merge main

# Description of Changes

# Description of Changes

- What was changed
- Filtered the "Add Member to Team" user picker so users who are already
members of the selected target team are no longer shown.
  - Applied the same filtering in both team management entry points:
    - `TeamsSection`
    - `TeamDetailsSection`
- Kept users in other teams visible, so they can still be moved into the
selected team.

- Why the change was made
- The modal was showing users who were already part of the target team,
which made the action misleading and allowed redundant selection.
- Hiding already-assigned users keeps the UI aligned with the actual
action: adding new members to the team

before:

<img width="442" height="425" alt="image"
src="https://github.com/user-attachments/assets/9faf991f-a7d3-4a48-91cd-f47730decde8"
/>

after:

<img width="430" height="382" alt="image"
src="https://github.com/user-attachments/assets/f8291172-feb6-4d8d-b536-eebf752b764b"
/>



---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

.dockerignore

@@ -8,8 +8,6 @@
 build/
 */build/
 **/build/
-# ...but re-include the Quarkus runner-jar so docker/quarkus/Dockerfile can layer it on the base image
-!app/core/build/*-runner.jar
 out/
 target/
 **/target/

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.13.0
+pkgver=2.13.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.13.0
+pkgver=2.13.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')

.github/workflows/db-migration-test.yml

@@ -58,18 +58,16 @@ jobs:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:quarkusBuild -PnoSpotless --no-daemon
+        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
 
       - name: Locate built JAR
         id: jar
         run: |
-          # Quarkus (quarkus.package.jar.type=uber-jar) emits a standalone runnable
-          # jar at app/core/build/<name>-runner.jar, replacing the Spring Boot bootJar
-          # that used to land in app/core/build/libs.
-          jar=$(find app/core/build -maxdepth 1 -name '*-runner.jar' 2>/dev/null | head -n 1)
+          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
+              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
           if [[ -z "$jar" ]]; then
-            echo "::error::No *-runner.jar under app/core/build"
-            ls -lah app/core/build || true
+            echo "::error::No JAR under app/core/build/libs"
+            ls -lah app/core/build/libs || true
             exit 1
           fi
           # Absolute path - the migration script pushd's into a temp workdir

.github/workflows/nightly.yml

@@ -51,3 +51,15 @@ jobs:
           name: playwright-nightly-${{ github.run_id }}
           path: frontend/editor/playwright-report/
           retention-days: 14
+
+  # Builds all desktop platforms on a schedule so the Rust dependency cache is
+  # written on main, where PR and merge-queue tauri builds can restore it.
+  warm-tauri-cache:
+    name: Warm Tauri Rust cache
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: ./.github/workflows/tauri-build.yml
+    with:
+      platform: all
+    secrets: inherit

.github/workflows/push-docker.yml

@@ -155,9 +155,9 @@ jobs:
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # No BASE_VERSION pin: inherit the Dockerfile ARG default (single source of truth).
           build-args: |
             VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-            BASE_VERSION=1.0.0
           platforms: linux/amd64,linux/arm64/v8
           provenance: true
           sbom: true

.github/workflows/tauri-build.yml

@@ -115,6 +115,20 @@ jobs:
           toolchain: stable
           targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
+      # Cache the Cargo registry and compiled dependency crates so the build
+      # only recompiles the app crate. Written on main; PRs and the merge queue
+      # restore from it.
+      - name: Cache Rust build
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: frontend/editor/src-tauri
+          # Stable key shared across workflows so the nightly warmer. 
+          # rust-cache still appends OS + rustc + Cargo.lock.
+          shared-key: tauri-${{ matrix.name }}
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+          # Save the dependency cache even if a later step fails
+          cache-on-failure: true
+
       - name: Set up x86_64 JDK 25 (macOS universal JRE)
         if: matrix.platform == 'macos-15'
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

.gitignore

@@ -42,18 +42,14 @@ SwaggerDoc.json
 # Runtime storage for uploaded files and user data (not Java source code)
 app/core/storage/
 
-# Frontend build artifacts copied to Quarkus static resources
-# Generated by `npm build` + the copyFrontendAssets/copyFrontendIndexHtml tasks; never committed.
-# The React bundle goes to META-INF/resources/ (Quarkus serves these over HTTP); index.html is the
-# only generated file in static/ (ReactRoutingController serves it). See app/core/build.gradle.
-app/core/src/main/resources/META-INF/resources/
-app/core/src/main/resources/static/index.html
-# Migration cleanup: earlier builds emitted the whole bundle into static/. Keep these ignored so
-# any stale generated assets left in static/ are not accidentally committed.
+# Frontend build artifacts copied to backend static resources
+# These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
+app/core/src/main/resources/static/index.html
 # Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
 app/core/src/main/resources/static/*.html
 !app/core/src/main/resources/static/api-landing.html
+!app/core/src/main/resources/static/mobile-upload.html
 # Prerendered nested-route pages (e.g. settings/people.html)
 app/core/src/main/resources/static/settings/
 app/core/src/main/resources/static/locales/
@@ -71,7 +67,7 @@ app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
 app/core/src/main/resources/static/**/*.gz
 app/core/src/main/resources/static/**/*.br
-# Note: Keep backend-managed files like fonts/, css/, js/, etc.
+# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
 # Gradle
 .gradle
@@ -285,23 +281,8 @@ docs/type3/signatures/
 
 **/application-dev-local.properties
 
-# AI agent session/local files - may contain tokens and secrets
+# Claude
 .claude/
-.agents/
-.cursor/
-.codex/
-.opencode/
-.copilot/
-.cline/
-.continue/
-.windsurf/
-.junie/
-.pi/
-.roo/
-.augment/
-.aider*
-CLAUDE.local.md
-skills-lock.json
 
 # Playwright MCP screenshots / traces
 .playwright-mcp/

.taskfiles/backend.yml

@@ -25,6 +25,7 @@ tasks:
           AIENGINE_URL: '{{.AIENGINE_URL}}'
           AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
           AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
+          SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN}}'
 
   dev:proprietary:
     desc: "Start backend dev server in proprietary mode"
@@ -34,12 +35,13 @@ tasks:
       AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
       AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
       AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
+      SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN | default ""}}'
     env:
       SERVER_PORT: '{{.PORT}}'
     cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
         platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}./gradlew :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}./gradlew :stirling-pdf:bootRun'
         platforms: [linux, darwin]
 
   dev:bundled:

.taskfiles/frontend.yml

@@ -130,9 +130,34 @@ tasks:
 
   dev:portal:
     desc: "Start developer portal dev server"
+    ignore_error: true
     deps: [install]
+    vars:
+      PORT: '{{.PORT | default "5173"}}'
+      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
+      EDITOR_URL: '{{.EDITOR_URL | default ""}}'
+      OPEN: '{{.OPEN | default ""}}'
+      SUBPATH: '{{.SUBPATH | default ""}}'
+      MOCKS: '{{.MOCKS | default ""}}'
+    env:
+      BACKEND_URL: '{{.BACKEND_URL}}'
     cmds:
-      - npx vite portal --port {{.PORT | default "5173"}}{{if .OPEN}} --open{{end}}
+      - '{{if .SUBPATH}}RUN_SUBPATH={{.SUBPATH}} {{end}}{{if .MOCKS}}VITE_PORTAL_MOCKS={{.MOCKS}} {{end}}{{if .EDITOR_URL}}VITE_EDITOR_URL={{.EDITOR_URL}} {{end}}npx vite portal --port {{.PORT}}{{if .OPEN}} --open{{end}}'
+
+  dev:portal:proxy:serve:
+    internal: true
+    vars:
+      PORT: '{{.PORT | default "3000"}}'
+      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
+      EDITOR_DEV_URL: '{{.EDITOR_DEV_URL | default ""}}'
+      PORTAL_DEV_URL: '{{.PORTAL_DEV_URL | default ""}}'
+    env:
+      PORT: '{{.PORT}}'
+      BACKEND_URL: '{{.BACKEND_URL}}'
+      EDITOR_DEV_URL: '{{.EDITOR_DEV_URL}}'
+      PORTAL_DEV_URL: '{{.PORTAL_DEV_URL}}'
+    cmds:
+      - npx tsx scripts/dev-origin-proxy.ts
 
   # ============================================================
   # Build
@@ -153,8 +178,10 @@ tasks:
   build:proprietary:
     desc: "Build for proprietary mode"
     deps: [prepare]
+    vars:
+      PREVIEW: '{{.PREVIEW | default ""}}'
     cmds:
-      - npx vite build editor --mode proprietary
+      - '{{if .PREVIEW}}VITE_BUILD_FOR_PREVIEW=1 {{end}}npx vite build editor --mode proprietary'
 
   build:saas:
     desc: "Build for SaaS mode"
@@ -181,8 +208,26 @@ tasks:
   build:portal:
     desc: "Build developer portal"
     deps: [install]
+    vars:
+      SUBPATH: '{{.SUBPATH | default ""}}'
     cmds:
-      - npx vite build portal
+      - '{{if .SUBPATH}}RUN_SUBPATH={{.SUBPATH}} {{end}}npx vite build portal'
+
+  preview:portal:proxy:
+    desc: "Build + serve editor + portal behind one origin (prod-like auth testing)"
+    deps: [prepare]
+    vars:
+      PORT: '{{.PORT | default "3000"}}'
+      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
+    env:
+      PORT: '{{.PORT}}'
+      BACKEND_URL: '{{.BACKEND_URL}}'
+    cmds:
+      - task: build:proprietary
+        vars: { PREVIEW: '1' }
+      - task: build:portal
+        vars: { SUBPATH: portal }
+      - npx tsx scripts/dev-origin-proxy.ts
 
   storybook:
     desc: "Start Storybook dev server"
@@ -288,6 +333,7 @@ tasks:
     desc: "Typecheck scripts"
     deps: [prepare]
     cmds:
+      - npx tsc --noEmit --project scripts/tsconfig.json
       - npx tsc --noEmit --project editor/scripts/tsconfig.json
 
   typecheck:prototypes:

.taskfiles/pre-commit.yml

@@ -4,8 +4,6 @@ version: '3'
 # pre-commit hook (.pre-commit-config.yaml) and CI (pre_commit.yml) both call.
 
 vars:
-  GITLEAKS: '8.30.0'
-
   # File selections as git pathspecs: git does the include/exclude matching, so
   # there is no grep/xargs and it behaves identically on every platform.
   PY_FILES: >-
@@ -43,7 +41,9 @@ vars:
     ':(exclude).github/workflows/*'
   LOCALE_TOML: 'frontend/editor/public/locales/*/translation.toml'
 
-  GITLEAKS_BIN: '.task/bin/gitleaks-{{.GITLEAKS}}{{if eq OS "windows"}}.exe{{end}}'
+  # gitleaks is pinned + checksum-verified by scripts/pre-commit/install_gitleaks.py,
+  # which owns the version and caches the binary here.
+  GITLEAKS_BIN: '.task/bin/gitleaks{{if eq OS "windows"}}.exe{{end}}'
 
 tasks:
   default:
@@ -84,22 +84,13 @@ tasks:
       - test -d scripts/pre-commit/.venv
 
   clean:
-    desc: "Remove the cache/build artifacts"
+    desc: "Remove the cached gitleaks binary and the tool virtualenv"
     cmds:
-      - task: '{{if eq OS "windows"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    cmds:
-      - rm -rf scripts/pre-commit/.venv .task/bin/gitleaks-*
-
-  # On Windows, use PowerShell so it matches the same paths and tolerates absent
-  # files without erroring.
-  clean-windows:
-    internal: true
-    ignore_error: true
-    cmds:
-      - powershell -NoProfile -Command "Remove-Item -Recurse -Force -ErrorAction SilentlyContinue scripts/pre-commit/.venv, .task/bin/gitleaks-*"
+      - cmd: rm -rf scripts/pre-commit/.venv .task/bin/gitleaks
+        platforms: [linux, darwin]
+      - cmd: cmd /c "rmdir /s /q scripts\pre-commit\.venv & del /q .task\bin\gitleaks.exe"
+        platforms: [windows]
+        ignore_error: true
 
   # Individual checks (hidden from `task --list`, but callable, e.g.
   # `task pre-commit:toml-sort FIX=1`). Pass FIX=1 to auto-fix where supported.
@@ -116,7 +107,7 @@ tasks:
   codespell:
     deps: [install]
     cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment,vertx --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
+      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
 
   toml-sort:
     deps: [install]
@@ -125,7 +116,7 @@ tasks:
 
   whitespace:
     cmds:
-      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}$(git ls-files {{.WS_FILES}})
+      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
 
   gitleaks:
     deps: [gitleaks-bin]
@@ -137,23 +128,6 @@ tasks:
 
   gitleaks-bin:
     internal: true
-    desc: "Ensure the pinned gitleaks binary is cached in .task/bin"
-    status:
-      - test -f {{.GITLEAKS_BIN}}
-    vars:
-      GL_ARCH: '{{if eq ARCH "amd64"}}x64{{else if eq ARCH "arm64"}}arm64{{else if eq ARCH "386"}}x32{{else}}{{ARCH}}{{end}}'
-      GL_PLATFORM: '{{OS}}_{{.GL_ARCH}}'
-      GL_URL: 'https://github.com/gitleaks/gitleaks/releases/download/v{{.GITLEAKS}}/gitleaks_{{.GITLEAKS}}_{{.GL_PLATFORM}}'
-      # SHA-256 of each release asset, from gitleaks_{{.GITLEAKS}}_checksums.txt.
-      GL_SHA: >-
-        {{if eq .GL_PLATFORM "linux_x64"}}79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e
-        {{- else if eq .GL_PLATFORM "linux_arm64"}}b4cbbb6ddf7d1b2a603088cd03a4e3f7ce48ee7fd449b51f7de6ee2906f5fa2f
-        {{- else if eq .GL_PLATFORM "darwin_x64"}}ca221d012d247080c2f6f61f4b7a83bffa2453806b0c195c795bbe9a8c775ed5
-        {{- else if eq .GL_PLATFORM "darwin_arm64"}}b251ab2bcd4cd8ba9e56ff37698c033ebf38582b477d21ebd86586d927cf87e7
-        {{- else if eq .GL_PLATFORM "windows_x64"}}54fe94f644b832dd08e8c3a5915efb3bfa862386d59fb27ca0792cb687a83573
-        {{- end}}
+    desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
     cmds:
-      - cmd: bash scripts/pre-commit/install-gitleaks.sh "{{.GL_URL}}.tar.gz" "{{.GL_SHA}}" "{{.GITLEAKS_BIN}}"
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -File scripts/pre-commit/install-gitleaks.ps1 -Url "{{.GL_URL}}.zip" -Sha "{{.GL_SHA}}" -Dest "{{.GITLEAKS_BIN}}"
-        platforms: [windows]
+      - uv run --no-project python scripts/pre-commit/install_gitleaks.py

AGENTS.md

@@ -152,7 +152,7 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 #### Import Paths - CRITICAL
 **ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.
 
