'
-    api 'io.quarkus:quarkus-rest-jackson'
-    // Servlet bridge: large amounts of controller/filter code use jakarta.servlet (HttpServletRequest,
-    // Filter, etc.). quarkus-undertow provides a servlet container on Quarkus so that API resolves and
-    // runs. TODO: Migration required - longer term, port servlet usage to JAX-RS (ContainerRequestContext)
-    //       and drop quarkus-undertow.
-    api 'io.quarkus:quarkus-undertow'
-    // Bean Validation (was transitively in spring-boot-starter-webmvc).
-    api 'io.quarkus:quarkus-hibernate-validator'
-    // @Scheduled support (was spring-context scheduling). quarkus-scheduler manages its own
-    // executor; the former SchedulingConfig TaskScheduler bean is no longer needed.
-    api 'io.quarkus:quarkus-scheduler'
-    // BCrypt implementation backing the Spring Security PasswordEncoder compatibility shim
-    // (replaces spring-security-crypto's BCryptPasswordEncoder). Standalone, no framework.
-    api 'at.favre.lib:bcrypt:0.10.2'
-    // Swagger/OpenAPI annotations (io.swagger.v3.oas.annotations.*) used by common's API marker
-    // interfaces; was transitive via springdoc. Quarkus' SmallRye OpenAPI also understands these.
-    api 'io.swagger.core.v3:swagger-core-jakarta:2.2.46'
-    // REMOVED: spring-boot-starter-aspectj. Quarkus has no AspectJ weaving; quarkus-arc provides
-    // CDI interceptors (@AroundInvoke / interceptor bindings) instead.
-    // TODO: Migration required - any @Aspect/@Around advice must be rewritten as CDI interceptors.
+    api 'org.springframework.boot:spring-boot-starter-webmvc'
+    api 'org.springframework.boot:spring-boot-starter-aspectj'
    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
@@ -63,8 +45,7 @@ dependencies {
    api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
    api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
    api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    // springdoc-openapi-starter-webmvc-ui -> SmallRye OpenAPI (schema at /q/openapi, UI at /q/swagger-ui)
-    api 'io.quarkus:quarkus-smallrye-openapi'
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
    // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
    api 'org.simplejavamail:simple-java-mail:8.12.6'
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -79,7 +60,7 @@ dependencies {
        exclude group: 'com.google.code.gson', module: 'gson'
    }

-    api 'com.stirling:jpdfium:1.0.2'
+    api 'com.stirling:jpdfium:1.0.0'

    // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
@@ -94,20 +75,9 @@ dependencies {
    }
    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
    jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.0"
    }

-    // Jackson 3 (tools.jackson) - retained because ~100 files migrated to the Jackson 3 namespace
-    // under Spring Boot 4. Quarkus integrates Jackson 2 for REST bodies; Jackson 3 coexists here as a
-    // plain library so those files compile and can still build/parse JSON directly.
-    // api-scoped so downstream modules (core, proprietary, saas) that import tools.jackson inherit it.
-    // TODO: Migration required - converge the codebase on a single Jackson major version.
-    api 'tools.jackson.core:jackson-databind:3.0.0'
-    api 'tools.jackson.core:jackson-core:3.0.0'
-
-    // Bucket4j (local in-process token bucket for RateLimitStore default impl)
-    implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0'
-
    // ArchUnit: enforces module dependency direction (see ArchitectureTest)
    testImplementation 'com.tngtech.archunit:archunit-junit5:1.4.2'
 }
@@ -6,16 +6,15 @@ import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;

-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;

 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;

 import stirling.software.common.model.ApplicationProperties;

-@ApplicationScoped
+@Service
@Slf4j
 public class EndpointConfiguration {

@@ -53,10 +52,9 @@ public class EndpointConfiguration {
    private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
    private final boolean runningProOrHigher;