-For a broader explanation of the frontend layering and override architecture, see [frontend/editor/DeveloperGuide.md](frontend/editor/DeveloperGuide.md).
+For a broader explanation of the frontend layering and override architecture, read @frontend/editor/DeveloperGuide.md
 
 ```typescript
 // ✅ CORRECT - Use @app/* for all imports

QUARKUS_MIGRATION_HANDOFF.md

@@ -1,563 +0,0 @@
-# Stirling-PDF: Spring Boot → Quarkus Migration — Continuation Handoff
-
-> **Purpose:** everything needed to resume this migration in a fresh session. Read this top-to-bottom
-> before touching anything. Companion doc `migration-report.md` has the higher-level summary; this
-> file is the working/continuation guide with the concrete state, commands, fixed bugs, remaining
-> bugs, and the recurring patterns you need to apply.
-
----
-
-## 0. TL;DR status
-
-- **2026-06-19 — merged `main` (136 commits) into `migration/run-02`.** Resolved 69 conflicts and
-  did **full Spring removal + Quarkus migration of every newly pulled-in file** (36 Spring-bearing
-  files: 21 proprietary + 15 saas). Net effect on main: legacy credits engine deleted (#6687,
-  replaced by PAYG #6589); the proprietary **policy** subsystem and the new **PAYG** subsystem
-  migrated to CDI/JAX-RS/Panache. Verified: 0 conflict markers, 0 `org.springframework` imports in
-  any main source. **`core` + `proprietary` compile; `proprietary` Quarkus-augments + boots + serves
-  real traffic; `saas` now compiles AND augments too** (previously ~28 CDI issues). Cross-file fix:
-  `PolicyExecutor`/`DownstreamEntitlementError` now carry HTTP status+body via
-  `jakarta.ws.rs.WebApplicationException` (was Spring `RestClientResponseException`);
-  `AiWorkflowService.paygLimitResponseOrNull` rewired to it. Repo `save()` shim added to the Panache
-  repos whose callers/tests expect Spring-Data `save()`.
-- **Branch:** `migration/run-01` (all work committed locally, **nothing pushed** — `origin` is the
-  public `Stirling-Tools/Stirling-PDF` repo; do not push without the owner's say-so).
-- **Default flavor (`proprietary`):** compiles, Quarkus-augments, boots, and serves real traffic in
-  Docker. ✅
-- **Cucumber API e2e (full-tool Docker image):** baselines, newest first:
-  - **Run 2 (login off, this session's fixes, no JWT mechanism): 223 / 258 pass**, 35 failed, 80
-    skipped. Up from the prior **183 / 258** baseline (+40). Eliminated buckets: split
-    `PDF corrupted` 8→0, `FileAlreadyExists` 8→0, `Admin login failed (500)` 17→0.
-  - **Run 3 (login off + `V2=true` + the new JWT Bearer mechanism): the 80 JWT/admin scenarios now
-    RUN (0 skipped)** because the `login → /me` probe passes. See §6.E / "Session 2". Final tally
-    recorded in §9.
-- **Stack:** Quarkus 3.33.2 LTS, **Java 25** (mandatory — see §2), Hibernate ORM Panache,
-  quarkus-rest (RESTEasy Reactive), quarkus-oidc, quarkus-undertow (servlet, for filters), OpenSAML 5.
-- **`saas` flavor:** compiles but full augmentation has ~28 CDI issues (design-level follow-up).
-- **JWT Bearer login:** ✅ works end-to-end (token issue + validate → `SecurityIdentity`, role
-  mapping, `@RolesAllowed`). **OAuth2/OIDC + SAML2 SSO:** ✅ both work end-to-end against the
-  `testing/compose` Keycloak stacks; `validate-oauth-test.sh` and `validate-saml-test.sh` both pass
-  (see §6.F). The default e2e Docker image + build helper are committed at `docker/quarkus/` (§3.3).
-
----
-
-## 1. Repo / flavor layout
-
-Multi-module Gradle build, three selectable flavors via `STIRLING_FLAVOR` (or `ENABLE_SAAS` /
-`DISABLE_ADDITIONAL_FEATURES`):
-
-| Flavor | Modules included | Notes |
-|--------|------------------|-------|
-| `core` | `:common`, `:stirling-pdf` (core) | OSS only |
-| `proprietary` (**default**) | + `:proprietary` | what all the e2e work targets |
-| `saas` | + `:saas` | opt-in: `STIRLING_FLAVOR=saas`; not yet augmentable |
-
-Module → directory:
-- `:stirling-pdf` → `app/core` (the runnable Quarkus app; applies the `io.quarkus` gradle plugin)
-- `:common` → `app/common` (library; CDI beans / JAX-RS / entities)
-- `:proprietary` → `app/proprietary` (library)
-- `:saas` → `app/saas` (library, only on saas flavor)
-
-Quarkus only discovers beans/entities in dependency jars that carry a **Jandex index**; the library
-modules are indexed via `quarkus.index-dependency.*` in
-`app/core/src/main/resources/application.properties`.
-
----
-
-## 2. Java 25 is mandatory (don't regress this)
-
-- The build uses a **JDK 25 toolchain** (`build.gradle` `subprojects { java { toolchain = 25 } }`).
-- The app is compiled to **class-file version 69 (Java 25)** — it will NOT run on JDK 21.
-- **The host's default `java` on the PATH is JDK 21.** Use the toolchain JDK 25 explicitly:
-  - `JAVA_HOME` points to a Temurin 25 JDK (`C:\Users\systo\scoop\apps\temurin25-jdk\current`).
-  - In Git Bash run the jar with `"$JAVA_HOME/bin/java" -jar ...` (host `java` = 21 → `UnsupportedClassVersionError`).
-- The Docker base image `stirlingtools/stirling-pdf-base:1.0.2` ships **Temurin 25.0.2** — so the
-  container runtime is JDK 25 already. Keep it that way; do not switch the base image to a JRE < 25.
-- Gradle build images / CI also pin `gradle:9.3.1-jdk25` and `eclipse-temurin:25-jre-noble`.
-
----
-
-## 3. Build → package → run → test (the exact loop)
-
-### 3.1 Build the runnable jar
-```bash
-./gradlew :stirling-pdf:quarkusBuild -x test --console=plain
-```
-- Produces the **runnable uber-jar** at: `app/core/build/stirling-pdf-2.12.0-runner.jar`
-  - `Main-Class: stirling.software.SPDF.SPDFApplication`.
-- ⚠️ **GOTCHA:** `app/core/build/libs/stirling-pdf-2.12.0.jar` is the *plain* (non-runnable) jar with
-  an empty manifest. The upstream `docker/embedded/Dockerfile` copies `libs/*.jar` — that's now the
-  WRONG jar. Always use the `-runner.jar`. (`quarkus.package.jar.type=uber-jar` is set in
-  application.properties.)
-- ⚠️ If the build fails with `Unable to delete .../-runner.jar`, a previous `java -jar` is still
-  holding it. Kill it: PowerShell `Get-CimInstance Win32_Process -Filter "Name='java.exe'" | ?{ $_.CommandLine -like '*stirling-pdf-2.12.0-runner*' } | %{ Stop-Process -Id $_.ProcessId -Force }`.
-
-### 3.2 Run standalone for a quick boot check (host JDK 25, fastest)
-```bash
-SECURITY_ENABLELOGIN=false QUARKUS_HTTP_PORT=8095 \
-QUARKUS_DATASOURCE_JDBC_URL="jdbc:h2:mem:t;DB_CLOSE_DELAY=-1;MODE=PostgreSQL" \
-nohup "$JAVA_HOME/bin/java" -jar app/core/build/stirling-pdf-2.12.0-runner.jar > /tmp/boot.log 2>&1 &
-# success line in log: "Stirling-PDF running on port: 8095"  (this app does NOT print Quarkus' "Listening on")
-```
-Health: `curl localhost:8095/api/v1/info/status` → `{"version":"2.12.0","status":"UP"}`.
-
-### 3.3 The "normal" Docker image (full tools) — what the cucumber e2e uses
-The upstream `docker/embedded/Dockerfile` is **Spring-Boot-specific** (uses
-`java -Djarmode=tools -jar app.jar extract --layers` + `spring-boot-loader` layers) and does NOT
-work with the Quarkus jar. For e2e I built an ad-hoc image layering the runner-jar on the prebuilt
-**base image** (which already has Java 25 + LibreOffice + Tesseract + qpdf + Ghostscript + Calibre +
-Python). **This Dockerfile lives in a temp dir and needs to be committed into the repo** (see §6 TODO).
-
-Build context (currently ephemeral at the bash path `/tmp/sp-full` =
-`C:\Users\systo\AppData\Local\Temp\sp-full`): `app.jar` (the runner jar), `fonts/*.ttf`, and this
-Dockerfile:
-```dockerfile
-FROM stirlingtools/stirling-pdf-base:1.0.2          # Java 25 + all tools
-WORKDIR /app
-COPY --chown=1000:1000 app.jar /app/app.jar
-COPY fonts/*.ttf /usr/share/fonts/truetype/
-RUN fc-cache -f \
-    && mkdir -p /storage \
-    && chown stirlingpdfuser:stirlingpdfgroup /storage /app \
-    && ln -sf /configs /app/configs && ln -sf /logs /app/logs \
-    && ln -sf /customFiles /app/customFiles && ln -sf /pipeline /app/pipeline \
-    && ln -sf /storage /app/storage \
-    && chown -h stirlingpdfuser:stirlingpdfgroup /app/configs /app/logs /app/customFiles /app/pipeline /app/storage
-ENV HOME=/home/stirlingpdfuser STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
-    TMPDIR=/tmp/stirling-pdf TEMP=/tmp/stirling-pdf TMP=/tmp/stirling-pdf \
-    SAL_TMP=/tmp/stirling-pdf/libre DBUS_SESSION_BUS_ADDRESS=/dev/null \
-    JAVA_OPTS="-XX:+UseG1GC -Djava.awt.headless=true" \
-    QUARKUS_HTTP_HOST=0.0.0.0 QUARKUS_HTTP_PORT=8080
-EXPOSE 8080/tcp
-STOPSIGNAL SIGTERM
-USER stirlingpdfuser
-ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
-```
-Stage + build + run:
-```bash
-# stage (bash /tmp resolves to %LOCALAPPDATA%\Temp)
-mkdir -p /tmp/sp-full/fonts
-cp app/core/build/stirling-pdf-2.12.0-runner.jar /tmp/sp-full/app.jar
-cp app/core/src/main/resources/static/fonts/*.ttf /tmp/sp-full/fonts/
-# (write the Dockerfile above to C:\Users\systo\AppData\Local\Temp\sp-full\Dockerfile)
-cd /tmp/sp-full && docker build -t stirling-pdf-quarkus:full .
-docker rm -f sp-e2e
-docker run -d --name sp-e2e -p 8080:8080 \
-  -e SECURITY_ENABLELOGIN=false -e METRICS_ENABLED=true \
-  -e SYSTEM_DEFAULTLOCALE=en-US -e SYSTEM_MAXFILESIZE=100 \
-  stirling-pdf-quarkus:full
-# wait for: curl localhost:8080/api/v1/info/status == 200
-```
-Base image was pulled with `docker pull stirlingtools/stirling-pdf-base:1.0.2`.
-
-### 3.4 Run the cucumber (behave) suite
-- Tests live in `testing/cucumber/` — Python **behave** (BDD), pure HTTP via `requests` (no browser).
-- **Target URL is hardcoded `http://localhost:8080`** in `features/steps/step_definitions.py`
-  (lines ~584/592/601) and `features/environment.py`. Easiest is to run the app on 8080.
-- `behave.ini` excludes `features/(enterprise|payg)` and tag `~@manual` by default.
-- `environment.py` probes `/api/v1/auth/login` (admin/stirling) at startup; if JWT/login is not
-  functional (login disabled / V2) it **skips** all `@jwt @login @me @refresh @token @mfa @apikey
-  @admin_settings @audit @signature @team @user_mgmt` scenarios → ~80 skips. That's expected.
-
-Install deps + run:
-```bash
-cd testing/cucumber
-pip install -r requirements.txt        # behave, requests, pypdf, reportlab, psycopg, pillow, ...
-TEST_CONTAINER_NAME=sp-e2e TEST_REPORT_DIR=/tmp python -m behave --no-capture --format progress2
-# single feature:  python -m behave features/general.feature
-# one scenario:    python -m behave features/general.feature:22 --format plain
-```
-The official CI driver is `testing/test.sh` (builds images via `docker/embedded/Dockerfile.*` and
-runs behave) — it will need the Dockerfile fixes from §6 before it works on Quarkus.
-
----
-
-## 4. Bugs FIXED this session (with the *why*, so you can spot siblings)
-
-### Session 2 (branch `claude/happy-chaplygin-906fe7`, fast-forwarded from `migration/run-01`)
-
-Newest first. These took the login-off suite **183 → 223** and then wired JWT so the **80 skipped
-JWT/admin scenarios run** (run 3, §9):
-
-1. **JWT Bearer → `SecurityIdentity` was never populated** → every user-scoped endpoint that reads
-   `SecurityIdentity.getPrincipal()` (folders, files, `/me`, user/team settings…) failed, and the
-   `environment.py` probe (`login → /me`) failed so ~80 scenarios auto-skipped. Added a custom
-   `HttpAuthenticationMechanism` + `IdentityProvider` in
-   `app/proprietary/.../security/identity/` (`JwtBearerAuthenticationMechanism`,
-   `JwtTokenIdentityProvider`): extract `Authorization: Bearer`, validate via the existing
-   `JwtService` (jjwt + keystore), build a `QuarkusSecurityIdentity` and map the `role` claim
-   (`ROLE_ADMIN` → also add `ADMIN` so `@RolesAllowed("ADMIN")` matches). Returns no identity when
-   no Bearer is present, so the X-API-KEY / login-off open-endpoint path is unaffected. **This is the
-   IdentityProvider that ~10 `// TODO: Migration required` comments across the security/storage code
-   asked for.** Run with `V2=true`.
-2. **No admin user was ever created** → all logins failed "No user found: admin". `InitialSecuritySetup`
-   was a Spring `@Component` (eagerly constructed, `@PostConstruct` ran every boot); the migration
-   made it a lazy `@ApplicationScoped` whose `@PostConstruct` never ran. Restored eager init via
-   `@Observes StartupEvent`. **Pattern: any migrated `@PostConstruct`-on-`@ApplicationScoped` startup
-   bean with no injector is dead code — grep for them.**
-3. **Eager init then exposed two latent bugs** (both real, both now fixed):
-   - `@Produces @ApplicationScoped DataSource` → Arc generated the client proxy in the JDK-sealed
-     `javax.sql` package → `NoClassDefFoundError` on first use. Fix: `@Singleton` (pseudo-scope, no
-     proxy). **Audit other `@Produces @ApplicationScoped` whose return type is a `java.*`/`javax.*`
-     type.**
-   - Panache `persist()` in the `StartupEvent` observer ran with no transaction (Spring Data wrapped
-     `save()` implicitly). Fix: `@Transactional` on the observer.
-4. **Login returned 500 instead of 401** for unknown user / bad password. `CustomUserDetailsService`
-   threw `IllegalArgumentException`, but `AuthController` catches the migration shim
-   `stirling.software.common.security.UsernameNotFoundException`. Made the service throw the shim
-   type. **Sibling: the locked-account path still throws `IllegalStateException` — wire it similarly
-   when needed.**
-5. **`@Transactional` missing on policy-store reads** (`JpaPolicyStore.all()`,
-   `findByTriggerType()`) → the scheduled folder-watch/schedule triggers threw
-   `ContextNotActiveException` off-request (§6.C). The reads are reached via the CDI proxy so a
-   method-level `@Transactional` applies even from the background virtual-thread executor.
-6. **Split scenarios sent a duplicate `fileInput` text part** (`| fileInput | fileInput |` in
-   `general.feature`) alongside the file part; Quarkus `@RestForm FileUpload` bound the *text* part
-   ("fileInput", 9 bytes) → "PDF corrupted". Spring ignored the stray part. Removed the redundant
-   rows (the file is already attached via the generate step). **Real clients send one part, so this
-   is a test artifact, not a server tolerance gap worth chasing.**
-7. **e2e Docker build is now first-class:** `docker/quarkus/Dockerfile` (+ `README.md`,
-   `build-and-run.sh`) layers the runner-jar on the base image, and `.dockerignore` re-includes
-   `app/core/build/*-runner.jar` (it was excluded by `**/build/`, so a clean `docker build` had been
-   silently relying on BuildKit cache).
-
-### Session 1
-
-1. **`MultipartFile.transferTo` didn't overwrite** (`a30d524ec`).
-   `app/common/.../model/MultipartFile.java` + `.../model/multipart/FileUploadMultipartFile.java`
-   used `Files.copy(in, dest)` without `REPLACE_EXISTING`. Callers do
-   `Files.createTempFile(...)` (creates the file) then `transferTo(thatPath)` → `FileAlreadyExistsException`.
-   Spring's `transferTo` overwrites. **Fixed** by adding `StandardCopyOption.REPLACE_EXISTING`.
-   Fixes the whole class of `/api/v1/misc/*` failures (scanner-effect, replace-invert, ocr,
-   update-metadata, unlock-pdf-forms, repair, extract-image-scans, add-page-numbers, …).
-
-2. **`maxDPI` defaulted to 0** (`a30d524ec`).
-   `ApplicationProperties.System.maxDPI` is a primitive `int` (→ 0 when not bound from settings).
-   Every DPI guard (`dpi > maxDPI`) then failed with *"maximum safe limit of 0"*. The
-   `settings.yml.template` default is 500. **Fixed** by `private int maxDPI = 500;`.
-   ⚠️ Root cause hint: this strongly suggests **settings.yml → ApplicationProperties config binding
-   is incomplete in the Quarkus migration**. Other primitive/unset fields may also be silently
-   wrong. Worth a dedicated audit (see §5).
-
-3. **Request-path `HttpServletRequest` → `UT000048` "No request is currently active"** (`860bd6e63`,
-   `4b572852c`). This was the dominant blocker. `quarkus-rest` (RESTEasy Reactive) runs handlers on
-   reactive/worker threads where the undertow servlet request context is NOT active, so ANY
-   `HttpServletRequest.getX()` throws. Fixed in:
-   - `GlobalExceptionHandler` (an `ExceptionMapper` that threw while handling *every* error, masking
-     the real cause) → `@Context UriInfo` + exception-safe `requestUri()`.
-   - `ControllerAuditAspect`, `AuditAspect` → route through the already-guarded
-     `AuditService.getCurrentRequest()` (returns null off-request) + a guarded `safeResponse()`.
-   - `AutoJobAspect`, `JobExecutorService` → inject `io.quarkus.vertx.http.runtime.CurrentVertxRequest`,
-     read query-param/method/path/attributes from the Vert.x request, degrade to null/no-op.
-   - `AuthController`, `UserController`, `ConfigController` → `@Context UriInfo` / `HttpHeaders` /
-     `io.vertx.core.http.HttpServerRequest`.
-   This unblocked the entire `@AutoJobPostMapping` chain (most PDF endpoints).
-
-4. **License singleton PK race** (`860bd6e63`). `UserLicenseSettings` has a manually-assigned
-   `@Id = 1L`. Spring Data `save()` on a non-new (pre-set-id) entity does a **MERGE (upsert)**; the
-   migration converted it to `persist()` (INSERT-only). The startup license sync raced the first
-   request, both inserted id=1 → `JdbcSQLIntegrityConstraintViolationException` → app crash. **Fixed**
-   in `UserLicenseSettingsService.getOrCreateSettings()` with a JVM lock +
-   `io.quarkus.narayana.jta.QuarkusTransaction.requiringNew()` create-once, then reload into the
-   caller's tx. **⚠️ This `save()`→`persist()`-should-be-`merge()` bug almost certainly exists for
-   OTHER manually-`@Id`'d entities — audit them (see §5).**
-
-5. **App couldn't boot without Redis** (`4665cceeb`).
-   - `quarkus.oidc.enabled=false` default (quarkus-oidc aborts startup without `auth-server-url`;
-     re-enable for an OAuth2 deployment).
-   - Valkey backplane beans eagerly injected the inactive `RedisDataSource`. Gated all 7 with
-     **build-time** `@io.quarkus.arc.properties.IfBuildProperty(name="cluster.backplane", stringValue="valkey")`
-     (NOT `@LookupIfProperty` — that leaves the bean in the build, so `RedisDataSource` still has a
-     consumer and Quarkus emits an eager startup observer that fails). Plus
-     `quarkus.redis.health.enabled=false`.
-
-6. **Runtime boot fixes** (`20b25ad76`): `quarkus.hibernate-orm.mapping.format.global=ignore` (JSON
-   columns), Quartz cron `0 0 0 * * MON` → `0 0 0 ? * MON` (Quartz rejects `*` in both day fields),
-   `@Scheduled(every="7d")` → `"P7D"`, `quarkus.arc.fail-on-intercepted-private-method=false`.
-
-7. **CDI augmentation** (`185ac88b3`): interceptor bindings made `@InterceptorBinding`
-   (`@EnterpriseEndpoint`, `@PremiumEndpoint`), a `tools.jackson.databind.ObjectMapper` producer
-   added in `AppConfig` (92 injection points), ambiguous beans resolved (`@DefaultBean`),
-   `Optional<X>`→`Instance<X>`, collection `List<X>`→`@All List<X>`, nested `SAML2` config producer.
-
-8. **Test layer** (`d51228af6`): a content-based exclude in root `build.gradle subprojects` skips any
-   test still importing `org.springframework`/`com.nimbusds` (self-maintaining), plus an explicit
-   list for tests asserting changed production signatures.
-
----
-
-## 5. Recurring patterns / gotchas (apply these everywhere)
-
-- **HttpServletRequest is poison on reactive threads.** ~35 main-source files still reference
-  `HttpServletRequest` (see §6 list). For each in the request path, replace with:
-  - path/URI → `@Context jakarta.ws.rs.core.UriInfo` (`uriInfo.getRequestUri().getPath()`), or in a
-    non-JAX-RS bean inject `io.quarkus.vertx.http.runtime.CurrentVertxRequest`
-    (`currentVertxRequest.getCurrent().request().path()`), guarded in try/catch returning null/"".
-  - headers → `@Context jakarta.ws.rs.core.HttpHeaders` (`getHeaderString(name)`).
-  - remote addr / method → `@Context io.vertx.core.http.HttpServerRequest`.
-  - request attributes (`get/setAttribute`) → Vert.x `RoutingContext.get/put` via `CurrentVertxRequest`.
-  - In services that already have a guarded accessor, reuse `AuditService.getCurrentRequest()`.
-- **Spring `save()` → Panache:** if the entity uses `@GeneratedValue` (new on insert) → `persist()`.
-  If the entity has a **manually-assigned `@Id`** (caller sets the id, "upsert" semantics) →
-  `getEntityManager().merge()` (NOT `persist()`), and consider concurrency.
-- **Config gating:** runtime selection that must REMOVE a bean (so its deps don't get wired) →
-  build-time `@IfBuildProperty`/`@UnlessBuildProperty`. `@LookupIfProperty` only disables *lookup*,
-  the bean and its injection points stay in the build.
-- **`quarkus.*` build-time props** (e.g. `quarkus.oidc.enabled`, `quarkus.hibernate-orm.*`,
-  `quarkus.arc.*`) can't be overridden by env at runtime — they require a rebuild.
-- **settings.yml binding is suspect** (see maxDPI). Audit `ApplicationProperties` for primitive
-  fields that need non-zero/template defaults, and verify the settings.yml → ApplicationProperties
-  binding path actually works in Quarkus (it was Spring `@ConfigurationProperties` + a custom YAML
-  property source — see the `YamlPropertySourceFactory` / `ConfigInitializer` TODOs).
-- **Augment gate:** `compileJava` passing ≠ working. `./gradlew :stirling-pdf:quarkusBuild` surfaces
-  CDI wiring errors; only *running* surfaces the `UT000048` / config / race bugs. Always run.
-- **Jackson 2 vs 3 coexist:** ~100 files use `tools.jackson` (Jackson 3, from Spring Boot 4); REST
-  (de)serialization uses Quarkus' Jackson 2. Don't "fix" `tools.jackson` imports — there's a producer.
-
----
-
-## 6. REMAINING WORK (prioritized)
-
-### A. Make the e2e Docker build first-class
-- [x] **DONE (Session 2):** `docker/quarkus/Dockerfile` (+ `README.md`, `build-and-run.sh`) committed,
-      uses the runner-jar, copies fonts; `.dockerignore` re-includes `app/core/build/*-runner.jar`.
-- [ ] Rewrite/replace `docker/embedded/Dockerfile`, `Dockerfile.fat`, `Dockerfile.ultra-lite` for
-      Quarkus: drop the Spring-Boot `-Djarmode=tools extract --layers` + `spring-boot-loader` layer
-      copies; either copy the uber `-runner.jar` to `/app/app.jar` or use the Quarkus fast-jar
-      (`quarkus-app/`) layout. The stage-1 `gradle clean build -PbuildWithFrontend=true` still builds
-      the frontend (fine).
-- [ ] Update `scripts/init.sh` / `init-without-ocr.sh` — they have Spring-loader fallbacks and AOT
-      machinery; the primary `java -jar /app.jar` path works for the uber-jar, but verify the AOT
-      cache + `restart-helper.jar` paths.
-- [ ] Then `testing/test.sh` (the official cucumber driver) should work end-to-end.
-
-### B. Real per-endpoint bugs surfaced by cucumber (login-off suite)
-Last measured failure buckets (before the transferTo/maxDPI fixes — re-run to refresh):
-- [ ] **`PdfCorruptedException` (~48)** on `convert/pdf/{word,vector,presentation,text,pdfa,...}`,
-      `convert/{html,cbz}/pdf`. Investigate `CustomPDFDocumentFactory` (PDF loading) — is it
-      misreporting valid PDFs as corrupted, or do these convert paths need LibreOffice/handling that
-      errors first and gets wrapped? Check one: `python -m behave features/convert_new.feature:NN --format plain`
-      then read `docker logs sp-e2e` for the real cause.
-- [ ] **`ClassCastException: String cannot be cast to ...` (~6)** — form/param binding type mismatch.
-      Likely a `@RestForm`/`@QueryParam` bound to the wrong type, or a Map/JSON form field. Check
-      `form/fill`, `form_advanced.feature`.
-- [ ] **Remaining `500`s** after A/B fixes — `misc/compress-pdf`, `general/split-pdf-by-chapters`,
-      `misc/add-image`, etc. Triage each via container logs.
-- [ ] **`400`s (~5)** — multipart `@RestForm` binding gaps. The migration left several request DTOs
-      with `MultipartFile`/POJO-list fields not bound to RESTEasy `FileUpload` (AI/workflow/sign DTOs
-      explicitly flagged). See `migration-report.md` "Representative deferred code".
-- [ ] **temp-file collisions other than transferTo** — also check `GeneralUtils.createTempFile`
-      (`app/common/.../util/GeneralUtils.java:79/85`) and any `Files.createFile`/`Files.copy`/
-      `Files.move` without `REPLACE_EXISTING`. `temp<rand>genericNonCustomisableName.pdf` and
-      `/tmp/stirling-pdf/stirling-pdf-<rand>.pdf` were two such names.
-
-### C. Background scheduled-task errors (log noise, not request-breaking)
-- [ ] `FolderWatchTrigger` (reconcile) and `ScheduleTrigger` (sweep) throw
-      `jakarta.enterprise.context.ContextNotActiveException` ("neither a transaction nor a CDI
-      request context is active") because they hit Panache/`PolicyRepository` off-request. Add
-      `@Transactional` (and/or `@ActivateRequestContext`) to those scheduled methods, or wrap the EM
-      access in `QuarkusTransaction.requiringNew()`. Files:
-      `app/proprietary/.../policy/trigger/FolderWatchTrigger.java`,
-      `.../policy/trigger/ScheduleTrigger.java`, `.../policy/store/JpaPolicyStore.java`.
-
-### D. The remaining ~35 `HttpServletRequest` files (apply §5 pattern as they surface)
-Not all are in the hot path; fix the ones that throw `UT000048` when their endpoints are exercised.
-Get the list any time with:
-```bash
-grep -rln "HttpServletRequest" app/core/src/main app/proprietary/src/main app/common/src/main --include=*.java
-```
-Known-fixed already: GlobalExceptionHandler, ControllerAuditAspect, AuditAspect, AutoJobAspect,
-JobExecutorService, AuthController, UserController, ConfigController. Everything else is unverified.
-High-risk: security filters (`UserAuthenticationFilter`, rate-limit filters, `JwtAuthenticationFilter`),
-anything reading headers/cookies/remote-addr per request.
-
-### E. Auth / JWT / login — DONE (Session 2)
-The whole Quarkus auth-identity layer is now in place (`app/proprietary/.../security/identity/`):
-- [x] **JWT Bearer** → `JwtBearerAuthenticationMechanism` + `JwtTokenIdentityProvider` (validate via
-      `JwtService`, map `role` claim). Run with `V2=true`.
-- [x] **X-API-KEY** → `ApiKeyAuthenticationMechanism` + `ApiKeyAuthenticationRequest` +
-      `ApiKeyIdentityProvider` (resolve via `userService.getUserByApiKey`). Lets `X-API-KEY` requests
-      authenticate (e.g. `/me`), and lets the suite run `SECURITY_ENABLELOGIN=true`.
-- [x] **User-as-principal** → `UserSecurityIdentityAugmentor` re-loads the `User` and sets it as the
-      `SecurityIdentity` principal; `User implements Principal`. This satisfies the ~7
-      `principal instanceof User` sites (folders, file storage, sessions, audit, UserController) — the
-      augmentor every `// TODO: Migration required` in security/storage asked for.
-- [x] **Config binding** → `ApplicationPropertiesConfigOverlay` overlays env/config onto
-      `ApplicationProperties` at startup (the Spring `@ConfigurationProperties` bind was never
-      migrated, so `SECURITY_ENABLELOGIN` / `SECURITY_CUSTOMGLOBALAPIKEY` / `STORAGE_ENABLED` were
-      ignored — root cause of the maxDPI/loginAttemptCount class too). **Currently a focused subset
-      (auth/storage/SSO toggles); a complete generic bind (all ~445 fields + settings.yml) is still
-      TODO.**
-- Validated on a login-ON probe (`SECURITY_ENABLELOGIN=true V2=true STORAGE_ENABLED=true
-  SECURITY_CUSTOMGLOBALAPIKEY=123456789`): open PDF endpoints (anon), JWT login+/me, X-API-KEY /me,
-  folder list/create all work. The 183 open endpoints stay open (no global `quarkus.http.auth.*`
-  policy), so login-ON does not regress them.
-
-### F. SAML / SSO — DONE (Session 2), both flows work end-to-end
-
-**Both `validate-oauth-test.sh` and `validate-saml-test.sh` pass, and both full login flows were
-verified end-to-end against the Keycloak compose** (login -> IdP -> callback/ACS -> auto-created
-user -> app JWT cookie -> `/me` 200). Run with `PREMIUM_KEY=<your enterprise license key>`. Tag the Quarkus image as
-`docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest` so the compose uses it (or repoint the
-`image:`); `start-saml-test.sh` generates the SP certs + fetches Keycloak's cert.
-
-- **OAuth2 / OIDC** (`security/oauth2/`): `OAuth2LoginController` (JAX-RS) serves
-  `/oauth2/authorization/{id}` -> IdP authorize redirect; `OAuth2CallbackServlet` (`@WebServlet
-  /login/oauth2/code/*`) does the code exchange + userinfo + auto-create + JWT cookie. **Why a
-  servlet for the callback:** quarkus-undertow's default servlet owns the `/login/*` prefix and
-  query-strips/intercepts the extension-less callback before RESTEasy sees it; a registered
-  `@WebServlet` takes precedence. (Same reason the SAML SP endpoints are servlets.)
-- **SAML2** (`security/saml2/`): `Saml2Service` (OpenSAML 5) initialises the library, loads SP
-  key/cert + IdP cert, builds SP metadata, builds+signs the redirect-binding AuthnRequest, and
-  validates the SAMLResponse signature (`SAMLSignatureProfileValidator` + `SignatureValidator`
-  against the IdP cert). `SamlMetadataServlet` -> `/saml2/service-provider-metadata/{id}`;
-  `SamlSpServlet` -> `/saml2/authenticate/{id}` (login init) + `/login/saml2/sso/{id}` (ACS).
-  **Gotcha:** the SP entityId must equal the SP-metadata URL (`{backendUrl}/saml2/service-provider-
-  metadata/{id}`), which is what Keycloak's SAML client is keyed on - NOT the bare
-  `SECURITY_SAML2_SP_ENTITYID` host (`SamlConfig` derives it). Keycloak's realm has
-  `saml.client.signature=false` (AuthnRequest signature optional) + `saml.server.signature=true`
-  (so the ACS validates the response against Keycloak's cert).
-- Both flows finish by issuing the app JWT as the `stirling_jwt` cookie, which
-  `JwtBearerAuthenticationMechanism` now also reads (not just the `Authorization` header) -> feeds
-  the `UserSecurityIdentityAugmentor` (principal = User).
-- Follow-ups: logout/SLO endpoints; encrypted-assertion handling; the `mcp` Keycloak compose;
-  desktop/Tauri RelayState (`TauriSamlUtils` preserved). Multi-provider (google/github) OAuth uses
-  the same pattern keyed by registrationId.
-
-### F-old. (superseded) original SAML/SSO scoping
-The `validate-*-test.sh` scripts are **endpoint-existence
-checks** (Keycloak up + Stirling serves the SSO endpoint), not full browser logins.
-
-Prereqs for any run: the compose files use `image: docker.stirlingpdf.com/.../stirling-pdf:latest`
-(the published Spring image) — **repoint to `stirling-pdf-quarkus:jwt`** (or wire
-`docker/quarkus/Dockerfile`). The SAML compose mounts `saml-private-key.key`/`saml-public-cert.crt`/
-`keycloak-saml-cert.pem` which **do not exist in the repo** — generate them (the SP signing
-key/cert; `start-saml-test.sh` may do this). SAML/OAuth need the **Enterprise license** env.
-
-**OAuth2 / OIDC** (more tractable — Quarkus has `quarkus-oidc`):
-- [ ] Extend `ApplicationPropertiesConfigOverlay` for `security.oauth2.*` (client issuer/clientId/
-      clientSecret/scopes/useAsUsername) — currently only the `enabled` toggle is bound.
-- [ ] Serve `GET /oauth2/authorization/{registrationId}` → 302 to the IdP authorize URL (login
-      initiation; the OAuth `validate` script checks this responds). Build from issuer + clientId +
-      redirect-uri `/login/oauth2/code/{registrationId}`.
-- [ ] Serve the callback `GET /login/oauth2/code/{registrationId}` → exchange code (REST Client to
-      the token endpoint), fetch userinfo, auto-create/login the user (reuse `CustomOAuth2UserService`
-      logic), issue the app JWT via `JwtService`. `quarkus.oidc.enabled` is **build-time** and aborts
-      startup with no `auth-server-url`, so either hand-roll the flow (simplest, no build-time gate)
-      or enable oidc with a runtime-disabled default tenant.
-
-**SAML2** (larger — no Quarkus SAML extension; OpenSAML 5 from scratch):
-- [ ] `Saml2Configuration` already loads the SP/IdP certs and computes entityId/ACS/SLO URLs and
-      customizes the AuthnRequest (all preserved). Build on it:
-  - [ ] `GET /saml2/service-provider-metadata/{registrationId}` → SP `EntityDescriptor` XML
-        (ACS=`/login/saml2/sso/{id}`, SP signing cert) marshalled via OpenSAML 5. (The SAML `validate`
-        script checks this.)
-  - [ ] login initiation → build+sign an `AuthnRequest` (use `customizeAuthnRequest`) and
-        redirect/POST to `samlConf.getIdpSingleLoginUrl()`.
-  - [ ] `POST /login/saml2/sso/{registrationId}` (ACS) → validate the SAML response/assertion against
-        the IdP cert, extract the NameID/attributes, auto-create/login the user, issue the app JWT.
-  - Host these as Jakarta `@WebServlet` (quarkus-undertow) or JAX-RS resources; gate on
-        `security.saml2.enabled`.
-- [ ] Both flows then feed the existing `UserSecurityIdentityAugmentor` (principal=User) once they
-      establish the session/JWT.
-
-### G. `saas` flavor full augmentation (optional, non-default)
-- [ ] `STIRLING_FLAVOR=saas ./gradlew :stirling-pdf:quarkusBuild` → ~28 Arc deployment problems
-      (Supabase second datasource via `quarkus.datasource."supabase".*`, `SecurityFilterChain`/
-      `JwtDecoder` → `quarkus.http.auth.*`+OIDC, credit `HandlerInterceptor`/`@RestControllerAdvice`
-      → JAX-RS `@Provider`/`ExceptionMapper`, `@ConfigurationProperties` → `@ConfigMapping`,
-      RestTemplate → REST Client). ~90 `// TODO: Migration required` across 34 saas files.
-
-### H. Test suite (unit/integration) re-enablement
-- [ ] ~180 test files are excluded from compilation (content filter on `org.springframework`/
-      `com.nimbusds` imports + an explicit list in `build.gradle`). Port them to `@QuarkusTest`
-      incrementally; as a file's Spring imports go away it auto-re-enters the build.
-
-### I. Loose ends
-- [ ] `/q/openapi` returns 500 (`UT000048`) — known quarkus-undertow + smallrye-openapi interaction;
-      swagger-ui works, live API works. Affects API-doc tooling only.
-- [ ] Jackson 2/3 convergence (drop `tools.jackson`).
-- [ ] ~437 `// TODO: Migration required` markers across the codebase document every deferred decision;
-      `grep -rn "TODO: Migration required" app/*/src/main` to enumerate.
-
----
-
-## 7. Quick reference — env vars used in e2e
-
-| Var | Value | Why |
-|-----|-------|-----|
-| `SECURITY_ENABLELOGIN` | `false` | run without auth (most API tests); set `true` for the JWT suite |
-| `METRICS_ENABLED` | `true` | enables `/api/v1/info/*` (info.feature) |
-| `SYSTEM_DEFAULTLOCALE` | `en-US` | matches default-language change |
-| `SYSTEM_MAXFILESIZE` | `100` | upload limit for tests |
-| `QUARKUS_HTTP_PORT` | `8080` | cucumber steps hardcode 8080 |
-| `QUARKUS_DATASOURCE_JDBC_URL` | `jdbc:h2:mem:...` | use a fresh in-mem DB for clean runs (avoids stale H2 file lock) |
-
-Default datasource (in `application.properties`) is **H2 file** at
-`./configs/stirling-pdf-DB-2.3.232` — fine in a container; for repeated host runs override to
-`jdbc:h2:mem:...` to dodge the file lock (`Database may be already in use`).
-
----
-
-## 8. Useful diagnostic one-liners
-
-```bash
-# container alive + real error (strip ANSI, drop known background noise)
-docker logs sp-e2e 2>&1 | sed 's/\x1b\[[0-9;]*m//g' \
-  | grep -iE "ERROR|Caused by|Exception" \
-  | grep -viE "Log4j|LogManager|ForkJoinPool|FolderWatch|ScheduleTrigger|policy-" | tail -30
-
-# categorize cucumber failures
-cd testing/cucumber && TEST_CONTAINER_NAME=sp-e2e python -m behave --no-capture --format plain --no-skipped > /tmp/behave.txt 2>&1
-grep -oE "Expected status code [0-9]+ but got [0-9]+" /tmp/behave.txt | sort | uniq -c | sort -rn
-grep -oE "features/[a-z_]+\.feature" /tmp/behave.txt | sort | uniq -c | sort -rn   # rough; use a junit reporter for precise
-
-# what still touches the servlet request
-grep -rln "HttpServletRequest" app/*/src/main --include=*.java
-
-# enumerate deferred work
-grep -rn "TODO: Migration required" app/*/src/main --include=*.java | wc -l
-```
-
----
-
-## 9. Measured cucumber results — newest first
-
-**Run 5 — LOGIN ON (`SECURITY_ENABLELOGIN=true V2=true STORAGE_ENABLED=true
-SECURITY_CUSTOMGLOBALAPIKEY=123456789`):**
-```
-18 features passed, 7 failed, 0 skipped
-304 scenarios passed, 34 failed, 0 skipped     <-- folders + user-scoped features now pass
-```
-X-API-KEY mechanism + User-principal augmentor + config overlay made login-ON work without
-regressing the open endpoints (0 folder failures). Trajectory: **183 → 223 → 272 → 291 → 304**.
-
-**Run 4 — login off + lockout fix:** `291 passed, 47 failed, 0 skipped`.
-
-**Run 3 — login off + `V2=true` + JWT Bearer mechanism (Session 2):**
-```
-17 features passed, 8 failed, 0 skipped
-272 scenarios passed, 66 failed, 0 skipped     <-- 0 skipped: all JWT/admin scenarios now run
-```
-The JWT mechanism unskipped all 80 and added +49 passing over run 2 with no regressions. Remaining
-66 failures, biggest buckets:
-- **~38 = login-lockout cascade (FIXED, pending re-measure).** `loginAttemptCount` defaulted to 0
-  (template = 5) → admin locked after one failed-login test → every later admin scenario blocked
-  ("Admin login failed" 21×, "Folder list returned" 17×). Fixed the primitive default (same as
-  maxDPI). **Re-run to confirm; expect ~300+.**
-- 10×(200→403) feature-gated/disabled (mostly not bugs).
-- 5×(200→401) + 2×(401→403) — auth scenarios asserting specific codes; triage individually.
-- 3×(200→500) — real per-endpoint bugs (e.g. `user/get-api-key`). Triage via container logs.
-
-**Run 2 — login off, Session 2 fixes, no JWT mechanism:**
-```
-16 features passed, 5 failed, 4 skipped
-223 scenarios passed, 35 failed, 80 skipped
-```
-
-**Run 1 — original baseline (login off):**
-```
-183 scenarios passed, 75 failed, 80 skipped
-```
-
-Trajectory this session: **183 → 223 (boot/login/test fixes) → 272 (JWT mechanism), 0 skipped.**

Taskfile.yml

@@ -78,6 +78,80 @@ tasks:
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
 
+  dev:portal:
+    desc: "Start backend + developer portal concurrently on free ports"
+    vars:
+      PORTS:
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
+      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
+      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 1}}'
+    deps:
+      - task: backend:dev
+        vars:
+          PORT: '{{.BACKEND_PORT}}'
+          SECURITY_ENABLELOGIN: "true"
+      - task: frontend:dev:portal
+        vars:
+          PORT: '{{.PORTAL_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+          OPEN: "true"
+
+  dev:portal:all:
+    desc: "Start backend + developer portal + editor concurrently on free ports"
+    vars:
+      PORTS:
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5174{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5174{{end}}'
+      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
+      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 1}}'
+      EDITOR_PORT: '{{index (splitList "\n" .PORTS) 2}}'
+    deps:
+      - task: backend:dev
+        vars:
+          PORT: '{{.BACKEND_PORT}}'
+          SECURITY_ENABLELOGIN: "true"
+      - task: frontend:dev:portal
+        vars:
+          PORT: '{{.PORTAL_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+          # Point the portal's "Editor" app switcher at the editor we spawn here.
+          EDITOR_URL: 'http://localhost:{{.EDITOR_PORT}}/'
+          OPEN: "true"
+      - task: frontend:dev
+        vars:
+          PORT: '{{.EDITOR_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+
+  dev:portal:proxy:
+    desc: "Editor + portal on ONE origin + backend via live dev servers (shared-token login)"
+    vars:
+      PORTS:
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 3000 5173 5174{{else}}{{.FIND_FREE_PORT_SH}} 8080 3000 5173 5174{{end}}'
+      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
+      PROXY_PORT: '{{index (splitList "\n" .PORTS) 1}}'
+      EDITOR_PORT: '{{index (splitList "\n" .PORTS) 2}}'
+      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 3}}'
+    deps:
+      - task: backend:dev
+        vars:
+          PORT: '{{.BACKEND_PORT}}'
+          SECURITY_ENABLELOGIN: "true"
+      - task: frontend:dev:proprietary
+        vars:
+          PORT: '{{.EDITOR_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+      - task: frontend:dev:portal
+        vars:
+          PORT: '{{.PORTAL_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+          SUBPATH: portal
+          MOCKS: 'false'
+      - task: frontend:dev:portal:proxy:serve
+        vars:
+          PORT: '{{.PROXY_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+          EDITOR_DEV_URL: 'http://localhost:{{.EDITOR_PORT}}'
+          PORTAL_DEV_URL: 'http://localhost:{{.PORTAL_PORT}}'
+
   dev:saas:
     desc: "Start SaaS backend + frontend concurrently on free ports"
     cmds:
@@ -124,6 +198,23 @@ tasks:
       - task: backend:build
       - task: frontend:build
 
+  preview:portal:proxy:
+    desc: "Build + serve editor + portal on ONE origin + backend (prod-like auth test)"
+    vars:
+      PORTS:
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 3000{{else}}{{.FIND_FREE_PORT_SH}} 8080 3000{{end}}'
+      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
+      PROXY_PORT: '{{index (splitList "\n" .PORTS) 1}}'
+    deps:
+      - task: backend:dev
+        vars:
+          PORT: '{{.BACKEND_PORT}}'
+          SECURITY_ENABLELOGIN: "true"
+      - task: frontend:preview:portal:proxy
+        vars:
+          PORT: '{{.PROXY_PORT}}'
+          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
+
   # ============================================================
   # Test
   # ============================================================

app/allowed-licenses.json

@@ -1,9 +1,5 @@
 {
   "allowedLicenses": [
-    {
-      "moduleName": "org.jboss:jboss-transaction-spi",
-      "moduleLicense": "Public Domain"
-    },
     {
       "moduleName": ".*",
       "moduleLicense": "BSD License"

app/common/build.gradle

@@ -1,4 +1,7 @@
-// REMOVED: bootRun{enabled=false} - Spring Boot plugin task. :common is a Quarkus library module.
+// Configure bootRun to disable it or point to a main class
+bootRun {
+    enabled = false
+}
 spotless {
     java {
         target 'src/**/java/**/*.java'
@@ -27,29 +30,8 @@ spotless {
 }
 dependencies {
     api 'com.google.guava:guava:33.6.0-jre'
-
-    // spring-boot-starter-webmvc -> Quarkus REST stack (api-scoped so downstream modules inherit it).
-    api 'io.quarkus:quarkus-rest'
-    api 'io.quarkus:quarkus-rest-jackson'
-    // Servlet bridge: large amounts of controller/filter code use jakarta.servlet (HttpServletRequest,
-    // Filter, etc.). quarkus-undertow provides a servlet container on Quarkus so that API resolves and
-    // runs. TODO: Migration required - longer term, port servlet usage to JAX-RS (ContainerRequestContext)
-    //       and drop quarkus-undertow.
-    api 'io.quarkus:quarkus-undertow'
-    // Bean Validation (was transitively in spring-boot-starter-webmvc).
-    api 'io.quarkus:quarkus-hibernate-validator'
-    // @Scheduled support (was spring-context scheduling). quarkus-scheduler manages its own
-    // executor; the former SchedulingConfig TaskScheduler bean is no longer needed.
-    api 'io.quarkus:quarkus-scheduler'
-    // BCrypt implementation backing the Spring Security PasswordEncoder compatibility shim
-    // (replaces spring-security-crypto's BCryptPasswordEncoder). Standalone, no framework.
-    api 'at.favre.lib:bcrypt:0.10.2'
-    // Swagger/OpenAPI annotations (io.swagger.v3.oas.annotations.*) used by common's API marker
-    // interfaces; was transitive via springdoc. Quarkus' SmallRye OpenAPI also understands these.
-    api 'io.swagger.core.v3:swagger-core-jakarta:2.2.46'
-    // REMOVED: spring-boot-starter-aspectj. Quarkus has no AspectJ weaving; quarkus-arc provides
-    // CDI interceptors (@AroundInvoke / interceptor bindings) instead.
-    // TODO: Migration required - any @Aspect/@Around advice must be rewritten as CDI interceptors.
+    api 'org.springframework.boot:spring-boot-starter-webmvc'
+    api 'org.springframework.boot:spring-boot-starter-aspectj'
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
@@ -63,8 +45,7 @@ dependencies {
     api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    // springdoc-openapi-starter-webmvc-ui -> SmallRye OpenAPI (schema at /q/openapi, UI at /q/swagger-ui)
-    api 'io.quarkus:quarkus-smallrye-openapi'
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
     api 'org.simplejavamail:simple-java-mail:8.12.6'
     api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -97,14 +78,6 @@ dependencies {
         runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
     }
 
-    // Jackson 3 (tools.jackson) - retained because ~100 files migrated to the Jackson 3 namespace
-    // under Spring Boot 4. Quarkus integrates Jackson 2 for REST bodies; Jackson 3 coexists here as a
-    // plain library so those files compile and can still build/parse JSON directly.
-    // api-scoped so downstream modules (core, proprietary, saas) that import tools.jackson inherit it.
-    // TODO: Migration required - converge the codebase on a single Jackson major version.
-    api 'tools.jackson.core:jackson-databind:3.0.0'
-    api 'tools.jackson.core:jackson-core:3.0.0'