-    @Inject
    public EndpointConfiguration(
            ApplicationProperties applicationProperties,
-            @Named("runningProOrHigher") boolean runningProOrHigher) {
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
        this.applicationProperties = applicationProperties;
        this.runningProOrHigher = runningProOrHigher;
        init();
@@ -0,0 +1,73 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.context.annotation.Primary;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
+ * LineAlignmentTableParser}. The first parser returning a result above {@link
+ * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
+ */
+@Service
+@Primary
+@RequiredArgsConstructor
+@Slf4j
+public class CompositeTableParser implements TableParser {
+
+    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
+    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
+
+    private final TabulaTableParser tabulaParser;
+    private final LineAlignmentTableParser lineAlignmentParser;
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        // Step 1: Tabula lattice mode (ruled/bordered tables).
+        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
+        if (!latticeResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula lattice ({} table(s))",
+                    rawPage.pageNumber(),
+                    latticeResults.size());
+            return latticeResults;
+        }
+
+        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
+        // parseStream is not on the TableParser interface — this intentionally couples to the
+        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
+        List<TableFragment> streamResults =
+                filterConfident(tabulaParser.parseStream(document, rawPage));
+        if (!streamResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula stream ({} table(s))",
+                    rawPage.pageNumber(),
+                    streamResults.size());
+            return streamResults;
+        }
+
+        // Step 3: Geometry-based line-alignment fallback.
+        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
+        if (!lineResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using LineAlignment ({} table(s))",
+                    rawPage.pageNumber(),
+                    lineResults.size());
+            return lineResults;
+        }
+
+        return List.of();
+    }
+
+    private List<TableFragment> filterConfident(List<TableFragment> tables) {
+        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
+    }
+}
@@ -0,0 +1,528 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.TreeMap;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Fallback {@link TableParser} for borderless financial tables using text geometry.
+ *
+ * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
+ * positions, groups vertically proximate anchor lines into table candidates, then scores each group
+ * on column consistency and anchor density (confidence ceiling 0.85).
+ */
+@Service
+@Slf4j
+public class LineAlignmentTableParser implements TableParser {
+
+    /** Width in points of each column position bucket. */
+    static final float COLUMN_BUCKET_PT = 5f;
+
+    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
+    private static final int COLUMN_MATCH_BUCKETS = 2;
+
+    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
+    private static final float MAX_GAP_FACTOR = 2.5f;
+
+    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
+    static final int MIN_TABLE_ROWS = 3;
+
+    /** Minimum confirmed column positions to form a valid table. */
+    static final int MIN_COLUMNS = 2;
+
+    /**
+     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
+     * rows).
+     */
+    private static final double COLUMN_MIN_FREQUENCY = 0.40;
+
+    /**
+     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
+     * percent, nil dashes.
+     */
+    private static final Pattern NUMERIC =
+            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
+
+    /**
+     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
+     * column-gap logic).
+     */
+    static final float ROW_MERGE_TOLERANCE_PT = 2f;
+
+    // ── public API ───────────────────────────────────────────────────────────────────────────────
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        List<RawLine> lines = rawPage.lines();
+        if (lines.size() < MIN_TABLE_ROWS) return List.of();
+
+        float modalSpacing = computeModalSpacing(lines);
+        List<TokenizedLine> tokenized =
+                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
+
+        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
+
+        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
+
+        List<Float> columnGrid = buildColumnGrid(anchors);
+        if (columnGrid.size() < MIN_COLUMNS) {
+            log.debug(
+                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
+                    rawPage.pageNumber(),
+                    MIN_COLUMNS);
+            return List.of();
+        }
+
+        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
+
+        List<TableFragment> results = new ArrayList<>();
+        for (int i = 0; i < groups.size(); i++) {
+            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
+                    .ifPresent(results::add);
+        }
+
+        log.debug(
+                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
+                rawPage.pageNumber(),
+                results.size(),
+                anchors.size(),
+                columnGrid.size());
+        return results;
+    }
+
+    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
+
+    /**
+     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
+     * split by LineBuilder.
+     */
+    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
+        if (tokenized.size() < 2) return tokenized;
+
+        List<TokenizedLine> result = new ArrayList<>();
+        int i = 0;
+
+        while (i < tokenized.size()) {
+            float baseY = tokenized.get(i).line().bounds().y();
+            int j = i + 1;
+            while (j < tokenized.size()
+                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
+                            <= ROW_MERGE_TOLERANCE_PT) {
+                j++;
+            }
+
+            if (j == i + 1) {
+                result.add(tokenized.get(i));
+            } else {
+                result.add(mergeGroup(tokenized.subList(i, j)));
+            }
+            i = j;
+        }
+
+        return result;
+    }
+
+    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
+        List<TextFragment> mergedFragments =
+                group.stream()
+                        .flatMap(tl -> tl.line().fragments().stream())
+                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        Bounds mergedBounds =
+                group.stream()
+                        .map(tl -> tl.line().bounds())
+                        .reduce(Bounds::merge)
+                        .orElse(group.get(0).line().bounds());
+
+        RawLine mergedLine =
+                new RawLine(
+                        group.get(0).line().lineId(),
+                        mergedFragments,
+                        mergedBounds,
+                        group.get(0).line().pageNumber());
+
+        return tokenize(mergedLine);
+    }
+
+    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
+     * fragment.
+     */
+    TokenizedLine tokenize(RawLine line) {
+        List<LineToken> tokens = new ArrayList<>();
+        for (TextFragment frag : line.fragments()) {
+            tokens.addAll(tokensFromFragment(frag));
+        }
+        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
+        return new TokenizedLine(line, tokens, numeric);
+    }
+
+    private List<LineToken> tokensFromFragment(TextFragment frag) {
+        String raw = frag.text();
+        if (raw == null || raw.isBlank()) return List.of();
+
+        float fragX = frag.bounds().x();
+        float fragWidth = frag.bounds().width();
+        int rawLen = raw.length();
+
+        List<LineToken> result = new ArrayList<>();
+        int offset = 0;
+        for (String part : raw.split("\\s+")) {
+            if (part.isEmpty()) {
+                offset++;
+                continue;
+            }
+            int idx = raw.indexOf(part, offset);
+            if (idx < 0) idx = offset;
+
+            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
+            float tokenRight =
+                    rawLen > 0
+                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
+                            : fragX + fragWidth;
+
+            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
+            offset = idx + part.length();
+        }
+        return result;
+    }
+
+    // ── column grid ──────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
+     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
+     */
+    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
+        // bucket → set of line indices that contributed a numeric token to that bucket
+        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
+        for (int i = 0; i < anchors.size(); i++) {
+            for (LineToken t : anchors.get(i).numeric()) {
+                int bucket = bucket(t.right());
+                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
+            }
+        }
+
+        int minHits =
+                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
+
+        // Confirmed buckets → average right-edge for that bucket
+        TreeMap<Integer, Float> confirmed = new TreeMap<>();
+        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
+            // Count distinct lines
+            long distinctLines = entry.getValue().stream().distinct().count();
+            if (distinctLines >= minHits) {
+                double avg =
+                        entry.getValue().stream()
+                                .distinct() // weight each line equally regardless of token count
+                                .mapToDouble(
+                                        lineIdx ->
+                                                avgRightEdgeForBucket(
+                                                        anchors, lineIdx, entry.getKey()))
+                                .average()
+                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
+                confirmed.put(entry.getKey(), (float) avg);
+            }
+        }
+
+        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
+    }
+
+    /**
+     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
+     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
+     */
+    private double avgRightEdgeForBucket(
+            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
+        return anchors.get(lineIdx).numeric().stream()
+                .filter(t -> bucket(t.right()) == targetBucket)
+                .mapToDouble(LineToken::right)
+                .average()
+                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
+    }
+
+    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
+     * MAX_GAP_FACTOR × modal spacing splits groups.
+     */
+    private List<List<TokenizedLine>> groupRows(
+            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
+        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
+
+        List<List<TokenizedLine>> groups = new ArrayList<>();
+        List<TokenizedLine> current = new ArrayList<>();
+
+        for (int i = 0; i < all.size(); i++) {
+            TokenizedLine tl = all.get(i);
+            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
+
+            if (current.isEmpty()) {
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            float gap =
+                    tl.line().bounds().y()
+                            - current.get(current.size() - 1).line().bounds().bottom();
+
+            if (gap > maxGap) {
+                groups.add(current);
+                current = new ArrayList<>();
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            if (fits) {
+                current.add(tl);
+            } else if (!tl.line().text().isBlank()) {
+                // Include non-anchor lines (labels) only if they have text and are within
+                // proximity.
+                current.add(tl);
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+
+        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
+    }
+
+    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
+        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
+                >= MIN_TABLE_ROWS;
+    }
+
+    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
+    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long matches =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) matches / tl.numeric().size() >= 0.60;
+    }
+
+    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long hits =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) hits / tl.numeric().size() < 0.60;
+    }
+
+    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
+
+    private Optional<TableFragment> buildFragment(
+            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
+
+        List<String> warnings = new ArrayList<>();
+        List<List<String>> rawRows = new ArrayList<>();
+        List<TableRow> rows = new ArrayList<>();
+
+        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
+            TokenizedLine tl = group.get(rowIdx);
+            List<String> rawRow = buildRawRow(tl, columnGrid);
+            rawRows.add(Collections.unmodifiableList(rawRow));
+            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
+        }
+
+        // Column count = 1 label column + confirmed numeric columns
+        int colCount = columnGrid.size() + 1;
+        Bounds bounds = computeGroupBounds(group);
+        float confidence = computeConfidence(group, columnGrid, warnings);
+
+        return Optional.of(
+                new TableFragment(
+                        "tbl-la-p" + pageNumber + "-" + tableIndex,
+                        pageNumber,
+                        bounds,
+                        List.of(),
+                        Collections.unmodifiableList(rows),
+                        Collections.unmodifiableList(rawRows),
+                        colCount,
+                        confidence,
+                        Collections.unmodifiableList(warnings),
+                        null));
+    }
+
+    /**
+     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
+     */
+    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
+        String[] cells = new String[columnGrid.size() + 1];
+        Arrays.fill(cells, "");
+
+        // Separate label tokens (those not landing in any confirmed column) from column tokens.
+        List<String> labelParts = new ArrayList<>();
+        for (LineToken token : tl.all()) {
+            int col = nearestColumnIndex(token.right(), columnGrid);
+            if (col >= 0 && token.numeric()) {
+                int cellIdx = col + 1;
+                cells[cellIdx] =
+                        cells[cellIdx].isEmpty()
+                                ? token.text()
+                                : cells[cellIdx] + " " + token.text();
+            } else {
+                labelParts.add(token.text());
+            }
+        }
+        cells[0] = String.join(" ", labelParts).trim();
+        return Arrays.asList(cells);
+    }
+
+    private TableRow buildTableRow(
+            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
+        List<TableCell> cells = new ArrayList<>(rawRow.size());
+
+        // Label cell: use the line's full bounds as an approximation.
+        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
+
+        for (int col = 0; col < columnGrid.size(); col++) {
+            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
+            float right = columnGrid.get(col);
+            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
+            Bounds cellBounds =
+                    new Bounds(
+                            left,
+                            tl.line().bounds().y(),
+                            right - left,
+                            tl.line().bounds().height());
+            cells.add(TableCell.of(col + 1, text, cellBounds));
+        }
+        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
+    }
+
+    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
+
+    /**
+     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
+     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
+     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
+     */
+    private float computeConfidence(
+            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
+        float score = 0.70f;
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        long totalRows = group.size();
+
+        // More columns
+        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
+        score += extraCols * 0.05f;
+
+        // More anchor rows
+        if (anchorCount >= 5) score += 0.05f;
+        if (anchorCount >= 8) score += 0.05f;
+
+        // Inconsistent column matching
+        long inconsistent =
+                group.stream()
+                        .filter(TokenizedLine::isAnchor)
+                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
+                        .count();
+        if (inconsistent > anchorCount * 0.30) {
+            score -= 0.15f;
+            warnings.add(
+                    "Column match inconsistent on "
+                            + inconsistent
+                            + "/"
+                            + anchorCount
+                            + " anchor rows");
+        }
+
+        // Label-heavy
+        long nonAnchor = totalRows - anchorCount;
+        if (nonAnchor > anchorCount) {
+            score -= 0.10f;
+            warnings.add(
+                    "Non-anchor rows ("
+                            + nonAnchor
+                            + ") outnumber anchor rows ("
+                            + anchorCount
+                            + ")");
+        }
+
+        return Math.max(0f, Math.min(0.85f, score));
+    }
+
+    // ── utility ──────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
+     * #COLUMN_MATCH_BUCKETS} buckets.
+     */
+    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