-
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)
     implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0'
 

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -6,16 +6,15 @@ import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
 
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 
-@ApplicationScoped
+@Service
 @Slf4j
 public class EndpointConfiguration {
 
@@ -53,10 +52,9 @@ public class EndpointConfiguration {
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
-    @Inject
     public EndpointConfiguration(
             ApplicationProperties applicationProperties,
-            @Named("runningProOrHigher") boolean runningProOrHigher) {
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
         this.applicationProperties = applicationProperties;
         this.runningProOrHigher = runningProOrHigher;
         init();

app/common/src/main/java/stirling/software/SPDF/pdf/parser/TabulaTableParser.java

@@ -9,8 +9,7 @@ import java.util.Collections;
 import java.util.List;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.stereotype.Service;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -48,7 +47,7 @@ import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
  *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
  * </ul>
  */
-@ApplicationScoped
+@Service
 @Slf4j
 public class TabulaTableParser implements TableParser {
 

app/common/src/main/java/stirling/software/common/annotations/AutoJobPostMapping.java

@@ -2,27 +2,21 @@ package stirling.software.common.annotations;
 
 import java.lang.annotation.*;
 
-import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import org.springframework.core.annotation.AliasFor;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 
-import jakarta.enterprise.util.Nonbinding;
-import jakarta.interceptor.InterceptorBinding;
-import jakarta.ws.rs.core.MediaType;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
 
 /**
  * Shortcut for a POST endpoint that is executed through the Stirling "auto‑job" framework.
  *
- * <p>MIGRATION (Spring -> Quarkus): this was a Spring composed meta-annotation that stamped
- * {@code @RequestMapping(method=POST)} onto the target via {@code @AliasFor}. JAX-RS does not
- * honour {@code @Path}/{@code @POST}/{@code @Consumes} through meta-annotations, so this annotation
- * no longer provides routing. It is now a CDI {@link InterceptorBinding} handled by {@code
- * AutoJobInterceptor}. <b>Controllers using {@code @AutoJobPostMapping} must additionally declare
- * their own JAX-RS {@code @POST} + {@code @Path(value)} + {@code @Consumes(consumes)}.</b> The
- * {@link #value()}/{@link #consumes()} members are retained so a scanner/controller can read the
- * intended routing.
- *
  * <p>Behaviour notes:
  *
  * <ul>
+ *   <li>The endpoint is registered with {@code POST} and, by default, consumes {@code
+ *       multipart/form-data} unless you override {@link #consumes()}.
  *   <li>When the client supplies {@code ?async=true} the call is handed to {@link
  *       stirling.software.common.service.JobExecutorService JobExecutorService} where it may be
  *       queued, retried, tracked and subject to time‑outs. For synchronous (default) invocations
@@ -32,26 +26,22 @@ import jakarta.ws.rs.core.MediaType;
  *       GET /api/v1/general/job/{id}</code>.
  * </ul>
  *
- * <p>Unless stated otherwise an attribute only affects <em>async</em> execution. All members are
- * {@code @Nonbinding} so the single {@code AutoJobInterceptor} matches every annotated method; the
- * interceptor reads the actual values reflectively from the target method.
+ * <p>Unless stated otherwise an attribute only affects <em>async</em> execution.
  */
-@Target({ElementType.METHOD, ElementType.TYPE})
+@Target(ElementType.METHOD)
 @Retention(RetentionPolicy.RUNTIME)
 @Documented
-@InterceptorBinding
+@RequestMapping(method = RequestMethod.POST)
 @RequestBody(required = true)
 public @interface AutoJobPostMapping {
 
-    /**
-     * The path mapping of the endpoint (controllers must mirror this on a JAX-RS {@code @Path}).
-     */
-    @Nonbinding
+    /** Alias for {@link RequestMapping#value} – the path mapping of the endpoint. */
+    @AliasFor(annotation = RequestMapping.class, attribute = "value")
     String[] value() default {};
 
     /** MIME types this endpoint accepts. Defaults to {@code multipart/form-data}. */
-    @Nonbinding
-    String[] consumes() default {MediaType.MULTIPART_FORM_DATA};
+    @AliasFor(annotation = RequestMapping.class, attribute = "consumes")
+    String[] consumes() default {MediaType.MULTIPART_FORM_DATA_VALUE};
 
     /**
      * Maximum execution time in milliseconds before the job is aborted. A negative value means "use
@@ -59,7 +49,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     long timeout() default -1;
 
     /**
@@ -68,7 +57,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     int retryCount() default 1;
 
     /**
@@ -76,7 +64,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     boolean trackProgress() default true;
 
     /**
@@ -85,7 +72,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     boolean queueable() default false;
 
     /**
@@ -96,6 +82,5 @@ public @interface AutoJobPostMapping {
      * AutoJobPostMappingWeightTest} fails the build if any endpoint leaves it unset. Runtime
      * readers clamp the value into {@code [1, 100]}.
      */
-    @Nonbinding
     int resourceWeight() default Integer.MIN_VALUE;
 }

app/common/src/main/java/stirling/software/common/annotations/api/AccountSecurityApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/account").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/account")
 @Tag(
         name = "Account Security",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/AdminApi.java

@@ -5,20 +5,19 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
  * Combined annotation for Admin Settings API controllers.
- *
- * <p>MIGRATION (Spring -> JAX-RS): JAX-RS/RESTEasy does NOT process {@code @Path} via custom
- * meta-annotations (Spring honoured composed {@code @RestController}/{@code @RequestMapping}
- * through {@code @AliasFor}; JAX-RS has no equivalent). This annotation therefore now carries only
- * the OpenAPI {@code @Tag}. Each controller annotated with {@code @AdminApi} MUST additionally
- * declare its own {@code @jakarta.ws.rs.Path("/api/v1/admin/settings")} (the path the removed
- * {@code @RequestMapping} used to supply).
+ * Includes @RestController, @RequestMapping("/api/v1/admin/settings"), and OpenAPI @Tag.
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
+@RestController
+@RequestMapping("/api/v1/admin/settings")
 @Tag(
         name = "Admin Settings",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/AdminServerCertificateApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/admin/server-certificate").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/admin/server-certificate")
 @Tag(
         name = "Admin - Server Certificate",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/analysis").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/analysis")
 @Tag(
         name = "Analysis",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/ConfigApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/config").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/config")
 @Tag(
         name = "Config",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/convert").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/convert")
 @Tag(
         name = "Convert",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/DatabaseApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/database").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/database")
 @Tag(
         name = "Database",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/DatabaseManagementApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/admin/database").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/admin/database")
 @Tag(
         name = "Database Management",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/filter").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/filter")
 @Tag(
         name = "Filter",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/general").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/general")
 @Tag(
         name = "General",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/InfoApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/info").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/info")
 @Tag(
         name = "Info",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/invite").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/invite")
 @Tag(
         name = "Invite",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/misc").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/misc")
 @Tag(
         name = "Misc",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/pipeline").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/pipeline")
 @Tag(
         name = "Pipeline",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/ProprietaryUiDataApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -14,9 +17,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/proprietary/ui-data").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/proprietary/ui-data")
 @Tag(
         name = "Proprietary UI Data",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/security").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/security")
 @Tag(
         name = "Security",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/SettingsApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/settings").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/settings")
 @Tag(
         name = "Settings",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/TeamApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/team").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/team")
 @Tag(
         name = "Team",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/UiDataApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/ui-data").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/ui-data")
 @Tag(
         name = "UI Data",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/UserApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/user").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/user")
 @Tag(
         name = "User",
         description =

app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java

@@ -7,101 +7,46 @@ import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.*;
 import org.slf4j.MDC;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.multipart.MultipartFile;
 
-import io.quarkus.vertx.http.runtime.CurrentVertxRequest;
-
-import jakarta.annotation.Priority;
-import jakarta.inject.Inject;
-import jakarta.interceptor.AroundInvoke;
-import jakarta.interceptor.Interceptor;
-import jakarta.interceptor.InvocationContext;
+import jakarta.servlet.http.HttpServletRequest;
 
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.model.MultipartFile;
 import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.FileStorage;
 import stirling.software.common.service.JobExecutorService;
 
-/**
- * MIGRATION (Spring AOP -> CDI interceptor): was an {@code @Aspect} with {@code @Around} advice on
- * {@code @AutoJobPostMapping}. Reworked into a CDI {@link Interceptor} bound by the
- * {@code @AutoJobPostMapping} {@code @InterceptorBinding}; {@code @Around}/{@code
- * ProceedingJoinPoint} became {@code @AroundInvoke}/{@link InvocationContext}.
- * {@code @Priority(20)} now meaningfully orders this interceptor (runs after lower-priority audit
- * interceptors populate MDC).
- */
-@Interceptor
-@AutoJobPostMapping
-@Priority(20)
+@Aspect
+@Component
+@RequiredArgsConstructor
 @Slf4j
+@Order(20) // Lower precedence - executes AFTER audit aspects populate MDC
 public class AutoJobAspect {
 
     private static final Duration RETRY_BASE_DELAY = Duration.ofMillis(100);
 
     private final JobExecutorService jobExecutorService;
-    // Reactive-safe access to the current request. The undertow HttpServletRequest proxy throws
-    // UT000048 ("No request is currently active") on RESTEasy Reactive worker threads, so query
-    // params / method / path / attributes are read from the Vert.x request instead, degrading to
-    // null/empty when no request is active.
-    private final CurrentVertxRequest currentVertxRequest;
+    private final HttpServletRequest request;
     private final FileStorage fileStorage;
 
-    @Inject
-    public AutoJobAspect(
-            JobExecutorService jobExecutorService,
-            CurrentVertxRequest currentVertxRequest,
-            FileStorage fileStorage) {
-        this.jobExecutorService = jobExecutorService;
-        this.currentVertxRequest = currentVertxRequest;
-        this.fileStorage = fileStorage;
-    }
-
-    private io.vertx.core.http.HttpServerRequest vertxRequest() {
-        try {
-            var current = currentVertxRequest.getCurrent();
-            return current != null ? current.request() : null;
-        } catch (RuntimeException e) {
-            return null;
-        }
-    }
-
-    private String requestParam(String name) {
-        io.vertx.core.http.HttpServerRequest req = vertxRequest();
-        return req != null ? req.getParam(name) : null;
-    }
-
-    private String requestMethod() {
-        io.vertx.core.http.HttpServerRequest req = vertxRequest();
-        return req != null ? req.method().name() : "";
-    }
-
-    private String requestUri() {
-        io.vertx.core.http.HttpServerRequest req = vertxRequest();
-        return req != null ? req.path() : "";
-    }
-
-    private Object requestAttribute(String name) {
-        try {
-            var current = currentVertxRequest.getCurrent();
-            return current != null ? current.get(name) : null;
-        } catch (RuntimeException e) {
-            return null;
-        }
-    }
-
-    @AroundInvoke
-    public Object wrapWithJobExecution(InvocationContext ctx) throws Exception {
-        AutoJobPostMapping autoJobPostMapping =
-                ctx.getMethod().getAnnotation(AutoJobPostMapping.class);
+    @Around("@annotation(autoJobPostMapping)")
+    public Object wrapWithJobExecution(
+            ProceedingJoinPoint joinPoint, AutoJobPostMapping autoJobPostMapping) throws Exception {
+        // This aspect will run before any audit aspects due to @Order(0)
         // Extract parameters from the request and annotation
-        boolean async = Boolean.parseBoolean(requestParam("async"));
+        boolean async = Boolean.parseBoolean(request.getParameter("async"));
         log.debug(
                 "AutoJobAspect: Processing {} {} with async={}",
-                requestMethod(),
-                requestUri(),
+                request.getMethod(),
+                request.getRequestURI(),
                 async);
         long timeout = autoJobPostMapping.timeout();
         int retryCount = autoJobPostMapping.retryCount();
@@ -116,8 +61,7 @@ public class AutoJobAspect {
                 trackProgress);
 
         // Process arguments in-place to avoid type mismatch issues
-        Object[] args = processArgsInPlace(ctx.getParameters(), async);
-        ctx.setParameters(args);
+        Object[] args = processArgsInPlace(joinPoint.getArgs(), async);
 
         // Extract queueable and resourceWeight parameters and validate
         boolean queueable = autoJobPostMapping.queueable();
@@ -136,7 +80,7 @@ public class AutoJobAspect {
                                     // The trackProgress flag controls whether detailed progress is
                                     // stored
                                     // for REST API queries, not WebSocket notifications
-                                    return ctx.proceed();
+                                    return joinPoint.proceed(args);
                                 } catch (Throwable ex) {
                                     log.error(
                                             "AutoJobAspect caught exception during job execution: {}",
@@ -157,7 +101,7 @@ public class AutoJobAspect {
         } else {
             // Use retry logic
             return executeWithRetries(
-                    ctx,
+                    joinPoint,
                     args,
                     async,
                     timeout,
@@ -169,7 +113,7 @@ public class AutoJobAspect {
     }
 
     private Object executeWithRetries(
-            InvocationContext ctx,
+            ProceedingJoinPoint joinPoint,
             Object[] args,
             boolean async,
             long timeout,
@@ -214,7 +158,7 @@ public class AutoJobAspect {
                                     }
 
                                     // Attempt to execute the operation
-                                    return ctx.proceed();
+                                    return joinPoint.proceed(args);
 
                                 } catch (Throwable ex) {
                                     lastException = ex;
@@ -348,7 +292,7 @@ public class AutoJobAspect {
 
     private String getJobIdFromContext() {
         try {
-            return (String) requestAttribute("jobId");
+            return (String) request.getAttribute("jobId");
         } catch (Exception e) {
             log.debug("Could not retrieve job ID from context: {}", e.getMessage());
             return null;

app/common/src/main/java/stirling/software/common/cluster/ClusterConfig.java

@@ -1,7 +1,8 @@
 package stirling.software.common.cluster;
 
+import org.springframework.context.annotation.Configuration;
+
 import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -18,7 +19,7 @@ import stirling.software.common.model.ApplicationProperties.Cluster;
  * single-instance install needs no new config.
  */
 @Slf4j
-@ApplicationScoped
+@Configuration
 @RequiredArgsConstructor
 public class ClusterConfig {
 
@@ -46,7 +47,7 @@ public class ClusterConfig {
                             + " JVM is coordinated. Cross-node lookups and the file proxy will fail."
                             + " Use backplane=valkey for real multi-node deployments.");
         } else {
-            // Fail fast on typos like "valky" so CDI doesn't later report a cryptic
+            // Fail fast on typos like "valky" so Spring doesn't later report a cryptic
             // "no ClusterBackplane bean" - the operator-facing error names the bad value.
             throw new IllegalStateException(
                     "cluster.enabled=true with unknown backplane '"

app/common/src/main/java/stirling/software/common/cluster/inprocess/InProcessClusterConfiguration.java

@@ -1,9 +1,9 @@
 package stirling.software.common.cluster.inprocess;
 
-import io.quarkus.arc.DefaultBean;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Produces;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -19,58 +19,46 @@ import stirling.software.common.model.ApplicationProperties;
  * Default cluster backplane wiring: every interface gets an {@code InProcess*} bean. Active when
  * cluster mode is off or {@code cluster.backplane=inprocess}.
  */
-// TODO: Migration required - the original @ConditionalOnExpression
-// ("!${cluster.enabled:false} || '${cluster.backplane:inprocess}'.equalsIgnoreCase('inprocess')")
-// gated activation of this whole configuration on a SpEL expression over two config properties.
-// Quarkus/CDI has no direct equivalent for conditionally registering a producer set based on a
-// SpEL boolean. The @DefaultBean producers below now always provide the in-process implementations
-// unless another bean of the same type is present. If a non-inprocess backplane is added, ensure
-// it is NOT a @DefaultBean so it wins, and consider gating with
-// @io.quarkus.arc.lookup.LookupIfProperty
-// / @io.quarkus.arc.lookup.LookupUnlessProperty or a build-time @IfBuildProperty per producer.
 @Slf4j
-@ApplicationScoped
+@Configuration
+@ConditionalOnExpression(
+        "!${cluster.enabled:false} ||"
+                + " '${cluster.backplane:inprocess}'.equalsIgnoreCase('inprocess')")
 public class InProcessClusterConfiguration {
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public ClusterBackplane clusterBackplane(ApplicationProperties applicationProperties) {
         log.info("Cluster backplane: in-process (single node)");
         return new InProcessClusterBackplane(applicationProperties);
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public JobStore jobStore() {
         return new InProcessJobStore();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public RateLimitStore rateLimitStore() {
         return new InProcessRateLimitStore();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public DistributedLock distributedLock() {
         return new InProcessDistributedLock();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public KeyValueCache keyValueCache() {
         return new InProcessKeyValueCache();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public InstanceRegistry instanceRegistry() {
         return new InProcessInstanceRegistry();
     }

app/common/src/main/java/stirling/software/common/cluster/inprocess/LocalDiskFileStoreConfiguration.java

@@ -1,11 +1,10 @@
 package stirling.software.common.cluster.inprocess;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-
-import io.quarkus.arc.DefaultBean;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Produces;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 
 import stirling.software.common.cluster.FileStore;
 
@@ -14,23 +13,17 @@ import stirling.software.common.cluster.FileStore;
  * cluster.artifactStore=local} (the default; {@code matchIfMissing=true}). The S3 artifact-store
  * supplies its own bean when {@code cluster.artifactStore=s3}.
  */
-// TODO: Migration required - the original class was guarded by Spring's
-// @ConditionalOnProperty(prefix="cluster", name="artifactStore", havingValue="local",
-// matchIfMissing=true). Quarkus has no runtime equivalent: @io.quarkus.arc.profile.IfBuildProperty
-// is build-time only and does not support matchIfMissing semantics. The producer below is now
-// unconditional. The "local is the default; S3 supplies its own bean" behavior is preserved via
-// @DefaultBean (the S3 artifact-store bean, if present, wins over this default). If a true
-// runtime toggle on cluster.artifactStore is needed, gate the producer body on the config value
-// and return/short-circuit accordingly.
-@ApplicationScoped
+@Configuration
+@ConditionalOnProperty(
+        prefix = "cluster",
+        name = "artifactStore",
+        havingValue = "local",
+        matchIfMissing = true)
 public class LocalDiskFileStoreConfiguration {
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
-    public FileStore fileStore(
-            @ConfigProperty(name = "stirling.tempDir", defaultValue = "/tmp/stirling-files")
-                    String tempDir) {
+    @Bean
+    @ConditionalOnMissingBean
+    public FileStore fileStore(@Value("${stirling.tempDir:/tmp/stirling-files}") String tempDir) {
         return new LocalDiskFileStore(tempDir);
     }
 }

app/common/src/main/java/stirling/software/common/config/TempFileConfiguration.java

@@ -3,29 +3,37 @@ package stirling.software.common.config;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
 import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.TempFileRegistry;
 
 /**
  * Configuration for the temporary file management system. Sets up the necessary beans and
  * configures system properties.
  */
 @Slf4j
-@ApplicationScoped
+@Configuration
 @RequiredArgsConstructor
 public class TempFileConfiguration {
 
     private final ApplicationProperties applicationProperties;
 
-    // MIGRATION: the @Produces TempFileRegistry producer was removed. TempFileRegistry is already
-    // an
-    // @ApplicationScoped CDI bean with a no-arg constructor, so the producer was a redundant second
-    // @Default bean of the same type and made every injection point ambiguous.
+    /**
+     * Create the TempFileRegistry bean.
+     *
+     * @return A new TempFileRegistry instance
+     */
+    @Bean
+    public TempFileRegistry tempFileRegistry() {
+        return new TempFileRegistry();
+    }
 
     @PostConstruct
     public void initTempFileConfig() {

app/common/src/main/java/stirling/software/common/config/TempFileShutdownHook.java

@@ -5,8 +5,8 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Set;
 
-import jakarta.annotation.PreDestroy;
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.beans.factory.DisposableBean;
+import org.springframework.stereotype.Component;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -14,12 +14,12 @@ import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.TempFileRegistry;
 
 /**
- * Handles cleanup of temporary files on application shutdown. Uses a CDI {@code @PreDestroy} method
- * (migrated from Spring's {@code DisposableBean}) to ensure cleanup happens during normal shutdown.
+ * Handles cleanup of temporary files on application shutdown. Implements Spring's DisposableBean
+ * interface to ensure cleanup happens during normal application shutdown.
  */
 @Slf4j
-@ApplicationScoped
-public class TempFileShutdownHook {
+@Component
+public class TempFileShutdownHook implements DisposableBean {
 
     private final TempFileRegistry registry;
 
@@ -31,8 +31,8 @@ public class TempFileShutdownHook {
         Runtime.getRuntime().addShutdownHook(new Thread(this::cleanupTempFiles));
     }
 
-    /** CDI pre-destroy callback (was DisposableBean#destroy). Called during normal shutdown. */
-    @PreDestroy
+    /** Spring's DisposableBean interface method. Called during normal application shutdown. */
+    @Override
     public void destroy() {
         log.info("Application shutting down, cleaning up temporary files");
         cleanupTempFiles();

app/common/src/main/java/stirling/software/common/configuration/AppConfig.java

@@ -9,69 +9,40 @@ import java.util.Properties;
 import java.util.function.Predicate;
 import java.util.stream.Stream;
 
-import org.eclipse.microprofile.config.Config;
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-
-import io.quarkus.arc.profile.IfBuildProfile;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.context.Dependent;
-import jakarta.enterprise.inject.Produces;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.context.annotation.Profile;
+import org.springframework.context.annotation.Scope;
+import org.springframework.core.env.Environment;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.util.ClassUtils;
 
 import lombok.Getter;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 
-/**
- * Central CDI producer hub (migrated from a Spring {@code @Configuration} class).
- *
- * <p>MIGRATION NOTES (Spring -> Quarkus CDI):
- *
- * <ul>
- *   <li>{@code @Bean} -> {@code @Produces}; {@code @Bean(name="x")} ->
- *       {@code @Produces @Named("x")}.
- *   <li>{@code @Value} -> {@code @ConfigProperty}; Spring {@code Environment} -> MicroProfile
- *       {@code Config}.
- *   <li>{@code @Profile("default")} flavor-default beans -> {@code @DefaultBean}: the :proprietary
- *       / :saas modules provide the "real" producer and automatically win when present, exactly
- *       like the old profile override (this is the Quarkus idiom for "default unless overridden").
- *   <li>{@code @Scope("request")} on {@code boolean} producers -> {@code @Dependent}. CDI normal
- *       scopes (e.g. {@code @RequestScoped}) require a client proxy, which is impossible for
- *       primitives/finals, so Spring's request-scoped primitive beans cannot be reproduced
- *       directly. {@code @Dependent} recomputes the value at each injection point, which is the
- *       closest behaviour. TODO: Migration required - if true per-HTTP-request semantics are
- *       needed, wrap the value in a {@code @RequestScoped} holder object instead of producing a
- *       bare boolean.
- *   <li>{@code @Lazy} dropped - CDI beans are initialised lazily by default.
- * </ul>
- */
+@Lazy
 @Slf4j
-@ApplicationScoped
+@Configuration
+@RequiredArgsConstructor
 public class AppConfig {
 
-    private final Config config;
+    private final Environment env;
 
     private final ApplicationProperties applicationProperties;
 
     @Getter
-    @ConfigProperty(name = "server.servlet.context-path", defaultValue = "/")
-    String contextPath;
+    @Value("${server.servlet.context-path:/}")
+    private String contextPath;
 
     @Getter
-    @ConfigProperty(name = "quarkus.http.port", defaultValue = "8080")
-    String serverPort;
-
-    @ConfigProperty(name = "v2")
-    boolean v2Enabled;
-
-    @Inject
-    public AppConfig(Config config, ApplicationProperties applicationProperties) {
-        this.config = config;
-        this.applicationProperties = applicationProperties;
-    }
+    @Value("${server.port:8080}")
+    private String serverPort;
 
     /**
      * Get the backend URL from system configuration. Falls back to http://localhost if not
@@ -84,111 +55,76 @@ public class AppConfig {
         return (backendUrl != null && !backendUrl.isBlank()) ? backendUrl : "http://localhost";
     }
 
-    @Produces
-    @Named("v2Enabled")
+    @Value("${v2}")
+    public boolean v2Enabled;
+
+    @Bean
     public boolean v2Enabled() {
         return v2Enabled;
     }
 
-    // MIGRATION: many beans inject tools.jackson.databind.ObjectMapper (Jackson 3, inherited from
-    // Spring Boot 4). Quarkus' container only produces a com.fasterxml.jackson (Jackson 2)
-    // ObjectMapper for REST (de)serialization, so the Jackson 3 type is an unsatisfied CDI
-    // dependency. This producer supplies a single application-scoped Jackson 3 mapper built the
-    // same
-    // way the codebase builds them ad hoc (JsonMapper.builder().build()). REST bodies still go
-    // through Quarkus' Jackson 2 mapper; this is only for code that uses the Jackson 3 API
-    // directly.
-    // TODO: Migration required - converge the codebase on one Jackson line (drop Jackson 3) later.
-    @Produces
-    @ApplicationScoped
-    public tools.jackson.databind.ObjectMapper jackson3ObjectMapper() {
-        return tools.jackson.databind.json.JsonMapper.builder().build();
-    }
-
-    @Produces
-    @Named("contextPath")
-    public String contextPathBean() {
-        return contextPath;
-    }
-
-    @Produces
-    @Named("loginEnabled")
+    @Bean(name = "loginEnabled")
     public boolean loginEnabled() {
         return applicationProperties.getSecurity().isEnableLogin();
     }
 
-    // MIGRATION: CDI has no producer for the nested ApplicationProperties.Security.SAML2 config
-    // object, so beans that inject it directly (e.g. CustomSaml2AuthenticationSuccessHandler) were
-    // unsatisfied. Expose it from the already-injected ApplicationProperties. May be null/disabled;
-    // that is fine for injection.
-    @Produces
-    public ApplicationProperties.Security.SAML2 saml2Config() {
-        return applicationProperties.getSecurity().getSaml2();
-    }
-
-    @Produces
-    @Named("appName")
+    @Bean(name = "appName")
     public String appName() {
         return "Stirling PDF";
     }
 
-    @Produces
-    @Named("appVersion")
+    @Bean(name = "appVersion")
     public String appVersion() {
-        // MIGRATION: Spring ClassPathResource -> plain classloader resource lookup.
+        Resource resource = new ClassPathResource("version.properties");
         Properties props = new Properties();
-        try (var in = getClass().getClassLoader().getResourceAsStream("version.properties")) {
-            if (in != null) {
-                props.load(in);
-                return props.getProperty("version");
-            }
+        try {
+            props.load(resource.getInputStream());
+            return props.getProperty("version");
         } catch (IOException e) {
             log.error("exception", e);
         }
         return "0.0.0";
     }
 
-    @Produces
-    @Named("homeText")
+    @Bean(name = "homeText")
     public String homeText() {
         return "null";
     }
 
-    @Produces
-    @Named("languages")
+    @Bean(name = "languages")
     public List<String> languages() {
         return applicationProperties.getUi().getLanguages();
     }
 
-    @Produces
-    @Named("navBarText")
+    @Bean
+    public String contextPath(@Value("${server.servlet.context-path}") String contextPath) {
+        return contextPath;
+    }
+
+    @Bean(name = "navBarText")
     public String navBarText() {
         String navBar = applicationProperties.getUi().getAppNameNavbar();
         return (navBar != null) ? navBar : "Stirling PDF";
     }
 
-    @Produces
-    @Named("enableAlphaFunctionality")
+    @Bean(name = "enableAlphaFunctionality")
     public boolean enableAlphaFunctionality() {
         return applicationProperties.getSystem().isEnableAlphaFunctionality();
     }
 
-    @Produces
-    @Named("rateLimit")
+    @Bean(name = "rateLimit")
     public boolean rateLimit() {
         String rateLimit = System.getProperty("rateLimit");
         if (rateLimit == null) rateLimit = System.getenv("rateLimit");
         return Boolean.parseBoolean(rateLimit);
     }
 
-    @Produces
-    @Named("RunningInDocker")
+    @Bean(name = "RunningInDocker")
     public boolean runningInDocker() {
         return Files.exists(Path.of("/.dockerenv"));
     }
 
-    @Produces
-    @Named("configDirMounted")
+    @Bean(name = "configDirMounted")
     public boolean isRunningInDockerWithConfig() {
         Path dockerEnv = Path.of("/.dockerenv");
         // default to true if not docker
@@ -207,23 +143,14 @@ public class AppConfig {
         }
     }
 
-    @Produces
-    @Named("activeSecurity")
+    @Bean(name = "activeSecurity")
     public boolean missingActiveSecurity() {
-        // MIGRATION: Spring ClassUtils.isPresent -> manual Class.forName presence check.
-        try {
-            Class.forName(
-                    "stirling.software.proprietary.security.configuration.SecurityConfiguration",
-                    false,
-                    this.getClass().getClassLoader());
-            return true;
-        } catch (ClassNotFoundException e) {
-            return false;
-        }
+        return ClassUtils.isPresent(
+                "stirling.software.proprietary.security.configuration.SecurityConfiguration",
+                this.getClass().getClassLoader());
     }
 
-    @Produces
-    @Named("directoryFilter")
+    @Bean(name = "directoryFilter")
     public Predicate<Path> processOnlyFiles() {
         return path -> {
             if (Files.isDirectory(path)) {
@@ -234,138 +161,113 @@ public class AppConfig {
         };
     }
 
-    @Produces
-    @Named("termsAndConditions")
+    @Bean(name = "termsAndConditions")
     public String termsAndConditions() {
         return applicationProperties.getLegal().getTermsAndConditions();
     }
 
-    @Produces
-    @Named("privacyPolicy")
+    @Bean(name = "privacyPolicy")
     public String privacyPolicy() {
         return applicationProperties.getLegal().getPrivacyPolicy();
     }
 
-    @Produces
-    @Named("cookiePolicy")
+    @Bean(name = "cookiePolicy")
     public String cookiePolicy() {
         return applicationProperties.getLegal().getCookiePolicy();
     }
 
-    @Produces
-    @Named("impressum")
+    @Bean(name = "impressum")
     public String impressum() {
         return applicationProperties.getLegal().getImpressum();
     }
 
-    @Produces
-    @Named("accessibilityStatement")
+    @Bean(name = "accessibilityStatement")
     public String accessibilityStatement() {
         return applicationProperties.getLegal().getAccessibilityStatement();
     }
 
-    @Produces
-    @Dependent
-    @Named("analyticsPrompt")
+    @Bean(name = "analyticsPrompt")
+    @Scope("request")
     public boolean analyticsPrompt() {
         return applicationProperties.getSystem().getEnableAnalytics() == null;
     }
 
-    @Produces
-    @Dependent
-    @Named("analyticsEnabled")
+    @Bean(name = "analyticsEnabled")
+    @Scope("request")
     public boolean analyticsEnabled() {
         if (applicationProperties.getPremium().isEnabled()) return true;
         return applicationProperties.getSystem().isAnalyticsEnabled();
     }
 
-    @Produces
-    @Named("StirlingPDFLabel")
+    @Bean(name = "StirlingPDFLabel")
     public String stirlingPDFLabel() {
         return "Stirling-PDF" + " v" + appVersion();
     }
 
-    @Produces
-    @Named("UUID")
+    @Bean(name = "UUID")
     public String uuid() {
         return applicationProperties.getAutomaticallyGenerated().getUUID();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Security security() {
         return applicationProperties.getSecurity();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Security.OAUTH2 oAuth2() {
         return applicationProperties.getSecurity().getOauth2();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Premium premium() {
         return applicationProperties.getPremium();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.System system() {
         return applicationProperties.getSystem();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Datasource datasource() {
         return applicationProperties.getSystem().getDatasource();
     }
 
-    // @IfBuildProfile("core"): these NORMAL/default license @Named beans apply only to the core
-    // flavor. In proprietary EEAppConfig provides them (security profile) and in saas
-    // SaasLicenseOverride does (saas profile); registering this producer alongside those trips
-    // Qute's named-bean validation ("Duplicate key runningEE"), which does not honour @DefaultBean
-    // suppression - so gate to core outright. (In core, EEAppConfig/SaasLicenseOverride are not
-    // even on the classpath.)
-    @Produces
-    @IfBuildProfile("core")
-    @Named("runningProOrHigher")
+    @Bean(name = "runningProOrHigher")
+    @Profile("default")
     public boolean runningProOrHigher() {
         return false;
     }
 
-    @Produces
-    @IfBuildProfile("core")
-    @Named("runningEE")
+    @Bean(name = "runningEE")
+    @Profile("default")
     public boolean runningEnterprise() {
         return false;
     }
 
-    @Produces
-    @IfBuildProfile("core")
-    @Named("license")
+    @Bean(name = "license")
+    @Profile("default")
     public String licenseType() {
         return "NORMAL";
     }
 
-    @Produces
-    @Named("scarfEnabled")
+    @Bean(name = "scarfEnabled")
     public boolean scarfEnabled() {
         return applicationProperties.getSystem().isScarfEnabled();
     }
 
-    @Produces
-    @Named("posthogEnabled")
+    @Bean(name = "posthogEnabled")
     public boolean posthogEnabled() {
         return applicationProperties.getSystem().isPosthogEnabled();
     }
 
-    @Produces
-    @Named("machineType")
+    @Bean(name = "machineType")
     public String determineMachineType() {
         try {
             boolean isDocker = runningInDocker();
             boolean isKubernetes = System.getenv("KUBERNETES_SERVICE_HOST") != null;
-            boolean isBrowserOpen =
-                    "true"
-                            .equalsIgnoreCase(
-                                    config.getOptionalValue("BROWSER_OPEN", String.class)
-                                            .orElse(null));
+            boolean isBrowserOpen = "true".equalsIgnoreCase(env.getProperty("BROWSER_OPEN"));
 
             if (isKubernetes) {
                 return "Kubernetes";

app/common/src/main/java/stirling/software/common/configuration/ApplicationPropertiesConfigOverlay.java

@@ -1,193 +0,0 @@
-package stirling.software.common.configuration;
-
-import java.lang.reflect.Field;
-import java.lang.reflect.Modifier;
-import java.lang.reflect.ParameterizedType;
-import java.lang.reflect.Type;
-import java.util.List;
-
-import org.eclipse.microprofile.config.Config;
-import org.eclipse.microprofile.config.ConfigProvider;
-
-import io.quarkus.arc.ClientProxy;
-import io.quarkus.runtime.StartupEvent;
-
-import jakarta.annotation.Priority;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.event.Observes;
-import jakarta.inject.Inject;
-import jakarta.interceptor.Interceptor;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.ApplicationProperties;
-
-/**
- * Binds MicroProfile/Quarkus config (env vars, {@code settings.yml} via {@link
- * SettingsYamlConfigSource}, {@code application.properties}, system properties) onto the mutable
- * {@link ApplicationProperties} bean at startup - the Quarkus replacement for the Spring
- * {@code @ConfigurationProperties(prefix = "")} relaxed binding that was lost in the migration.
- *
- * <p>Rather than hand-listing each property, this walks the whole {@code ApplicationProperties}
- * object graph by reflection and, for every scalar / enum / scalar-list field, applies the value
- * from config when one is present (so unset fields keep their Java default). The dotted key for a
- * field mirrors its path in the tree ({@code security.oauth2.client.keycloak.clientId}, {@code
- * endpoints.toRemove}, ...); SmallRye then resolves it from any source - e.g. env var {@code
- * SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTID} or the same key in {@code settings.yml} - with the
- * usual precedence (sys props &gt; env &gt; settings.yml &gt; application.properties).
- *
- * <p>This is the behaviour Spring had: every settings.yml / {@code SECURITY_*}/{@code STORAGE_*}
- * /{@code PREMIUM_*} value is honoured, fixing the whole {@code maxDPI=0} / {@code enableLogin}
- * /{@code endpoints.toRemove} / premium-license class of "ignored config" bugs at once.
- *
- * <p>Runs with {@code @Priority(APPLICATION)} so it completes before startup consumers read the
- * bean: {@code InitialSecuritySetup} (enableLogin / customGlobalAPIKey), {@code
- * EndpointConfiguration} (endpoints.toRemove), and {@code LicenseKeyChecker.onApplicationReady}
- * (premium.enabled / premium.key, which has the lower default observer priority 2500).
- *
- * <p>Values are never logged - only key names at DEBUG and a total at INFO - because the tree
- * carries secrets (premium key, client secrets, initial-login password, SMTP/Telegram tokens).
- */
-@Slf4j
-@ApplicationScoped
-public class ApplicationPropertiesConfigOverlay {
-
-    private static final int MAX_DEPTH = 20;
-
-    @Inject ApplicationProperties applicationProperties;
-
-    void onStart(@Observes @Priority(Interceptor.Priority.APPLICATION) StartupEvent event) {
-        Config config = ConfigProvider.getConfig();
-        // ApplicationProperties is @ApplicationScoped, so the injected reference is a client proxy;
-        // reflect over the real contextual instance (its getters delegate, but getDeclaredFields()
-        // on the proxy would not see the model fields).
-        Object root = applicationProperties;
-        if (root instanceof ClientProxy proxy) {
-            root = proxy.arc_contextualInstance();
-        }
-        int[] applied = {0};
-        bind(root, "", config, 0, applied);
-        log.info(
-                "Applied {} configuration override(s) onto ApplicationProperties"
-                        + " (settings.yml + environment)",
-                applied[0]);
-    }
-
-    private void bind(Object node, String prefix, Config config, int depth, int[] applied) {
-        if (node == null || depth > MAX_DEPTH) {
-            return;
-        }
-        for (Field field : node.getClass().getDeclaredFields()) {
-            int mods = field.getModifiers();
-            if (Modifier.isStatic(mods) || field.isSynthetic()) {
-                continue;
-            }
-            String key = prefix.isEmpty() ? field.getName() : prefix + "." + field.getName();
-            Class<?> type = field.getType();
-            try {
-                field.setAccessible(true);
-                if (isModelType(type)) {
-                    Object child = field.get(node);
-                    if (child == null) {
-                        child = instantiate(type);
-                        if (child != null) {
-                            field.set(node, child);
-                        }
-                    }
-                    bind(child, key, config, depth + 1, applied);
-                } else if (List.class.isAssignableFrom(type)) {
-                    Class<?> element = listElementType(field);
-                    if (element != null && isLeaf(element)) {
-                        config.getOptionalValues(key, element)
-                                .ifPresent(value -> apply(field, node, value, key, applied));
-                    }
-                    // List<model-type> has no flat scalar representation here - skip.
-                } else if (isLeaf(type)) {
-                    config.getOptionalValue(key, box(type))
-                            .ifPresent(value -> apply(field, node, value, key, applied));
-                }
-                // Maps and other container/unsupported types are left to their Java defaults.