+        int nearest = -1;
+        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
+        for (int i = 0; i < grid.size(); i++) {
+            float dist = Math.abs(rightEdge - grid.get(i));
+            if (dist < minDist) {
+                minDist = dist;
+                nearest = i;
+            }
+        }
+        return nearest;
+    }
+
+    private Bounds computeGroupBounds(List<TokenizedLine> group) {
+        return group.stream()
+                .map(tl -> tl.line().bounds())
+                .reduce(Bounds::merge)
+                .orElse(new Bounds(0, 0, 0, 0));
+    }
+
+    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
+    private float computeModalSpacing(List<RawLine> lines) {
+        if (lines.size() < 2) return 0f;
+        Map<Float, Long> freq = new HashMap<>();
+        for (int i = 1; i < lines.size(); i++) {
+            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
+            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
+        }
+        return freq.entrySet().stream()
+                .max(Map.Entry.comparingByValue())
+                .map(Map.Entry::getKey)
+                .orElse(0f);
+    }
+
+    private static int bucket(float x) {
+        return Math.round(x / COLUMN_BUCKET_PT);
+    }
+
+    // ── private data types ───────────────────────────────────────────────────────────────────────
+
+    /** A word-level token with an approximate right-edge x-position. */
+    record LineToken(String text, float x, float right, boolean numeric) {}
+
+    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
+    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
+        boolean isAnchor() {
+            return numeric.size() >= 2;
+        }
+    }
+}
@@ -0,0 +1,139 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
+ *
+ * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
+ * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
+ * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
+ */
+@Service
+@Slf4j
+public class LineBuilder {
+
+    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
+    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
+
+    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
+    private static final float MIN_BASELINE_TOLERANCE = 2f;
+
+    /**
+     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
+     * two-column gutters.
+     */
+    static final float COLUMN_GAP_RATIO = 0.10f;
+
+    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
+    static final float COLUMN_GAP_MIN_PT = 40f;
+
+    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
+        if (fragments.isEmpty()) return List.of();
+
+        float effectiveWidth = inferEffectiveWidth(fragments);
+        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
+        log.debug(
+                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
+                pageNumber,
+                effectiveWidth,
+                columnGapThreshold);
+
+        // Sort top-to-bottom first, then left-to-right within the same baseline band.
+        List<TextFragment> sorted =
+                fragments.stream()
+                        .sorted(
+                                Comparator.comparingDouble(TextFragment::baseline)
+                                        .thenComparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
+
+        List<RawLine> lines = new ArrayList<>(groups.size());
+        for (int i = 0; i < groups.size(); i++) {
+            List<TextFragment> group =
+                    groups.get(i).stream()
+                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                            .toList();
+
+            Bounds lineBounds =
+                    group.stream()
+                            .map(TextFragment::bounds)
+                            .reduce(Bounds::merge)
+                            .orElse(new Bounds(0, 0, 0, 0));
+
+            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
+        }
+        return lines;
+    }
+
+    private List<List<TextFragment>> groupByBaseline(
+            List<TextFragment> sorted, float columnGapThreshold) {
+        List<List<TextFragment>> groups = new ArrayList<>();
+        List<TextFragment> current = new ArrayList<>();
+        float currentBaseline = Float.NaN;
+
+        for (TextFragment fragment : sorted) {
+            if (current.isEmpty()) {
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+                continue;
+            }
+
+            float maxFontSize =
+                    Math.max(
+                            fragment.fontSize(),
+                            (float)
+                                    current.stream()
+                                            .mapToDouble(TextFragment::fontSize)
+                                            .max()
+                                            .orElse(0));
+            float tolerance =
+                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
+
+            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
+            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
+
+            if (sameBaseline && !columnGap) {
+                current.add(fragment);
+                // Anchor to the weighted mean baseline so long lines stay stable.
+                currentBaseline =
+                        (currentBaseline * (current.size() - 1) + fragment.baseline())
+                                / current.size();
+            } else {
+                groups.add(current);
+                current = new ArrayList<>();
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+        return groups;
+    }
+
+    /**
+     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
+     * threshold}.
+     */
+    private static boolean hasColumnGap(
+            TextFragment next, List<TextFragment> group, float threshold) {
+        float lastRight = group.get(group.size() - 1).bounds().right();
+        return next.bounds().x() - lastRight > threshold;
+    }
+
+    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
+    private static float inferEffectiveWidth(List<TextFragment> fragments) {
+        double maxRight =
+                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
+        return (float) maxRight * 1.10f;
+    }
+}
@@ -1,142 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Detects whether a page is one- or two-column from per-line bounding boxes, and classifies an
- * X-span into the column it belongs to. Detection is a midpoint vote at {@code pageWidth / 2}.
- *
- * <p>Capped at two columns by design — sufficient for the redaction target set (single-column
- * documents and IEEE-style two-column papers). 3+ column layouts (newspapers, magazines) and
- * off-centre gutters (asymmetric two-column) would need a histogram or clustering approach to
- * detect the actual gutter X. (future work)
- *
- * <p>Coordinates are PDFTextStripper screen space (top-left origin, Y increases downward).
- */
-public final class PageColumnLayout {
-
-    /**
-     * Slack when checking "crosses a gutter" so single-pixel overshoots don't mark a line as
-     * spanning.
-     */
-    public static final float SPAN_SLACK_PT = 2f;
-
-    /**
-     * Slack on each side of the page midpoint inside which a line is considered "spanning"
-     * (covering both columns) rather than belonging to one side.
-     */
-    private static final float MIDPOINT_SLACK_PT = 30f;
-
-    /**
-     * Minimum line width (points) for a line to count toward the two-column tally. Avoids false
-     * positives where right-aligned dates, page numbers, or short "Link" fragments next to a
-     * heading look like a second column when they're really just inline metadata.
-     */
-    private static final float MIN_COLUMN_LINE_WIDTH_PT = 100f;
-
-    /**
-     * Minimum number of clearly leftish AND clearly rightish lines (each of width &ge; {@link
-     * #MIN_COLUMN_LINE_WIDTH_PT}) required to call the page two-column. Anything below this falls
-     * back to single-column.
-     */
-    private static final int MIN_SIDE_LINES = 3;
-
-    private final List<float[]> columns;
-    private final List<float[]> gutters;
-
-    private PageColumnLayout(List<float[]> columns, List<float[]> gutters) {
-        this.columns = columns;
-        this.gutters = gutters;
-    }
-
-    /**
-     * Determines column layout from per-line bounding boxes ({@code [x1, _, x2, _]}). Counts lines
-     * whose X-midpoint sits clearly left of, or clearly right of, the page midpoint (with {@link
-     * #MIDPOINT_SLACK_PT} slack each side). If both sides have at least {@link #MIN_SIDE_LINES}
-     * lines, the page is treated as two-column with the gutter at the page midpoint. Otherwise it's
-     * single-column.
-     *
-     * <p>Cross-column lines must already be split: callers should feed boxes from a line extractor
-     * that splits same-Y glyphs at large X gaps (see {@code AllTextLineExtractor}). Without that
-     * split, IEEE-style aligned-baseline 2-column PDFs produce one wide merged box per row and the
-     * side tallies all end up classified as "spanning", falling to single-column.
-     */
-    public static PageColumnLayout fromLineBoxes(List<float[]> lineBoxes, float pageWidth) {