-            } catch (Exception ex) {
-                // Per-field best effort: an unconvertible value or inaccessible field must not
-                // abort
-                // the whole overlay. Never include the value (may be a secret).
-                log.debug("Skipped config binding for {} ({})", key, ex.toString());
-            }
-        }
-    }
-
-    private void apply(Field field, Object node, Object value, String key, int[] applied) {
-        try {
-            field.set(node, value);
-            applied[0]++;
-            // Key name only - the value may be a secret (license key, password, client secret).
-            log.debug("Applied config override: {}", key);
-        } catch (Exception ex) {
-            log.debug("Failed to set {} ({})", key, ex.toString());
-        }
-    }
-
-    private static boolean isModelType(Class<?> type) {
-        return type.getName().startsWith("stirling.software") && !type.isEnum();
-    }
-
-    private static boolean isLeaf(Class<?> type) {
-        return type == String.class
-                || type.isEnum()
-                || type.isPrimitive()
-                || type == Boolean.class
-                || type == Integer.class
-                || type == Long.class
-                || type == Double.class
-                || type == Float.class
-                || type == Short.class
-                || type == Byte.class;
-    }
-
-    private static Class<?> box(Class<?> type) {
-        if (!type.isPrimitive()) {
-            return type;
-        }
-        if (type == boolean.class) {
-            return Boolean.class;
-        }
-        if (type == int.class) {
-            return Integer.class;
-        }
-        if (type == long.class) {
-            return Long.class;
-        }
-        if (type == double.class) {
-            return Double.class;
-        }
-        if (type == float.class) {
-            return Float.class;
-        }
-        if (type == short.class) {
-            return Short.class;
-        }
-        if (type == byte.class) {
-            return Byte.class;
-        }
-        return type;
-    }
-
-    private static Class<?> listElementType(Field field) {
-        Type generic = field.getGenericType();
-        if (generic instanceof ParameterizedType parameterized) {
-            Type[] args = parameterized.getActualTypeArguments();
-            if (args.length == 1 && args[0] instanceof Class<?> element) {
-                return element;
-            }
-        }
-        return null;
-    }
-
-    private static Object instantiate(Class<?> type) {
-        try {
-            return type.getDeclaredConstructor().newInstance();
-        } catch (Exception ex) {
-            return null;
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/configuration/PostHogConfig.java

@@ -1,29 +1,28 @@
 package stirling.software.common.configuration;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 
 import com.posthog.java.PostHog;
 
 import jakarta.annotation.PreDestroy;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Produces;
 
 import lombok.extern.slf4j.Slf4j;
 
-@ApplicationScoped
+@Configuration
 @Slf4j
 public class PostHogConfig {
 
-    @ConfigProperty(name = "posthog.api.key")
-    String posthogApiKey;
+    @Value("${posthog.api.key}")
+    private String posthogApiKey;
 
-    @ConfigProperty(name = "posthog.host")
-    String posthogHost;
+    @Value("${posthog.host}")
+    private String posthogHost;
 
     private PostHog postHogClient;
 
-    @Produces
-    @ApplicationScoped
+    @Bean
     public PostHog postHogClient() {
         postHogClient =
                 new PostHog.Builder(posthogApiKey)

app/common/src/main/java/stirling/software/common/configuration/PostHogLoggerImpl.java

@@ -1,13 +1,13 @@
 package stirling.software.common.configuration;
 
-import com.posthog.java.PostHogLogger;
+import org.springframework.stereotype.Component;
 
-import jakarta.enterprise.context.ApplicationScoped;
+import com.posthog.java.PostHogLogger;
 
 import lombok.extern.slf4j.Slf4j;
 
 @Slf4j
-@ApplicationScoped
+@Component
 public class PostHogLoggerImpl implements PostHogLogger {
 
     @Override

app/common/src/main/java/stirling/software/common/configuration/RuntimePathConfig.java

@@ -10,8 +10,7 @@ import java.util.List;
 import java.util.Set;
 
 import org.apache.commons.lang3.StringUtils;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.context.annotation.Configuration;
 
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
@@ -25,7 +24,7 @@ import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.UnoServerPool;
 
 @Slf4j
-@ApplicationScoped
+@Configuration
 @Getter
 public class RuntimePathConfig {
     private final ApplicationProperties properties;

app/common/src/main/java/stirling/software/common/configuration/SchedulingConfig.java

@@ -1,19 +1,23 @@
 package stirling.software.common.configuration;
 
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.scheduling.TaskScheduler;
+import org.springframework.scheduling.concurrent.SimpleAsyncTaskScheduler;
+
 /**
  * Configures the scheduler used by all {@code @Scheduled} methods. Uses virtual threads so that
  * long-running scheduled tasks (e.g. cleanup, license checks, file monitoring) never block each
  * other — each runs on its own lightweight virtual thread.
- *
- * <p>MIGRATION (Spring -> Quarkus): the custom Spring {@code TaskScheduler} bean has been removed.
- * Quarkus' {@code quarkus-scheduler} extension owns the scheduling thread pool, so no application
- * bean is required. To keep the "each scheduled task on its own virtual thread" behaviour, annotate
- * the individual {@code @io.quarkus.scheduler.Scheduled} methods with
- * {@code @io.smallrye.common.annotation.RunOnVirtualThread} (or configure {@code
- * quarkus.scheduler.use-virtual-threads=true} where supported).
- *
- * <p>TODO: Migration required - any injection point that received the former Spring {@code
- * TaskScheduler} bean must be rewritten to use the Quarkus scheduler API or a CDI-managed {@code
- * java.util.concurrent.ScheduledExecutorService}.
  */
-public class SchedulingConfig {}
+@Configuration
+public class SchedulingConfig {
+
+    @Bean
+    public TaskScheduler taskScheduler() {
+        SimpleAsyncTaskScheduler scheduler = new SimpleAsyncTaskScheduler();
+        scheduler.setVirtualThreads(true);
+        scheduler.setThreadNamePrefix("scheduled-vt-");
+        return scheduler;
+    }
+}

app/common/src/main/java/stirling/software/common/configuration/SettingsYamlConfigSource.java

@@ -1,141 +0,0 @@
-package stirling.software.common.configuration;
-
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import org.eclipse.microprofile.config.spi.ConfigSource;
-import org.snakeyaml.engine.v2.api.Load;
-import org.snakeyaml.engine.v2.api.LoadSettings;
-
-/**
- * Exposes {@code settings.yml} (and {@code custom_settings.yml}, with the bundled {@code
- * settings.yml.template} as the default fallback) as a MicroProfile/SmallRye {@link ConfigSource}.
- *
- * <p>Restores the Spring {@code @ConfigurationProperties} behaviour that bound {@code settings.yml}
- * into {@code ApplicationProperties}: without this the YAML was never read under Quarkus, so flags
- * like {@code security.enableLogin} fell back to their Java defaults regardless of the file (the
- * {@code enableLogin=false}/{@code maxDPI=0}/{@code loginAttemptCount=0} class of bugs). The nested
- * YAML is flattened to dotted keys ({@code security.enableLogin -> "true"}); {@link
- * ApplicationPropertiesConfigOverlay} and {@code @ConfigProperty} injections then read them.
- *
- * <p>Ordinal {@value #ORDINAL} sits above {@code application.properties} (250) but below
- * environment variables (300) and system properties (400), matching Spring's precedence - e.g.
- * {@code SECURITY_ENABLELOGIN} still overrides the file.
- *
- * <p>Registered via {@code META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource}.
- */
-public class SettingsYamlConfigSource implements ConfigSource {
-
-    private static final int ORDINAL = 275;
-
-    private final Map<String, String> properties;
-
-    public SettingsYamlConfigSource() {
-        this.properties = load();
-    }
-
-    private static Map<String, String> load() {
-        Map<String, String> flat = new HashMap<>();
-        // 1. Bundled template provides the defaults (e.g. security.enableLogin: true).
-        try (InputStream in =
-                SettingsYamlConfigSource.class
-                        .getClassLoader()
-                        .getResourceAsStream("settings.yml.template")) {
-            if (in != null) {
-                flatten("", loadYaml(in), flat);
-            }
-        } catch (Exception ignored) {
-            // best effort - fall through to file overrides / Java defaults
-        }
-        // 2. The user's settings.yml overrides the template.
-        mergeFile(InstallationPathConfig.getSettingsPath(), flat);
-        // 3. custom_settings.yml overrides settings.yml.
-        mergeFile(InstallationPathConfig.getCustomSettingsPath(), flat);
-        return flat;
-    }
-
-    private static void mergeFile(String path, Map<String, String> flat) {
-        try {
-            Path p = Path.of(path);
-            if (Files.isRegularFile(p)) {
-                try (InputStream in = Files.newInputStream(p)) {
-                    flatten("", loadYaml(in), flat);
-                }
-            }
-        } catch (Exception ignored) {
-            // unreadable/invalid file - keep whatever defaults were already loaded
-        }
-    }
-
-    private static Object loadYaml(InputStream in) {
-        return new Load(LoadSettings.builder().build()).loadFromInputStream(in);
-    }
-
-    private static void flatten(String prefix, Object node, Map<String, String> out) {
-        if (node instanceof Map<?, ?> map) {
-            for (Map.Entry<?, ?> e : map.entrySet()) {
-                String key =
-                        prefix.isEmpty() ? String.valueOf(e.getKey()) : prefix + "." + e.getKey();
-                flatten(key, e.getValue(), out);
-            }
-        } else if (node instanceof List<?> list) {
-            // Emit scalar lists as a comma-separated value so SmallRye binds them via
-            // config.getValues()/getOptionalValues() (e.g. endpoints.toRemove, consumed by
-            // EndpointConfiguration to disable endpoints). Lists containing maps/nested lists have
-            // no
-            // flat scalar form, so skip those - their consumers read them structurally, not through
-            // this overlay. The scalar lists here (endpoint names, group names) contain no commas,
-            // so
-            // a plain join round-trips cleanly.
-            boolean scalarList =
-                    !list.isEmpty()
-                            && list.stream()
-                                    .allMatch(
-                                            e ->
-                                                    e != null
-                                                            && !(e instanceof Map)
-                                                            && !(e instanceof List));
-            if (scalarList) {
-                out.put(
-                        prefix,
-                        list.stream()
-                                .map(String::valueOf)
-                                .collect(java.util.stream.Collectors.joining(",")));
-            }
-            return;
-        } else if (node != null) {
-            out.put(prefix, String.valueOf(node));
-        }
-        // null leaves are left unset so the Java default applies.
-    }
-
-    @Override
-    public Map<String, String> getProperties() {
-        return properties;
-    }
-
-    @Override
-    public Set<String> getPropertyNames() {
-        return properties.keySet();
-    }
-
-    @Override
-    public String getValue(String propertyName) {
-        return properties.get(propertyName);
-    }
-
-    @Override
-    public String getName() {
-        return "settings.yml";
-    }
-
-    @Override
-    public int getOrdinal() {
-        return ORDINAL;
-    }
-}

app/common/src/main/java/stirling/software/common/configuration/YamlPropertySourceFactory.java

@@ -0,0 +1,22 @@
+package stirling.software.common.configuration;
+
+import java.util.Properties;
+
+import org.springframework.beans.factory.config.YamlPropertiesFactoryBean;
+import org.springframework.core.env.PropertiesPropertySource;
+import org.springframework.core.env.PropertySource;
+import org.springframework.core.io.support.EncodedResource;
+import org.springframework.core.io.support.PropertySourceFactory;
+
+public class YamlPropertySourceFactory implements PropertySourceFactory {
+
+    @Override
+    public PropertySource<?> createPropertySource(String name, EncodedResource encodedResource) {
+        YamlPropertiesFactoryBean factory = new YamlPropertiesFactoryBean();
+        factory.setResources(encodedResource.getResource());
+        Properties properties = factory.getObject();
+
+        return new PropertiesPropertySource(
+                encodedResource.getResource().getFilename(), properties);
+    }
+}

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -1,6 +1,7 @@
 package stirling.software.common.model;
 
 import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.HttpURLConnection;
@@ -14,11 +15,22 @@ import java.util.List;
 import java.util.Locale;
 import java.util.UUID;
 
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.core.env.ConfigurableEnvironment;
+import org.springframework.core.env.PropertySource;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.core.io.support.EncodedResource;
+import org.springframework.stereotype.Component;
+
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.Data;
 import lombok.Getter;
@@ -27,11 +39,9 @@ import lombok.ToString;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.configuration.InstallationPathConfig;
+import stirling.software.common.configuration.YamlPropertySourceFactory;
 import stirling.software.common.constants.JwtConstants;
 import stirling.software.common.model.exception.UnsupportedProviderException;
-import stirling.software.common.model.io.ClassPathResource;
-import stirling.software.common.model.io.FileSystemResource;
-import stirling.software.common.model.io.Resource;
 import stirling.software.common.model.oauth2.GitHubProvider;
 import stirling.software.common.model.oauth2.GoogleProvider;
 import stirling.software.common.model.oauth2.KeycloakProvider;
@@ -41,12 +51,9 @@ import stirling.software.common.util.ValidationUtils;
 
 @Data
 @Slf4j
-@ApplicationScoped
-// TODO: Migration required - rebind via @io.smallrye.config.ConfigMapping or
-// @io.quarkus.arc.config.ConfigProperties. Was Spring @ConfigurationProperties(prefix = ""),
-// kept here as a plain CDI bean POJO; the property binding is not yet wired in Quarkus.
-// TODO: Migration required - Spring @Order(Ordered.HIGHEST_PRECEDENCE) controlled
-// configuration-bean ordering; there is no equivalent CDI ordering annotation for this bean.
+@Component
+@Order(Ordered.HIGHEST_PRECEDENCE)
+@ConfigurationProperties(prefix = "")
 public class ApplicationProperties {
 
     private Legal legal = new Legal();
@@ -75,17 +82,38 @@ public class ApplicationProperties {
     private Cluster cluster = new Cluster();
     private Policies policies = new Policies();
 
-    // REMOVED (Spring -> Quarkus): dynamicYamlPropertySource(ConfigurableEnvironment).
-    // This was a Spring @Bean that registered settings.yml as an extra runtime PropertySource on
-    // the
-    // ConfigurableEnvironment (added first, or last under the "saas" profile). Quarkus has no
-    // ConfigurableEnvironment/PropertySource model and the @Bean had already been removed, so the
-    // method was dead code referencing Spring-only types.
-    // TODO: Migration required - reimplement external settings.yml loading as a custom
-    // org.eclipse.microprofile.config.spi.ConfigSource (registered via a ConfigSourceProvider /
-    // META-INF/services), giving it an ordinal that reproduces the old precedence: higher than the
-    // application defaults normally, but lower than application-saas.properties under the saas
-    // profile. Wire it in ConfigInitializer.
+    @Bean
+    public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
+            throws IOException {
+        String configPath = InstallationPathConfig.getSettingsPath();
+        log.debug("Attempting to load settings from: {}", configPath);
+
+        File file = new File(configPath);
+        if (!file.exists()) {
+            log.error("Warning: Settings file does not exist at: {}", configPath);
+        }
+
+        Resource resource = new FileSystemResource(configPath);
+        if (!resource.exists()) {
+            throw new FileNotFoundException("Settings file not found at: " + configPath);
+        }
+
+        EncodedResource encodedResource = new EncodedResource(resource);
+        PropertySource<?> propertySource =
+                new YamlPropertySourceFactory().createPropertySource(null, encodedResource);
+
+        boolean saasActive = Arrays.asList(environment.getActiveProfiles()).contains("saas");
+        if (saasActive) {
+            // Saas-pinned values in application-saas.properties must beat settings.yml.
+            environment.getPropertySources().addLast(propertySource);
+        } else {
+            environment.getPropertySources().addFirst(propertySource);
+        }
+
+        log.debug("Loaded properties: {}", propertySource.getSource());
+
+        return propertySource;
+    }
 
     /**
      * Initialize fileUploadLimit from environment variables if not set in settings.yml. Supports
@@ -494,12 +522,8 @@ public class ApplicationProperties {
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
-        // Defaults mirror settings.yml.template. These primitives are not bound from the template
-        // by the current Quarkus config path, so an unset 0 means "lock after 0 attempts" (every
-        // login blocked, and the lockout never accumulates a window) - same class of bug as
-        // maxDPI=0. See the settings.yml binding TODO.
-        private int loginAttemptCount = 5;
-        private long loginResetTimeMinutes = 120;
+        private int loginAttemptCount;
+        private long loginResetTimeMinutes;
         private String loginMethod = "all";
         private String customGlobalAPIKey;
         private Jwt jwt = new Jwt();
@@ -584,9 +608,8 @@ public class ApplicationProperties {
             @JsonIgnore
             public InputStream getIdpMetadataUri() throws IOException {
                 if (idpMetadataUri.startsWith("classpath:")) {
-                    return getClass()
-                            .getClassLoader()
-                            .getResourceAsStream(idpMetadataUri.substring("classpath:".length()));
+                    return new ClassPathResource(idpMetadataUri.substring("classpath:".length()))
+                            .getInputStream();
                 }
                 try {
                     URI uri = new URI(idpMetadataUri);
@@ -599,9 +622,6 @@ public class ApplicationProperties {
                 }
             }
 
-            // TODO: Migration required - returns org.springframework.core.io.Resource, a public
-            // signature relied on by callers. Converting to InputStream/byte[]/java.nio would
-            // ripple to those call sites, so the Spring Resource type is retained for now.
             @JsonIgnore
             public Resource getSpCert() {
                 if (spCert == null) return null;
@@ -612,9 +632,6 @@ public class ApplicationProperties {
                 }
             }
 
-            // TODO: Migration required - returns org.springframework.core.io.Resource, a public
-            // signature relied on by callers. Converting to InputStream/byte[]/java.nio would
-            // ripple to those call sites, so the Spring Resource type is retained for now.
             @JsonIgnore
             public Resource getIdpCert() {
                 if (idpCert == null) return null;
@@ -625,9 +642,6 @@ public class ApplicationProperties {
                 }
             }
 
-            // TODO: Migration required - returns org.springframework.core.io.Resource, a public
-            // signature relied on by callers. Converting to InputStream/byte[]/java.nio would
-            // ripple to those call sites, so the Spring Resource type is retained for now.
             @JsonIgnore
             public Resource getPrivateKey() {
                 if (privateKey == null) return null;
@@ -867,10 +881,7 @@ public class ApplicationProperties {
         private Boolean enableDesktopInstallSlide;
         private Datasource datasource;
         private boolean disableSanitize;
-        // Default mirrors settings.yml.template (maxDPI: 500). Without an explicit default this
-        // primitive is 0, which makes every DPI check (dpi > maxDPI) fail with "maximum safe limit
-        // of 0" when the value is not populated from settings.
-        private int maxDPI = 500;
+        private int maxDPI;
         private boolean enableUrlToPDF;
         private Html html = new Html();
         private CustomPaths customPaths = new CustomPaths();

app/common/src/main/java/stirling/software/common/model/MultipartFile.java

@@ -1,70 +0,0 @@
-package stirling.software.common.model;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import stirling.software.common.model.io.Resource;
-
-/**
- * Migration compatibility shim for Spring's {@code
- * org.springframework.web.multipart.MultipartFile}.
- *
- * <p>Quarkus/JAX-RS has no drop-in equivalent for the {@code MultipartFile} abstraction that the
- * service layer relies on (it exposes {@code org.jboss.resteasy.reactive.multipart.FileUpload} at
- * the REST boundary instead). To avoid rewriting the public signatures of dozens of service and
- * util methods across every module, this interface mirrors the subset of Spring's API that the
- * codebase actually uses. Controllers adapt the inbound {@code FileUpload}/{@code byte[]} to one of
- * the implementations ({@link stirling.software.common.model.multipart.ByteArrayMultipartFile},
- * {@link stirling.software.common.model.multipart.FileUploadMultipartFile}) and pass it down
- * unchanged.
- *
- * <p>TODO: Migration required - longer term, the REST boundary should standardise on {@code
- * FileUpload}/{@code @RestForm} and this shim can be retired.
- */
-public interface MultipartFile {
-
-    String getName();
-
-    String getOriginalFilename();
-
-    String getContentType();
-
-    boolean isEmpty();
-
-    long getSize();
-
-    byte[] getBytes() throws IOException;
-
-    InputStream getInputStream() throws IOException;
-
-    /**
-     * The content as a {@link Resource}. The default is a stream-backed resource; file-backed
-     * implementations (e.g. {@code FileUploadMultipartFile}) override this to enable zero-copy fast
-     * paths.
-     */
-    default Resource getResource() {
-        try {
-            return new stirling.software.common.model.io.InputStreamResource(
-                    getInputStream(), getOriginalFilename());
-        } catch (IOException e) {
-            throw new java.io.UncheckedIOException(e);
-        }
-    }
-
-    default void transferTo(File dest) throws IOException {
-        transferTo(dest.toPath());
-    }
-
-    default void transferTo(Path dest) throws IOException {
-        try (InputStream in = getInputStream()) {
-            // Spring's MultipartFile#transferTo overwrites an existing destination. Callers
-            // commonly
-            // pass a path from Files.createTempFile(...) (which has already created an empty file),
-            // so REPLACE_EXISTING is required - a plain Files.copy would throw FileAlreadyExists.
-            Files.copy(in, dest, java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-        }
-    }
-}

app/common/src/main/java/stirling/software/common/model/api/GeneralFile.java

@@ -1,12 +1,12 @@
 package stirling.software.common.model.api;
 
+import org.springframework.web.multipart.MultipartFile;
+
 import io.swagger.v3.oas.annotations.media.Schema;
 
 import lombok.Data;
 import lombok.EqualsAndHashCode;
 
-import stirling.software.common.model.MultipartFile;
-
 @Data
 @EqualsAndHashCode
 public class GeneralFile {

app/common/src/main/java/stirling/software/common/model/api/PDFFile.java

@@ -1,5 +1,8 @@
 package stirling.software.common.model.api;
 
+import org.springframework.http.MediaType;
+import org.springframework.web.multipart.MultipartFile;
+
 import io.swagger.v3.oas.annotations.media.Schema;
 
 import jakarta.validation.constraints.AssertTrue;
@@ -8,8 +11,6 @@ import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.NoArgsConstructor;
 
-import stirling.software.common.model.MultipartFile;
-
 @Data
 @NoArgsConstructor
 @EqualsAndHashCode
@@ -17,7 +18,7 @@ public class PDFFile {
 
     @Schema(
             description = "The input PDF file",
-            contentMediaType = "application/pdf",
+            contentMediaType = MediaType.APPLICATION_PDF_VALUE,
             format = "binary")
     private MultipartFile fileInput;
 

app/common/src/main/java/stirling/software/common/model/io/ClassPathResource.java

@@ -1,64 +0,0 @@
-package stirling.software.common.model.io;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.URL;
-
-/** Classpath-backed {@link Resource} (migration shim for Spring's {@code ClassPathResource}). */
-public class ClassPathResource implements Resource {
-
-    private final String path;
-    private final ClassLoader classLoader;
-
-    public ClassPathResource(String path) {
-        this(path, ClassPathResource.class.getClassLoader());
-    }
-
-    public ClassPathResource(String path, ClassLoader classLoader) {
-        this.path = path.startsWith("/") ? path.substring(1) : path;
-        this.classLoader = classLoader != null ? classLoader : ClassLoader.getSystemClassLoader();
-    }
-
-    @Override
-    public InputStream getInputStream() throws IOException {
-        InputStream is = classLoader.getResourceAsStream(path);
-        if (is == null) {
-            throw new IOException("class path resource [" + path + "] cannot be opened");
-        }
-        return is;
-    }
-
-    @Override
-    public boolean exists() {
-        return classLoader.getResource(path) != null;
-    }
-
-    @Override
-    public String getFilename() {
-        int sep = path.lastIndexOf('/');
-        return sep != -1 ? path.substring(sep + 1) : path;
-    }
-
-    @Override
-    public long contentLength() throws IOException {
-        try (InputStream is = getInputStream()) {
-            long count = 0;
-            byte[] buf = new byte[8192];
-            int read;
-            while ((read = is.read(buf)) != -1) {
-                count += read;
-            }
-            return count;
-        }
-    }
-
-    @Override
-    public File getFile() throws IOException {
-        URL url = classLoader.getResource(path);
-        if (url == null || !"file".equals(url.getProtocol())) {
-            throw new IOException("class path resource [" + path + "] is not a filesystem file");
-        }
-        return new File(url.getFile());
-    }
-}

app/common/src/main/java/stirling/software/common/model/io/FileSystemResource.java

@@ -1,56 +0,0 @@
-package stirling.software.common.model.io;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-/** File-backed {@link Resource} (migration shim for Spring's {@code FileSystemResource}). */
-public class FileSystemResource implements Resource {
-
-    private final Path path;
-
-    public FileSystemResource(Path path) {
-        this.path = path;
-    }
-
-    public FileSystemResource(File file) {
-        this.path = file.toPath();
-    }
-
-    public FileSystemResource(String path) {
-        this.path = Path.of(path);
-    }
-
-    @Override
-    public InputStream getInputStream() throws IOException {
-        return Files.newInputStream(path);
-    }
-
-    @Override
-    public boolean exists() {
-        return Files.exists(path);
-    }
-
-    @Override
-    public String getFilename() {
-        Path name = path.getFileName();
-        return name == null ? null : name.toString();
-    }
-
-    @Override
-    public long contentLength() throws IOException {
-        return Files.size(path);
-    }
-
-    @Override
-    public boolean isFile() {
-        return true;
-    }
-
-    @Override
-    public File getFile() {
-        return path.toFile();
-    }
-}

app/common/src/main/java/stirling/software/common/model/io/InputStreamResource.java

@@ -1,50 +0,0 @@
-package stirling.software.common.model.io;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-
-/**
- * Stream-backed {@link Resource} (migration shim for Spring's {@code InputStreamResource}). As with
- * Spring, the stream can only be read once.
- */
-public class InputStreamResource implements Resource {
-
-    private final InputStream inputStream;
-    private final String filename;
-
-    public InputStreamResource(InputStream inputStream) {
-        this(inputStream, null);
-    }
-
-    public InputStreamResource(InputStream inputStream, String filename) {
-        this.inputStream = inputStream;
-        this.filename = filename;
-    }
-
-    @Override
-    public InputStream getInputStream() {
-        return inputStream;
-    }
-
-    @Override
-    public boolean exists() {
-        return true;
-    }
-
-    @Override
-    public String getFilename() {
-        return filename;
-    }
-
-    @Override
-    public long contentLength() throws IOException {
-        // Spring's InputStreamResource also cannot report length without consuming the stream.
-        return -1;
-    }
-
-    @Override
-    public File getFile() throws IOException {
-        throw new IOException("InputStreamResource is not backed by a file");
-    }
-}

app/common/src/main/java/stirling/software/common/model/io/Resource.java

@@ -1,40 +0,0 @@
-package stirling.software.common.model.io;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-
-/**
- * Migration compatibility shim for Spring's {@code org.springframework.core.io.Resource}.
- *
- * <p>Quarkus/Jakarta has no single {@code Resource} abstraction. Rather than rewrite the many
- * public method signatures across the codebase that accept or return {@code Resource}, this
- * interface mirrors the subset of Spring's API the codebase actually uses ({@code
- * getInputStream/exists/getFile/getFilename/contentLength/isFile}) together with the {@link
- * FileSystemResource}, {@link InputStreamResource} and {@link ClassPathResource} implementations.
- * Converting a file is then just an import swap.
- *
- * <p>TODO: Migration required - longer term, prefer {@code java.nio.file.Path} / {@code
- * InputStream} directly at the boundaries and retire this shim.
- */
-public interface Resource {
-
-    InputStream getInputStream() throws IOException;
-
-    boolean exists();
-
-    String getFilename();
-
-    long contentLength() throws IOException;
-
-    /** Whether this resource is backed by a real file in the filesystem. */
-    default boolean isFile() {
-        return false;
-    }
-
-    /**
-     * @return the underlying file.
-     * @throws IOException if the resource is not file-backed.
-     */
-    File getFile() throws IOException;
-}

app/common/src/main/java/stirling/software/common/model/multipart/ByteArrayMultipartFile.java

@@ -1,68 +0,0 @@
-package stirling.software.common.model.multipart;
-
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
-
-import stirling.software.common.model.MultipartFile;
-import stirling.software.common.model.io.InputStreamResource;
-import stirling.software.common.model.io.Resource;
-
-/**
- * In-memory {@link MultipartFile} backed by a byte array. Useful for tests and for code paths that
- * synthesize file content (migration shim - see {@link MultipartFile}).
- */
-public class ByteArrayMultipartFile implements MultipartFile {
-
-    private final String name;
-    private final String originalFilename;
-    private final String contentType;
-    private final byte[] content;
-
-    public ByteArrayMultipartFile(
-            String name, String originalFilename, String contentType, byte[] content) {
-        this.name = name;
-        this.originalFilename = originalFilename;
-        this.contentType = contentType;
-        this.content = content != null ? content : new byte[0];
-    }
-
-    @Override
-    public String getName() {
-        return name;
-    }
-
-    @Override
-    public String getOriginalFilename() {
-        return originalFilename;
-    }
-
-    @Override
-    public String getContentType() {
-        return contentType;
-    }
-
-    @Override
-    public boolean isEmpty() {
-        return content.length == 0;
-    }
-
-    @Override
-    public long getSize() {
-        return content.length;
-    }
-
-    @Override
-    public byte[] getBytes() {
-        return content;
-    }
-
-    @Override
-    public InputStream getInputStream() {
-        return new ByteArrayInputStream(content);
-    }
-
-    @Override
-    public Resource getResource() {
-        return new InputStreamResource(new ByteArrayInputStream(content), originalFilename);
-    }
-}

app/common/src/main/java/stirling/software/common/model/multipart/FileUploadMultipartFile.java

@@ -1,108 +0,0 @@
-package stirling.software.common.model.multipart;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-
-import org.jboss.resteasy.reactive.multipart.FileUpload;
-
-import stirling.software.common.model.MultipartFile;
-import stirling.software.common.model.io.FileSystemResource;
-import stirling.software.common.model.io.Resource;
-
-/**
- * Adapts a Quarkus REST {@link FileUpload} (the inbound multipart representation at the JAX-RS
- * boundary) to the {@link MultipartFile} migration shim, so controllers can pass uploads down to
- * the existing service layer without changing its method signatures.
- */
-public class FileUploadMultipartFile implements MultipartFile {
-
-    private final FileUpload delegate;
-
-    public FileUploadMultipartFile(FileUpload delegate) {
-        this.delegate = delegate;
-    }
-
-    /** Null-safe factory: returns null when the upload is absent. */
-    public static MultipartFile of(FileUpload upload) {
-        return upload == null ? null : new FileUploadMultipartFile(upload);
-    }
-
-    /**
-     * Null-safe factory for a multipart field that may have multiple parts under the same name.
-     *
-     * <p>Spring's MultipartFile binding picked the actual file part even when a client also sent a
-     * plain text form field of the same name; RESTEasy Reactive's {@code @RestForm FileUpload}
-     * binds the <em>first</em> part by name instead, so a stray {@code name=value} text part sent
-     * before the file would shadow the upload. Prefer the part that carries a real filename (the
-     * file), falling back to the last part, so such requests bind the same way they did under
-     * Spring.
-     */
-    public static MultipartFile of(List<FileUpload> uploads) {
-        if (uploads == null || uploads.isEmpty()) {
-            return null;
-        }
-        FileUpload chosen = null;
-        for (FileUpload upload : uploads) {
-            if (upload.fileName() != null && !upload.fileName().isBlank()) {
-                chosen = upload;
-                break;
-            }
-        }
-        if (chosen == null) {
-            chosen = uploads.get(uploads.size() - 1);
-        }
-        return new FileUploadMultipartFile(chosen);
-    }
-
-    @Override
-    public String getName() {
-        return delegate.name();
-    }
-
-    @Override
-    public String getOriginalFilename() {
-        return delegate.fileName();
-    }
-
-    @Override
-    public String getContentType() {
-        return delegate.contentType();
-    }
-
-    @Override
-    public boolean isEmpty() {
-        return getSize() == 0;
-    }
-
-    @Override
-    public long getSize() {
-        return delegate.size();
-    }
-
-    @Override
-    public byte[] getBytes() throws IOException {
-        return Files.readAllBytes(delegate.uploadedFile());
-    }
-
-    @Override
-    public InputStream getInputStream() throws IOException {
-        return Files.newInputStream(delegate.uploadedFile());
-    }
-
-    @Override
-    public Resource getResource() {
-        // File-backed: enables FileStorage's zero-copy fast path.
-        return new FileSystemResource(delegate.uploadedFile());
-    }
-
-    @Override
-    public void transferTo(Path dest) throws IOException {
-        // Overwrite semantics like Spring's MultipartFile#transferTo; callers often pass a
-        // Files.createTempFile(...) path that already exists, so REPLACE_EXISTING is required.
-        Files.copy(
-                delegate.uploadedFile(), dest, java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-    }
-}

app/common/src/main/java/stirling/software/common/security/AbstractAuthenticationToken.java

@@ -1,70 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.authentication.AbstractAuthenticationToken}.
- *
- * <p>Base implementation of {@link Authentication} holding authorities, details and an
- * authenticated flag.
- */
-public abstract class AbstractAuthenticationToken implements Authentication {
-
-    private final List<GrantedAuthority> authorities;
-    private Object details;
-    private boolean authenticated = false;
-
-    protected AbstractAuthenticationToken(Collection<? extends GrantedAuthority> authorities) {
-        if (authorities == null) {
-            this.authorities = Collections.emptyList();
-        } else {
-            List<GrantedAuthority> copy = new ArrayList<>(authorities.size());
-            for (GrantedAuthority authority : authorities) {
-                copy.add(authority);
-            }
-            this.authorities = Collections.unmodifiableList(copy);
-        }
-    }
-
-    @Override
-    public Collection<? extends GrantedAuthority> getAuthorities() {
-        return authorities;
-    }
-
-    @Override
-    public Object getCredentials() {
-        return null;
-    }
-
-    @Override
-    public Object getDetails() {
-        return details;
-    }
-
-    public void setDetails(Object details) {
-        this.details = details;
-    }
-
-    @Override
-    public boolean isAuthenticated() {
-        return authenticated;
-    }
-
-    @Override
-    public void setAuthenticated(boolean authenticated) throws IllegalArgumentException {
-        this.authenticated = authenticated;
-    }
-
-    @Override
-    public String getName() {
-        Object principal = getPrincipal();
-        if (principal instanceof UserDetails) {
-            return ((UserDetails) principal).getUsername();
-        }
-        return principal == null ? null : principal.toString();
-    }
-}

app/common/src/main/java/stirling/software/common/security/Authentication.java

@@ -1,28 +0,0 @@
-package stirling.software.common.security;
-
-import java.security.Principal;
-import java.util.Collection;
-
-/**
- * Migration compatibility shim for {@code org.springframework.security.core.Authentication}.
- *
- * <p>Represents the token for an authentication request or for an authenticated principal once the
- * request has been processed.
- */
-public interface Authentication extends Principal {
-
-    Collection<? extends GrantedAuthority> getAuthorities();
-
-    Object getCredentials();
-
-    Object getDetails();
-
-    Object getPrincipal();
-
-    boolean isAuthenticated();
-
-    void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
-
-    @Override
-    String getName();
-}

app/common/src/main/java/stirling/software/common/security/AuthenticationException.java

@@ -1,19 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.AuthenticationException}.
- *
- * <p>Abstract superclass for all exceptions related to an {@link Authentication} object being
- * invalid for whatever reason.
- */
-public class AuthenticationException extends RuntimeException {
-
-    public AuthenticationException(String msg) {
-        super(msg);
-    }
-
-    public AuthenticationException(String msg, Throwable cause) {
-        super(msg, cause);
-    }
-}

app/common/src/main/java/stirling/software/common/security/BCryptPasswordEncoder.java

@@ -1,45 +0,0 @@
-package stirling.software.common.security;
-
-import at.favre.lib.crypto.bcrypt.BCrypt;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder}.
- *
- * <p>Implementation of {@link PasswordEncoder} backed by the {@code at.favre.lib:bcrypt} library.
- */
-public class BCryptPasswordEncoder implements PasswordEncoder {
-
-    private static final int DEFAULT_STRENGTH = 10;
-
-    private final int strength;
-
-    public BCryptPasswordEncoder() {
-        this(DEFAULT_STRENGTH);
-    }
-
-    public BCryptPasswordEncoder(int strength) {
-        this.strength = strength;
-    }
-
-    @Override
-    public String encode(CharSequence rawPassword) {
-        if (rawPassword == null) {
-            throw new IllegalArgumentException("rawPassword cannot be null");
-        }
-        return BCrypt.withDefaults().hashToString(strength, rawPassword.toString().toCharArray());
-    }
-
-    @Override
-    public boolean matches(CharSequence rawPassword, String encodedPassword) {
-        if (rawPassword == null) {
-            throw new IllegalArgumentException("rawPassword cannot be null");
-        }
-        if (encodedPassword == null || encodedPassword.isEmpty()) {
-            return false;
-        }
-        return BCrypt.verifyer()
-                .verify(rawPassword.toString().toCharArray(), encodedPassword)
-                .verified;
-    }
-}

app/common/src/main/java/stirling/software/common/security/BadCredentialsException.java

@@ -1,18 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.authentication.BadCredentialsException}.
- *
- * <p>Thrown if an authentication request is rejected because the credentials are invalid.
- */
-public class BadCredentialsException extends AuthenticationException {
-
-    public BadCredentialsException(String msg) {
-        super(msg);
-    }
-
-    public BadCredentialsException(String msg, Throwable cause) {
-        super(msg, cause);
-    }
-}

app/common/src/main/java/stirling/software/common/security/GrantedAuthority.java

@@ -1,17 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code org.springframework.security.core.GrantedAuthority}.
- *
- * <p>Represents an authority granted to an {@link Authentication} object. Provided so that code
- * migrated from Spring Boot to Quarkus compiles without Spring Security on the classpath.
- */
-public interface GrantedAuthority {
-
-    /**
-     * Returns a textual representation of the granted authority.
-     *
-     * @return the authority string, never {@code null}
-     */
-    String getAuthority();
-}

app/common/src/main/java/stirling/software/common/security/OAuth2User.java

@@ -1,20 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Collection;
-import java.util.Map;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.oauth2.core.user.OAuth2User}.
- *
- * <p>Represents a user {@link java.security.Principal} authenticated using OAuth 2.0 or OpenID
- * Connect.
- */
-public interface OAuth2User {
-
-    Map<String, Object> getAttributes();
-
-    Collection<? extends GrantedAuthority> getAuthorities();
-
-    String getName();
-}

app/common/src/main/java/stirling/software/common/security/PasswordEncoder.java

@@ -1,16 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.crypto.password.PasswordEncoder}.
- *
- * <p>Service interface for encoding passwords.
- */
-public interface PasswordEncoder {
-
-    /** Encodes the raw password. */
-    String encode(CharSequence rawPassword);
-
-    /** Verifies that the encoded password matches the raw password after it too is encoded. */
-    boolean matches(CharSequence rawPassword, String encodedPassword);
-}

app/common/src/main/java/stirling/software/common/security/PersistentRememberMeToken.java

@@ -1,40 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Date;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.web.authentication.rememberme.PersistentRememberMeToken}.
- *
- * <p>Holds the persistent remember-me token data for a single series.
- */
-public class PersistentRememberMeToken {
-
-    private final String username;
-    private final String series;
-    private final String tokenValue;
-    private final Date date;
-
-    public PersistentRememberMeToken(String username, String series, String tokenValue, Date date) {
-        this.username = username;
-        this.series = series;
-        this.tokenValue = tokenValue;
-        this.date = date;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public String getSeries() {
-        return series;
-    }
-