-        if (lineBoxes == null || lineBoxes.isEmpty()) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float pageMid = pageWidth / 2f;
-        int left = 0, right = 0;
-        for (float[] lb : lineBoxes) {
-            if (lb == null || lb.length < 3) continue;
-            float width = lb[2] - lb[0];
-            // Skip narrow lines — dates, page numbers, "Link" labels next to a heading should
-            // not, on their own, make a single-column doc look two-column.
-            if (width < MIN_COLUMN_LINE_WIDTH_PT) continue;
-            float mid = (lb[0] + lb[2]) * 0.5f;
-            if (mid < pageMid - MIDPOINT_SLACK_PT) left++;
-            else if (mid > pageMid + MIDPOINT_SLACK_PT) right++;
-        }
-        if (left < MIN_SIDE_LINES || right < MIN_SIDE_LINES) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float gutterL = pageMid - MIDPOINT_SLACK_PT;
-        float gutterR = pageMid + MIDPOINT_SLACK_PT;
-        return new PageColumnLayout(
-                List.of(new float[] {0f, gutterL}, new float[] {gutterR, pageWidth}),
-                List.of(new float[] {gutterL, gutterR}));
-    }
-
-    /** All columns, left-to-right, as {@code [leftX, rightX]} pairs. Never empty. */
-    public List<float[]> columns() {
-        return columns;
-    }
-
-    /** Gutters between columns, left-to-right, as {@code [leftX, rightX]} pairs. */
-    public List<float[]> gutters() {
-        return gutters;
-    }
-
-    public int columnCount() {
-        return columns.size();
-    }
-
-    /**
-     * Returns the column index containing the X-midpoint of {@code [x1, x2]}, falling back to the
-     * closest column if the midpoint sits inside a gutter.
-     */
-    public int columnOf(float x1, float x2) {
-        float mid = (x1 + x2) * 0.5f;
-        int best = 0;
-        float bestDist = Float.MAX_VALUE;
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            if (mid >= c[0] && mid <= c[1]) return i;
-            float dist = mid < c[0] ? c[0] - mid : mid - c[1];
-            if (dist < bestDist) {
-                bestDist = dist;
-                best = i;
-            }
-        }
-        return best;
-    }
-
-    /**
-     * Returns every column index whose X-range overlaps {@code [x1, x2]} with at least {@link
-     * #SPAN_SLACK_PT} of intrusion. A normal in-column line returns one index; a line crossing a
-     * gutter returns two or more.
-     */
-    public int[] columnsCrossing(float x1, float x2) {
-        List<Integer> hits = new ArrayList<>();
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            float overlap = Math.min(x2, c[1]) - Math.max(x1, c[0]);
-            if (overlap > SPAN_SLACK_PT) hits.add(i);
-        }
-        if (hits.isEmpty()) hits.add(columnOf(x1, x2));
-        int[] out = new int[hits.size()];
-        for (int i = 0; i < hits.size(); i++) out[i] = hits.get(i);
-        return out;
-    }
-}
@@ -1,133 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.awt.geom.Point2D;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.contentstream.PDFGraphicsStreamEngine;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImage;
-import org.apache.pdfbox.util.Matrix;
-
-/**
- * PDFGraphicsStreamEngine that intercepts {@code drawImage} calls and records each image's bounding
- * box in PDF user-space (origin bottom-left, Y up) by transforming the unit square through the
- * current transformation matrix (CTM).
- *
- * <p>Usage:
- *
- * <pre>{@code
- * PageImageLocator locator = new PageImageLocator(page, pageIndex);
- * locator.processPage(page);
- * List<ImageBox> boxes = locator.getImageBoxes();
- * }</pre>
- *
- * <p>Each {@link ImageBox} carries the 0-based page index and the axis-aligned bounding box {@code
- * (x1, y1, x2, y2)} in PDF user-space coordinates.
- */
-public final class PageImageLocator extends PDFGraphicsStreamEngine {
-
-    /**
-     * Bounding box of a raster or vector image found on a PDF page.
-     *
-     * @param pageIndex 0-based page index
-     * @param x1 left edge in PDF user-space (origin bottom-left)
-     * @param y1 bottom edge in PDF user-space
-     * @param x2 right edge
-     * @param y2 top edge
-     */
-    public record ImageBox(int pageIndex, float x1, float y1, float x2, float y2) {}
-
-    private final int pageIndex;
-    private final List<ImageBox> imageBoxes = new ArrayList<>();
-    private final Point2D.Float currentPoint = new Point2D.Float();
-
-    /**
-     * @param page the PDPage to process
-     * @param pageIndex 0-based index of this page in the document (stored on each returned {@link
-     *     ImageBox})
-     */
-    public PageImageLocator(PDPage page, int pageIndex) {
-        super(page);
-        this.pageIndex = pageIndex;
-    }
-
-    /** Returns all image bounding boxes collected during {@link #processPage}. */
-    public List<ImageBox> getImageBoxes() {
-        return imageBoxes;
-    }
-
-    @Override
-    public void drawImage(PDImage pdImage) throws IOException {
-        Matrix ctm = getGraphicsState().getCurrentTransformationMatrix();
-        // An image occupies the unit square (0,0)→(1,1) in image space.
-        // Transform all four corners through the CTM to get the page-space bounding box.
-        float a = ctm.getScaleX();
-        float b = ctm.getShearY();
-        float c = ctm.getShearX();
-        float d = ctm.getScaleY();
-        float e = ctm.getTranslateX();
-        float f = ctm.getTranslateY();
-        float[] xs = {e, a + e, c + e, a + c + e};
-        float[] ys = {f, b + f, d + f, b + d + f};
-        float x1 = Float.MAX_VALUE, y1 = Float.MAX_VALUE;
-        float x2 = -Float.MAX_VALUE, y2 = -Float.MAX_VALUE;
-        for (float x : xs) {
-            x1 = Math.min(x1, x);
-            x2 = Math.max(x2, x);
-        }
-        for (float y : ys) {
-            y1 = Math.min(y1, y);
-            y2 = Math.max(y2, y);
-        }
-        imageBoxes.add(new ImageBox(pageIndex, x1, y1, x2, y2));
-    }
-
-    // ---------- required abstract methods (no-op for path operations) ----------
-
-    @Override
-    public void appendRectangle(Point2D p0, Point2D p1, Point2D p2, Point2D p3) {}
-
-    @Override
-    public void clip(int windingRule) {}
-
-    @Override
-    public void moveTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void lineTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void curveTo(float x1, float y1, float x2, float y2, float x3, float y3) {
-        currentPoint.setLocation(x3, y3);
-    }
-
-    @Override
-    public Point2D getCurrentPoint() {
-        return currentPoint;
-    }
-
-    @Override
-    public void closePath() {}
-
-    @Override
-    public void endPath() {}
-
-    @Override
-    public void strokePath() {}
-
-    @Override
-    public void fillPath(int windingRule) {}
-
-    @Override
-    public void fillAndStrokePath(int windingRule) {}
-
-    @Override
-    public void shadingFill(COSName shadingName) {}
-}
@@ -0,0 +1,79 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
+ * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
+ * {@link PDDocument} lifecycle.
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class PdfIngester {
+
+    private final LineBuilder lineBuilder;
+    private final TableParser tableParser;
+
+    public List<ParsedPage> parse(PDDocument document) throws IOException {
+        return parse(document, document.getNumberOfPages());
+    }
+
+    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
+        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
+        List<ParsedPage> pages = new ArrayList<>(pageCount);
+        long fragmentsMs = 0;
+        long tablesMs = 0;
+        long t0 = System.currentTimeMillis();
+
+        for (int p = 1; p <= pageCount; p++) {
+            long ft = System.currentTimeMillis();
+            List<TextFragment> fragments = extractFragments(document, p);
+            fragmentsMs += System.currentTimeMillis() - ft;
+
+            PDPage page = document.getPage(p - 1);
+            PDRectangle mediaBox = page.getMediaBox();
+            List<RawLine> lines = lineBuilder.build(fragments, p);
+            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
+
+            long tt = System.currentTimeMillis();
+            List<TableFragment> tables = tableParser.parse(document, rawPage);
+            tablesMs += System.currentTimeMillis() - tt;
+
+            log.debug(
+                    "Page {}: {} fragments → {} lines, {} table(s)",
+                    p,
+                    fragments.size(),
+                    lines.size(),
+                    tables.size());
+            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
+        }
+
+        log.info(
+                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
+                pageCount,
+                System.currentTimeMillis() - t0,
+                fragmentsMs,
+                tablesMs);
+        return pages;
+    }
+
+    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
+            throws IOException {
+        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
+        stripper.getText(document);
+        return stripper.getFragments();
+    }
+}
@@ -9,8 +9,7 @@ import java.util.Collections;
 import java.util.List;

 import org.apache.pdfbox.pdmodel.PDDocument;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.stereotype.Service;

 import lombok.extern.slf4j.Slf4j;

@@ -48,7 +47,7 @@ import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
 *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
 * </ul>
 */
-@ApplicationScoped
+@Service
@Slf4j
 public class TabulaTableParser implements TableParser {

@@ -0,0 +1,113 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.text.PDFTextStripper;
+import org.apache.pdfbox.text.TextPosition;
+
+/**
+ * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
+ *
+ * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
+ * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
+ * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
+ */
+class WordExtractingStripper extends PDFTextStripper {
+
+    private final int targetPage;
+    private final List<TextFragment> fragments = new ArrayList<>();
+    private int fragmentIndex = 0;
+
+    WordExtractingStripper(int pageNumber) throws IOException {
+        this.targetPage = pageNumber;
+        setStartPage(pageNumber);
+        setEndPage(pageNumber);
+        setSortByPosition(true);
+    }
+
+    @Override
+    protected void startPage(PDPage page) throws IOException {
+        super.startPage(page);
+        fragments.clear();
+        fragmentIndex = 0;
+    }
+
+    @Override
+    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
+        if (text == null || text.isBlank()) return;
+
+        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
+        // number as its own string operation, so this is the common case).
+        if (text.indexOf(' ') < 0) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
+        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
+        if (textPositions.size() != text.length()) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
+        int start = 0;
+        for (int i = 0; i <= text.length(); i++) {
+            if (i == text.length() || text.charAt(i) == ' ') {
+                if (start < i) {
+                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
+                }
+                start = i + 1;
+            }
+        }
+    }
+
+    private void emitFragment(String text, List<TextPosition> positions) {
+        if (positions.isEmpty()) return;
+
+        float minX = Float.MAX_VALUE;
+        float minY = Float.MAX_VALUE;
+        float maxRight = -Float.MAX_VALUE;
+        float maxBaseline = -Float.MAX_VALUE;
+        TextPosition first = null;
+
+        for (TextPosition tp : positions) {
+            if (tp == null) continue;
+            if (first == null) first = tp;
+
+            float x = tp.getX();
+            // getY() is the baseline; top of character = getY() - getHeight().
+            float top = tp.getY() - tp.getHeight();
+            float right = x + tp.getWidth();
+            float baseline = tp.getY();
+
+            minX = Math.min(minX, x);
+            minY = Math.min(minY, top);
+            maxRight = Math.max(maxRight, right);
+            maxBaseline = Math.max(maxBaseline, baseline);
+        }
+
+        if (first == null) return;
+
+        PDFont font = first.getFont();
+        String fontName = font != null ? font.getName() : "";
+        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
+        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
+        float fontSize = first.getHeight();
+
+        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
+        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
+        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
+    }
+
+    List<TextFragment> getFragments() {
+        return Collections.unmodifiableList(fragments);
+    }
+}
@@ -2,27 +2,21 @@ package stirling.software.common.annotations;

 import java.lang.annotation.*;

-import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import org.springframework.core.annotation.AliasFor;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;

-import jakarta.enterprise.util.Nonbinding;
-import jakarta.interceptor.InterceptorBinding;
-import jakarta.ws.rs.core.MediaType;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;

 /**
 * Shortcut for a POST endpoint that is executed through the Stirling "auto‑job" framework.
 *
- * <p>MIGRATION (Spring -> Quarkus): this was a Spring composed meta-annotation that stamped
- * {@code @RequestMapping(method=POST)} onto the target via {@code @AliasFor}. JAX-RS does not
- * honour {@code @Path}/{@code @POST}/{@code @Consumes} through meta-annotations, so this annotation
- * no longer provides routing. It is now a CDI {@link InterceptorBinding} handled by {@code
- * AutoJobInterceptor}. <b>Controllers using {@code @AutoJobPostMapping} must additionally declare
- * their own JAX-RS {@code @POST} + {@code @Path(value)} + {@code @Consumes(consumes)}.</b> The
- * {@link #value()}/{@link #consumes()} members are retained so a scanner/controller can read the
- * intended routing.
- *
 * <p>Behaviour notes:
 *
 * <ul>
+ *   <li>The endpoint is registered with {@code POST} and, by default, consumes {@code
+ *       multipart/form-data} unless you override {@link #consumes()}.
 *   <li>When the client supplies {@code ?async=true} the call is handed to {@link
 *       stirling.software.common.service.JobExecutorService JobExecutorService} where it may be
 *       queued, retried, tracked and subject to time‑outs. For synchronous (default) invocations
@@ -32,26 +26,22 @@ import jakarta.ws.rs.core.MediaType;
 *       GET /api/v1/general/job/{id}</code>.
 * </ul>
 *
- * <p>Unless stated otherwise an attribute only affects <em>async</em> execution. All members are
- * {@code @Nonbinding} so the single {@code AutoJobInterceptor} matches every annotated method; the
- * interceptor reads the actual values reflectively from the target method.
+ * <p>Unless stated otherwise an attribute only affects <em>async</em> execution.
 */
-@Target({ElementType.METHOD, ElementType.TYPE})
+@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
-@InterceptorBinding
+@RequestMapping(method = RequestMethod.POST)
@RequestBody(required = true)
 public @interface AutoJobPostMapping {

-    /**
-     * The path mapping of the endpoint (controllers must mirror this on a JAX-RS {@code @Path}).
-     */
-    @Nonbinding
+    /** Alias for {@link RequestMapping#value} – the path mapping of the endpoint. */
+    @AliasFor(annotation = RequestMapping.class, attribute = "value")
    String[] value() default {};

    /** MIME types this endpoint accepts. Defaults to {@code multipart/form-data}. */
-    @Nonbinding
-    String[] consumes() default {MediaType.MULTIPART_FORM_DATA};
+    @AliasFor(annotation = RequestMapping.class, attribute = "consumes")
+    String[] consumes() default {MediaType.MULTIPART_FORM_DATA_VALUE};

    /**
     * Maximum execution time in milliseconds before the job is aborted. A negative value means "use
@@ -59,7 +49,6 @@ public @interface AutoJobPostMapping {
     *
     * <p>Only honoured when {@code async=true}.
     */
-    @Nonbinding
    long timeout() default -1;

    /**
@@ -68,7 +57,6 @@ public @interface AutoJobPostMapping {
     *
     * <p>Only honoured when {@code async=true}.
     */
-    @Nonbinding
    int retryCount() default 1;

    /**
@@ -76,7 +64,6 @@ public @interface AutoJobPostMapping {
     *
     * <p>Only honoured when {@code async=true}.
     */
-    @Nonbinding
    boolean trackProgress() default true;

    /**
@@ -85,17 +72,11 @@ public @interface AutoJobPostMapping {
     *
     * <p>Only honoured when {@code async=true}.
     */
-    @Nonbinding
    boolean queueable() default false;

    /**
     * Relative resource weight (1-100). See {@link
     * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
-     *
-     * <p>The default is a sentinel ({@link Integer#MIN_VALUE}); {@code
-     * AutoJobPostMappingWeightTest} fails the build if any endpoint leaves it unset. Runtime
-     * readers clamp the value into {@code [1, 100]}.
     */
-    @Nonbinding
-    int resourceWeight() default Integer.MIN_VALUE;
+    int resourceWeight() default 1;
 }
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/account").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/account")
@Tag(
        name = "Account Security",
        description =
@@ -5,20 +5,19 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
 * Combined annotation for Admin Settings API controllers.
- *
- * <p>MIGRATION (Spring -> JAX-RS): JAX-RS/RESTEasy does NOT process {@code @Path} via custom
- * meta-annotations (Spring honoured composed {@code @RestController}/{@code @RequestMapping}
- * through {@code @AliasFor}; JAX-RS has no equivalent). This annotation therefore now carries only
- * the OpenAPI {@code @Tag}. Each controller annotated with {@code @AdminApi} MUST additionally
- * declare its own {@code @jakarta.ws.rs.Path("/api/v1/admin/settings")} (the path the removed
- * {@code @RequestMapping} used to supply).
+ * Includes @RestController, @RequestMapping("/api/v1/admin/settings"), and OpenAPI @Tag.
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
+@RestController
+@RequestMapping("/api/v1/admin/settings")
@Tag(
        name = "Admin Settings",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/admin/server-certificate").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/admin/server-certificate")
@Tag(
        name = "Admin - Server Certificate",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/analysis").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/analysis")
@Tag(
        name = "Analysis",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/config").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/config")
@Tag(
        name = "Config",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/convert").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/convert")
@Tag(
        name = "Convert",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/database").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/database")
@Tag(
        name = "Database",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/admin/database").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/admin/database")
@Tag(
        name = "Database Management",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/filter").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/filter")
@Tag(
        name = "Filter",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/general").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/general")
@Tag(
        name = "General",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/info").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/info")
@Tag(
        name = "Info",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/invite").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/invite")
@Tag(
        name = "Invite",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/misc").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/misc")
@Tag(
        name = "Misc",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/pipeline").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/pipeline")
@Tag(
        name = "Pipeline",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -14,9 +17,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/proprietary/ui-data").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/proprietary/ui-data")
@Tag(
        name = "Proprietary UI Data",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/security").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/security")
@Tag(
        name = "Security",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/settings").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/settings")
@Tag(
        name = "Settings",
        description =
@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;

+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;

 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 */
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/team").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/team")
@Tag(
        name = "Team",
        description =
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Anthony Stirling	ca40fecd4a	audit: jpdfium split	2026-05-22 10:04:53 +01:00
Anthony Stirling	9c2c39256a	impl migration to pdfium for split	2026-05-22 09:43:18 +01:00
Anthony Stirling	2f1fe2c80c	Delete MergeBenchmark	2026-05-21 23:00:00 +01:00
Anthony Stirling	1051f28c52	Drop remaining why/how comments	2026-05-21 19:11:52 +01:00
Anthony Stirling	29ccbf7ae6	Trim verbose comments across JPDFium integration	2026-05-21 19:03:31 +01:00
Anthony Stirling	007c8e17de	Exclude JPDFium native cache from temp-file regression check	2026-05-21 17:46:46 +01:00
Anthony Stirling	81dbb29be3	Iterative addBookmarkFlat with depth + cycle + node-count guards	2026-05-21 17:17:06 +01:00
Anthony Stirling	caef0477a9	Merge remote-tracking branch 'origin/main' into feat/jpdfium-integration # Conflicts: # app/common/build.gradle	2026-05-21 16:55:18 +01:00
Anthony Stirling	7682a0dd54	sign-jpdfium-dylibs: sign both Gradle and Tauri bootJar copies	2026-05-21 16:26:52 +01:00
Anthony Stirling	f90ed4657a	Apply spotless; bash 3.2-compatible array handling in sign-jpdfium-dylibs	2026-05-21 15:53:28 +01:00
Anthony Stirling	a6c7a68242	Move sign-jpdfium-dylibs-in-bootjar.sh into frontend/scripts/	2026-05-21 15:21:25 +01:00
Anthony Stirling	a184b394d6	Strip rationale-history comments from JDK 25 references	2026-05-21 15:20:11 +01:00
Anthony Stirling	302d04c201	Merge remote-tracking branch 'origin/main' into feat/jpdfium-integration # Conflicts: # build.gradle	2026-05-21 15:05:51 +01:00
Anthony Stirling	68ae9d52fb	Bump JPDFium dep to 1.0.0; drop snapshot repo	2026-05-21 14:46:10 +01:00
Anthony Stirling	6552ba905c	Cleanup: drop local mavenLocal hack; gate MergeBenchmark with -Dmerge.bench=true	2026-05-21 11:58:43 +01:00
Anthony Stirling	ee36b6f616	MergeController: preserve source bookmarks through merge (PDFium drops them)	2026-05-21 11:39:59 +01:00
Anthony Stirling	627091f8df	MergeController: use JPDFium native merge (94% less heap on 5-doc merge)	2026-05-21 10:37:01 +01:00
Anthony Stirling	67a37d3291	Filter JPDFium natives per Tauri target OS (saves ~45 MB per bundle)	2026-05-21 00:28:31 +01:00
Anthony Stirling	4b6d4885f4	sign-jpdfium-dylibs: resolve native-jar paths via `jar tf` first `jar xf <jar> <path>` doesn't expand glob patterns in <path> the way `unzip` does — paths must be exact. My initial script passed `BOOT-INF/lib/jpdfium-natives-darwin-x64-*.jar` as a literal path, which matched nothing, so the script always reported "No JPDFium darwin natives in bootJar; nothing to sign" and exited without actually signing anything. Fix: `jar tf` to LIST the bootJar's contents, grep with a regex for the snapshot-versioned native-jar paths, then `jar xf` those exact paths. The natives jars are normally: BOOT-INF/lib/jpdfium-natives-darwin-x64-1.0.0-SNAPSHOT.jar BOOT-INF/lib/jpdfium-natives-darwin-arm64-1.0.0-SNAPSHOT.jar …but the version number floats with the snapshot timestamp, hence the regex match instead of a fixed path.	2026-05-20 09:46:07 +01:00
Anthony Stirling	2a151b65f7	Move JPDFium dylib signing step AFTER cert import My first placement put the sign-jpdfium-dylibs-in-bootjar step at the wrong point in the workflow: BEFORE the "Verify Certificate" step that sets APPLE_SIGNING_IDENTITY in GITHUB_ENV. So the gate `if: ... && env.APPLE_SIGNING_IDENTITY != ''` always evaluated to false and the step silently skipped, leaving the dylibs unsigned and notarytool still rejecting the .app. Move it to right after Verify Certificate (which sets the env var from the keychain identity). Also switch the gate to checking env.APPLE_CERTIFICATE (the secret that's set at job level and available from step 1) rather than env.APPLE_SIGNING_IDENTITY (set mid-workflow via GITHUB_ENV) — the latter is fine in `run:` blocks but flaky in `if:` evaluation depending on GH Actions evaluation timing.	2026-05-20 09:08:37 +01:00
Anthony Stirling	9458fcd0e2	Re-run CI against JPDFium with Windows ICU trim + harfbuzz-no-glib	2026-05-20 00:45:22 +01:00
Anthony Stirling	1e8c41425b	Sign JPDFium dylibs in bootJar before Tauri notarization (macOS) Tauri-build macos-universal has been failing notarytool because the .dylib files inside the JPDFium native jars (jpdfium-natives-darwin- x64-.jar / -arm64-.jar) ship unsigned — JPDFium's publish workflow has no Apple Developer credentials, so it can't sign during publish. Apple's notarytool walks INTO nested .jars in the .app and reports: "The binary is not signed." path: Stirling-PDF.zip/Stirling-PDF.app/Contents/Resources/libs/ stirling-pdf-.jar/BOOT-INF/lib/ jpdfium-natives-darwin-x64-1.0.0-SNAPSHOT.jar/natives/darwin-x64/ libjpdfium.dylib Tauri's own codesign walk doesn't open .jars, so the fix has to happen here before tauri-action runs. New step between `task desktop:prepare` (builds bootJar) and `tauri-action` (builds .app + notarizes): scripts/sign-jpdfium-dylibs-in-bootjar.sh 1. jar xf bootJar BOOT-INF/lib/jpdfium-natives-darwin-.jar 2. for each native jar, explode it, codesign every .dylib with APPLE_SIGNING_IDENTITY + --options runtime + --timestamp 3. jar cfM0 to repack the natives jar (stored, no deflate — matches Spring Boot's preferred layout) 4. jar uf bootJar to replace the natives jars in the outer bootJar with the freshly-signed versions Gated on macOS-15 + APPLE_SIGNING_IDENTITY being set, so PR builds from forks (no secret) fall through and the existing "binary not signed" failure persists — no regression vs current.	2026-05-19 23:32:09 +01:00
Anthony Stirling	b3277a18c8	Re-run CI: pick up Rust-LTO-trimmed JPDFium snapshot	2026-05-19 18:56:29 +01:00
Anthony Stirling	5ca1586976	Re-run CI: pick up smaller (ICU+qpdf trim) JPDFium snapshot	2026-05-19 18:18:21 +01:00
Anthony Stirling	ce47a4e3af	Re-run CI: pick up ICU-trimmed JPDFium snapshot	2026-05-19 17:08:17 +01:00
Anthony Stirling	859a2d97c2	Always re-resolve JPDFium snapshots in CI PR rerun against new JPDFium snapshots kept using Gradle's cached versions from earlier runs. Gradle caches 'changing modules' (anything ending in -SNAPSHOT) for 24h by default, and gh run rerun --failed reuses the existing run's Gradle home — so even after publishing a fresh com.stirling:jpdfium-natives-*:1.0.0-SNAPSHOT, the bootJar kept embedding the old natives. cacheChangingModulesFor 0 means every Gradle invocation re-checks the snapshot's maven-metadata.xml and pulls a newer timestamped build if present. cacheDynamicVersionsFor 0 does the same for non-snapshot dynamic versions (e.g. '1.+'). Both are scoped to the subprojects.configurations.all block alongside the existing security force-versions. Trade-off: every Gradle invocation in CI does a HEAD against Maven Central per snapshot dep (4 natives + 1 main jpdfium = 5 small requests). Negligible compared to a download. Reverts naturally when JPDFium ships a tagged release.	2026-05-19 15:00:02 +01:00
Anthony Stirling	a422deecdb	Re-add jpdfium-natives-darwin-x64 (Intel Mac) runtime dep The publish-github-packages workflow's restored darwin-x64 build now cross-compiles from macos-14 under Rosetta + a second Homebrew, so the natives jar is available again. Adding it back to the bootJar classpath lets the tauri-build macos-15 universal binary cover Intel Macs too.	2026-05-19 10:15:16 +01:00
Anthony Stirling	7f8f09c899	Native-access via bootJar manifest, not CLI flags everywhere JDK 22+ honors an 'Enable-Native-Access' attribute on the executable jar's manifest (JEP 472). Setting it once on the Spring Boot bootJar removes the need to remember --enable-native-access=ALL-UNNAMED in: - Docker init script's JAVA_BASE_OPTS injection - Tauri Rust launcher's java_options vector - Anywhere else somebody runs the bootJar …and also future-proofs against JDK 26's hard-fail behavior without each launch point having to track the flag. app/core/build.gradle: add 'Enable-Native-Access': 'ALL-UNNAMED' to the bootJar manifest attributes block. build.gradle (bootRun jvmArgs): keep --enable-native-access=ALL-UNNAMED because bootRun launches from classfiles, not the bootJar — the manifest mechanism doesn't apply to that codepath, only to 'java -jar'. scripts/init-without-ocr.sh: drop the FFM injection. frontend/src-tauri/src/commands/backend.rs: drop the CLI arg.	2026-05-18 21:35:06 +01:00
Anthony Stirling	96920b1186	build.gradle: modernJavaVersion 21 -> 25 This was the actual culprit behind 'JVM runtime version 21 vs 25' Gradle variant-attribute mismatch errors during PR CI. modernJavaVersion drives: - options.release on JavaCompile.configureEach across all subprojects - restart-helper compile target Even though sourceCompatibility / targetCompatibility were already bumped to VERSION_25 in an earlier commit, --release 21 on javac overrode them and made Gradle's compileClasspath declare org.gradle.jvm.version=21, which then refused to resolve com.stirling:jpdfium:1.0.0-SNAPSHOT (published as JVM 25). Bumping modernJavaVersion to 25 aligns everything.	2026-05-18 19:09:28 +01:00
Anthony Stirling	3626319685	docs+ci: scrub remaining JDK 21 references JPDFium's published artifacts target JVM 25 and Stirling-PDF's main sources are now compiled with sourceCompatibility = VERSION_25, so JDK 21 is no longer supported. Update header comments and developer-facing docs to reflect the hard floor. - backend-build.yml header: 'JDK 21/25 \xc3\x97 spring-security' -> 'JDK 25 \xc3\x97 spring-security' - AGENTS.md Important Notes: minimum 21 -> requires 25 - DeveloperGuide.md prerequisites + setup steps: drop 'or later, 25 recommended' language, say 'JDK 25' outright.	2026-05-18 19:07:11 +01:00
Anthony Stirling	755f270a31	ci: drop JDK 21 from backend build matrix JPDFium's published artifacts carry org.gradle.jvm.version=25 (FFM is finalized at JDK 22+; JPDFium picks 25 as the source target). Gradle's variant attribute matching refuses to resolve the dep on JDK 21 targets, so the 21 cells in this matrix were guaranteed to fail. Now that targetCompatibility is bumped to 25 across the project, JDK 25 is the only supported toolchain.	2026-05-18 19:04:59 +01:00
Anthony Stirling	6e1a7454ca	Integrate Stirling-Tools JPDFium for PDF operations This is a bring-up branch to validate JPDFium consumption across all Stirling-PDF release targets (server jar, Docker, Tauri desktop). Open as PR for cross-platform CI validation. Source dep - com.stirling:jpdfium:1.0.0-SNAPSHOT (pulled from Maven Central snapshots, fully anonymous — no PAT or GitHub Packages auth needed) - Per-platform natives: linux-x64, linux-arm64, darwin-arm64, windows-x64 All four are added as runtimeOnly so the bootJar carries every platform and NativeLoader picks the right one at startup. The natives jars are hermetic — each bundles its bridge, PDFium component libs, and the third-party deps (pcre2/freetype/harfbuzz/icu/qpdf/pugixml/libunibreak), so no system package install is required at runtime. - TODO follow-up: jpdfium-natives-darwin-x64 (Intel Mac) — dropped from the upstream publish matrix while cross-compile-on-macos-14 setup lands. JDK 25 enforcement - Bump root + subprojects from sourceCompatibility / targetCompatibility 21 -> 25. JPDFium publishes with org.gradle.jvm.version=25 (FFM is final in JDK 22+; JPDFium picks 25 as the floor), and a 21-targeted Stirling-PDF jar would fail Gradle's variant attribute match at compile time. - bootRun jvmArgs: add --enable-native-access=ALL-UNNAMED. JDK 25 warns on restricted FFM methods without it; JDK 26 will hard-fail. Docker - scripts/init-without-ocr.sh: prepend --enable-native-access=ALL-UNNAMED to JAVA_BASE_OPTS so the JAVA_TOOL_OPTIONS env var that the container sets includes it for the running JVM. Idempotent — won't duplicate if already present. Tauri - frontend/src-tauri/src/commands/backend.rs: the sidecar Java spawn now passes --enable-native-access=ALL-UNNAMED. The bundled jlink JRE's module list (desktop.yml JLINK_MODULES) already includes java.desktop and java.net.http which is everything JPDFium's module-info requires. Smoke test - app/common/src/test/java/stirling/software/common/jpdfium/JPDFiumSmokeTest.java Opens the existing common test resource example.pdf via PdfDocument.open and asserts a positive page count. Confirms the dep resolves, the right natives jar lands on the classpath, the bridge + PDFium component libs + third-party deps all load, and the FFM bindings parse a real PDF end-to-end. Runs as part of :common:test on each platform's CI runner.	2026-05-18 18:31:37 +01:00