-    public String getTokenValue() {
-        return tokenValue;
-    }
-
-    public Date getDate() {
-        return date;
-    }
-}

app/common/src/main/java/stirling/software/common/security/PersistentTokenRepository.java

@@ -1,20 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Date;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.web.authentication.rememberme.PersistentTokenRepository}.
- *
- * <p>Persists the remember-me tokens used by the persistent token based remember-me services.
- */
-public interface PersistentTokenRepository {
-
-    void createNewToken(PersistentRememberMeToken token);
-
-    void updateToken(String series, String tokenValue, Date lastUsed);
-
-    PersistentRememberMeToken getTokenForSeries(String seriesId);
-
-    void removeUserTokens(String username);
-}

app/common/src/main/java/stirling/software/common/security/SecurityContext.java

@@ -1,14 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.context.SecurityContext}.
- *
- * <p>Holds the {@link Authentication} associated with the current execution.
- */
-public interface SecurityContext {
-
-    Authentication getAuthentication();
-
-    void setAuthentication(Authentication authentication);
-}

app/common/src/main/java/stirling/software/common/security/SecurityContextHolder.java

@@ -1,37 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.context.SecurityContextHolder}.
- *
- * <p>Associates a {@link SecurityContext} with the current thread of execution using a {@link
- * ThreadLocal}.
- */
-public final class SecurityContextHolder {
-
-    private static final ThreadLocal<SecurityContext> CONTEXT_HOLDER = new ThreadLocal<>();
-
-    private SecurityContextHolder() {}
-
-    /** Returns the context for the current thread, creating an empty one if none is set. */
-    public static SecurityContext getContext() {
-        SecurityContext context = CONTEXT_HOLDER.get();
-        if (context == null) {
-            context = createEmptyContext();
-            CONTEXT_HOLDER.set(context);
-        }
-        return context;
-    }
-
-    public static void setContext(SecurityContext context) {
-        CONTEXT_HOLDER.set(context);
-    }
-
-    public static void clearContext() {
-        CONTEXT_HOLDER.remove();
-    }
-
-    public static SecurityContext createEmptyContext() {
-        return new SecurityContextImpl();
-    }
-}

app/common/src/main/java/stirling/software/common/security/SecurityContextImpl.java

@@ -1,28 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.context.SecurityContextImpl}.
- *
- * <p>Basic concrete implementation of {@link SecurityContext}.
- */
-public class SecurityContextImpl implements SecurityContext {
-
-    private Authentication authentication;
-
-    public SecurityContextImpl() {}
-
-    public SecurityContextImpl(Authentication authentication) {
-        this.authentication = authentication;
-    }
-
-    @Override
-    public Authentication getAuthentication() {
-        return authentication;
-    }
-
-    @Override
-    public void setAuthentication(Authentication authentication) {
-        this.authentication = authentication;
-    }
-}

app/common/src/main/java/stirling/software/common/security/SessionInformation.java

@@ -1,47 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Date;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.session.SessionInformation}.
- *
- * <p>Represents a record of a session within the application's session registry.
- */
-public class SessionInformation {
-
-    private final Object principal;
-    private final String sessionId;
-    private Date lastRequest;
-    private boolean expired = false;
-
-    public SessionInformation(Object principal, String sessionId, Date lastRequest) {
-        this.principal = principal;
-        this.sessionId = sessionId;
-        this.lastRequest = lastRequest;
-    }
-
-    public Object getPrincipal() {
-        return principal;
-    }
-
-    public String getSessionId() {
-        return sessionId;
-    }
-
-    public Date getLastRequest() {
-        return lastRequest;
-    }
-
-    public boolean isExpired() {
-        return expired;
-    }
-
-    public void expireNow() {
-        this.expired = true;
-    }
-
-    public void refreshLastRequest() {
-        this.lastRequest = new Date();
-    }
-}

app/common/src/main/java/stirling/software/common/security/SessionRegistry.java

@@ -1,24 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.List;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.session.SessionRegistry}.
- *
- * <p>Maintains a registry of currently known principals and their sessions.
- */
-public interface SessionRegistry {
-
-    List<Object> getAllPrincipals();
-
-    List<SessionInformation> getAllSessions(Object principal, boolean includeExpiredSessions);
-
-    SessionInformation getSessionInformation(String sessionId);
-
-    void refreshLastRequest(String sessionId);
-
-    void registerNewSession(String sessionId, Object principal);
-
-    void removeSessionInformation(String sessionId);
-}

app/common/src/main/java/stirling/software/common/security/SimpleGrantedAuthority.java

@@ -1,45 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Objects;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.authority.SimpleGrantedAuthority}.
- *
- * <p>A basic, immutable {@link GrantedAuthority} backed by a single string.
- */
-public class SimpleGrantedAuthority implements GrantedAuthority {
-
-    private final String authority;
-
-    public SimpleGrantedAuthority(String authority) {
-        this.authority = authority;
-    }
-
-    @Override
-    public String getAuthority() {
-        return authority;
-    }
-
-    @Override
-    public boolean equals(Object obj) {
-        if (this == obj) {
-            return true;
-        }
-        if (!(obj instanceof SimpleGrantedAuthority)) {
-            return false;
-        }
-        SimpleGrantedAuthority other = (SimpleGrantedAuthority) obj;
-        return Objects.equals(authority, other.authority);
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hashCode(authority);
-    }
-
-    @Override
-    public String toString() {
-        return authority;
-    }
-}

app/common/src/main/java/stirling/software/common/security/UserDetails.java

@@ -1,26 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Collection;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.userdetails.UserDetails}.
- *
- * <p>Provides core user information used by the authentication layer.
- */
-public interface UserDetails {
-
-    Collection<? extends GrantedAuthority> getAuthorities();
-
-    String getPassword();
-
-    String getUsername();
-
-    boolean isAccountNonExpired();
-
-    boolean isAccountNonLocked();
-
-    boolean isCredentialsNonExpired();
-
-    boolean isEnabled();
-}

app/common/src/main/java/stirling/software/common/security/UserDetailsService.java

@@ -1,19 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.userdetails.UserDetailsService}.
- *
- * <p>Loads user-specific data, typically as part of an authentication flow.
- */
-public interface UserDetailsService {
-
-    /**
-     * Locates the user based on the username.
-     *
-     * @param username the username identifying the user whose data is required
-     * @return a fully populated user record, never {@code null}
-     * @throws UsernameNotFoundException if the user could not be found
-     */
-    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
-}

app/common/src/main/java/stirling/software/common/security/UsernameNotFoundException.java

@@ -1,18 +0,0 @@
-package stirling.software.common.security;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.core.userdetails.UsernameNotFoundException}.
- *
- * <p>Thrown if a {@link UserDetailsService} implementation cannot locate a user by its username.
- */
-public class UsernameNotFoundException extends AuthenticationException {
-
-    public UsernameNotFoundException(String msg) {
-        super(msg);
-    }
-
-    public UsernameNotFoundException(String msg, Throwable cause) {
-        super(msg, cause);
-    }
-}

app/common/src/main/java/stirling/software/common/security/UsernamePasswordAuthenticationToken.java

@@ -1,67 +0,0 @@
-package stirling.software.common.security;
-
-import java.util.Collection;
-
-/**
- * Migration compatibility shim for {@code
- * org.springframework.security.authentication.UsernamePasswordAuthenticationToken}.
- *
- * <p>An {@link Authentication} implementation designed for simple presentation of a username and
- * password.
- */
-public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationToken {
-
-    private final Object principal;
-    private Object credentials;
-
-    /** Creates an unauthenticated token (typically used as an authentication request). */
-    public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
-        super(null);
-        this.principal = principal;
-        this.credentials = credentials;
-        setAuthenticated(false);
-    }
-
-    /** Creates an authenticated token (typically the result of a successful authentication). */
-    public UsernamePasswordAuthenticationToken(
-            Object principal,
-            Object credentials,
-            Collection<? extends GrantedAuthority> authorities) {
-        super(authorities);
-        this.principal = principal;
-        this.credentials = credentials;
-        super.setAuthenticated(true);
-    }
-
-    /** Factory method mirroring Spring Security 6 for creating an unauthenticated token. */
-    public static UsernamePasswordAuthenticationToken unauthenticated(
-            Object principal, Object credentials) {
-        return new UsernamePasswordAuthenticationToken(principal, credentials);
-    }
-
-    /** Factory method mirroring Spring Security 6 for creating an authenticated token. */
-    public static UsernamePasswordAuthenticationToken authenticated(
-            Object principal,
-            Object credentials,
-            Collection<? extends GrantedAuthority> authorities) {
-        return new UsernamePasswordAuthenticationToken(principal, credentials, authorities);
-    }
-
-    @Override
-    public Object getCredentials() {
-        return credentials;
-    }
-
-    @Override
-    public Object getPrincipal() {
-        return principal;
-    }
-
-    @Override
-    public String getName() {
-        if (principal instanceof UserDetails) {
-            return ((UserDetails) principal).getUsername();
-        }
-        return principal == null ? null : principal.toString();
-    }
-}

app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java

@@ -24,18 +24,17 @@ import org.apache.pdfbox.io.RandomAccessReadBufferedFile;
 import org.apache.pdfbox.io.RandomAccessStreamCache.StreamCacheCreateFunction;
 import org.apache.pdfbox.io.ScratchFile;
 import org.apache.pdfbox.pdmodel.PDDocument;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.inject.Inject;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+import org.springframework.web.multipart.MultipartFile;
 
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.model.MultipartFile;
 import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.TempFileManager;
 
-@ApplicationScoped
+@Component
 @Slf4j
 public class CustomPDFDocumentFactory {
 
@@ -45,8 +44,8 @@ public class CustomPDFDocumentFactory {
     // class without a full Spring context. When null, falls back to Files.createTempFile().
     private final TempFileManager tempFileManager;
 
-    /** Primary constructor used by CDI. Both collaborators are required in production. */
-    @Inject
+    /** Primary constructor used by Spring. Both collaborators are required in production. */
+    @Autowired
     public CustomPDFDocumentFactory(
             PdfMetadataService pdfMetadataService, TempFileManager tempFileManager) {
         this.pdfMetadataService = pdfMetadataService;

app/common/src/main/java/stirling/software/common/service/FileOrUploadService.java

@@ -4,20 +4,18 @@ import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.nio.file.*;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
 
 import lombok.RequiredArgsConstructor;
 
-import stirling.software.common.model.MultipartFile;
-
-@ApplicationScoped
+@Service
 @RequiredArgsConstructor
 public class FileOrUploadService {
 
-    @ConfigProperty(name = "stirling.tempDir", defaultValue = "/tmp/stirling-files")
-    String tempDirPath;
+    @Value("${stirling.tempDir:/tmp/stirling-files}")
+    private String tempDirPath;
 
     public Path resolveFilePath(String fileId) {
         return Path.of(tempDirPath).resolve(fileId);

app/common/src/main/java/stirling/software/common/service/FileStorage.java

@@ -9,23 +9,22 @@ import java.util.Optional;
 import java.util.concurrent.Executors;
 import java.util.concurrent.atomic.AtomicReference;
 
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Instance;
-import jakarta.ws.rs.core.StreamingOutput;
+import org.springframework.core.io.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.cluster.FileStore;
-import stirling.software.common.model.MultipartFile;
-import stirling.software.common.model.io.Resource;
 import stirling.software.common.util.JobContext;
 
 /**
  * Service for storing and retrieving files with unique file IDs. Used by the AutoJobPostMapping
  * system to handle file references. Disk I/O is delegated to the injected {@link FileStore} bean.
  */
-@ApplicationScoped
+@Service
 @RequiredArgsConstructor
 @Slf4j
 public class FileStorage {
@@ -35,12 +34,7 @@ public class FileStorage {
 
     private final FileOrUploadService fileOrUploadService;
     private final FileStore fileStore;
-
-    // MIGRATION: CDI does not inject java.util.Optional<T>. Optional<JobOwnershipService> is now
-    // jakarta.enterprise.inject.Instance<JobOwnershipService>, resolved via isResolvable()/get().
-    // Exactly one JobOwnershipService impl is selected at build time (Impl vs NoOp), so this is
-    // always resolvable in practice, but Instance<> keeps the previous optional contract.
-    private final Instance<JobOwnershipService> jobOwnershipService;
+    private final Optional<JobOwnershipService> jobOwnershipService;
 
     public String storeFile(MultipartFile file) throws IOException {
         String owner = resolveOwner();
@@ -103,7 +97,7 @@ public class FileStorage {
         return new StoredFile(stored.fileId(), stored.size());
     }
 
-    public String storeFromStreamingBody(StreamingOutput body, String originalName)
+    public String storeFromStreamingBody(StreamingResponseBody body, String originalName)
             throws IOException {
         String owner = resolveOwner();
         // Hold Throwable not IOException: an unchecked failure (NPE, IllegalState, OOM, etc.)
@@ -119,7 +113,7 @@ public class FileStorage {
                         executor.submit(
                                 () -> {
                                     try {
-                                        body.write(out);
+                                        body.writeTo(out);
                                     } catch (Throwable ex) {
                                         bodyError.set(ex);
                                     } finally {
@@ -148,9 +142,10 @@ public class FileStorage {
                         throw ioe;
                     }
                     throw new IOException(
-                            "StreamingOutput writer failed: " + writerErr.getMessage(), writerErr);
+                            "StreamingResponseBody writer failed: " + writerErr.getMessage(),
+                            writerErr);
                 }
-                log.debug("Stored StreamingOutput with ID: {}", stored.fileId());
+                log.debug("Stored StreamingResponseBody with ID: {}", stored.fileId());
                 return stored.fileId();
             } finally {
                 // Interrupt and join the writer task: shutdown() alone returns immediately and a
@@ -199,14 +194,11 @@ public class FileStorage {
         if (propagated != null) {
             return propagated;
         }
-        if (!jobOwnershipService.isResolvable()) {
-            return null;
-        }
-        return jobOwnershipService.get().getCurrentUserId().orElse(null);
+        return jobOwnershipService.flatMap(JobOwnershipService::getCurrentUserId).orElse(null);
     }
 
     private void enforceOwnership(String fileId) {
-        if (!jobOwnershipService.isResolvable()) {
+        if (jobOwnershipService.isEmpty()) {
             return;
         }
         Optional<String> currentUser = jobOwnershipService.get().getCurrentUserId();

app/common/src/main/java/stirling/software/common/service/InternalApiClient.java

@@ -1,36 +1,31 @@
 package stirling.software.common.service;
 
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.io.UncheckedIOException;
-import java.net.ConnectException;
-import java.net.URI;
 import java.net.URLDecoder;
-import java.net.http.HttpClient;
-import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
-import java.net.http.HttpTimeoutException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.time.Duration;
-import java.util.List;
-import java.util.Map;
 import java.util.regex.Pattern;
 
-import org.eclipse.microprofile.config.Config;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.env.Environment;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.*;
+import org.springframework.http.client.SimpleClientHttpRequestFactory;
+import org.springframework.stereotype.Service;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RequestCallback;
+import org.springframework.web.client.ResourceAccessException;
+import org.springframework.web.client.RestTemplate;
 
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Instance;
 import jakarta.servlet.ServletContext;
-import jakarta.ws.rs.core.Response;
 
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.enumeration.Role;
-import stirling.software.common.model.io.FileSystemResource;
-import stirling.software.common.model.io.Resource;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 
@@ -38,21 +33,14 @@ import stirling.software.common.util.TempFileManager;
  * Dispatches HTTP POST requests to internal Stirling API endpoints via loopback. Used by
  * PipelineProcessor and AiWorkflowService to execute tool operations programmatically without
  * leaving the JVM network stack.
- *
- * <p>MIGRATION (Spring -> Quarkus): the HTTP dispatch was rebuilt on {@link
- * java.net.http.HttpClient} (replacing Spring's {@code RestTemplate}/{@code
- * SimpleClientHttpRequestFactory}). The multipart body is encoded manually; {@code
- * MultiValueMap<String,Object>} became {@code Map<String,List<Object>>} and {@code
- * ResponseEntity<Resource>} became {@link Response}. {@code ResourceAccessException} timeout
- * handling is now driven by {@link HttpTimeoutException}.
  */
-@ApplicationScoped
+@Service
 @Slf4j
 public class InternalApiClient {
 
     // Allowlist for internal dispatch. Matches fixed namespace prefixes,
     // but rejects traversal (..), URL-encoding (%), query/fragment, backslashes, and any other
-    // character that could alter the resolved endpoint on the local server.
+    // character that could alter the resolved endpoint on the local Spring server.
     //
     // The second alternation carves out `/api/v1/ai/tools/*` specifically — AI tools are
     // dispatchable, but the broader `/api/v1/ai/` surface (orchestrate, health, etc.) is
@@ -75,30 +63,30 @@ public class InternalApiClient {
     private final ServletContext servletContext;
     private final UserServiceInterface userService;
     private final TempFileManager tempFileManager;
-    private final Config config;
+    private final Environment environment;
     private final Duration readTimeout;
-    private final HttpClient httpClient;
+    private final RestTemplate restTemplate;
 
     public InternalApiClient(
             ServletContext servletContext,
-            Instance<UserServiceInterface> userService,
+            @Autowired(required = false) UserServiceInterface userService,
             TempFileManager tempFileManager,
-            Config config,
+            Environment environment,
             ApplicationProperties applicationProperties) {
         this.servletContext = servletContext;
-        this.userService = userService.isResolvable() ? userService.get() : null;
+        this.userService = userService;
         this.tempFileManager = tempFileManager;
-        this.config = config;
+        this.environment = environment;
         ApplicationProperties.InternalApi internalApi = applicationProperties.getInternalApi();
         // A bounded read timeout is what protects the workflow when an internal tool hangs
         // (e.g. an infinite loop in a PDF processing service). The connect timeout is short
         // because this is a loopback call; if connecting takes longer than a few seconds the
         // local server is itself unhealthy.
         this.readTimeout = Duration.ofSeconds(internalApi.getReadTimeoutSeconds());
-        this.httpClient =
-                HttpClient.newBuilder()
-                        .connectTimeout(Duration.ofSeconds(internalApi.getConnectTimeoutSeconds()))
-                        .build();
+        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
+        factory.setConnectTimeout(Duration.ofSeconds(internalApi.getConnectTimeoutSeconds()));
+        factory.setReadTimeout(readTimeout);
+        this.restTemplate = new RestTemplate(factory);
     }
 
     /**
@@ -106,110 +94,78 @@ public class InternalApiClient {
      * prefixes (e.g. {@code /api/v1/misc/compress-pdf}).
      *
      * @param endpointPath API path (e.g. {@code /api/v1/general/rotate-pdf})
-     * @param body multipart form body (fileInput + parameters): each value is either a {@link
-     *     Resource} (file part) or a {@code String} (form field)
-     * @return JAX-RS {@link Response} with the result file as a {@link TempFileResource} entity
+     * @param body multipart form body (fileInput + parameters)
+     * @return response with the result file as a {@link TempFileResource} body
      */
-    public Response post(String endpointPath, Map<String, List<Object>> body) {
+    public ResponseEntity<Resource> post(String endpointPath, MultiValueMap<String, Object> body) {
         validateUrl(endpointPath);
         String url = getBaseUrl() + endpointPath;
 
-        String boundary = "----StirlingBoundary" + Long.toHexString(System.nanoTime());
-        byte[] multipartBody = encodeMultipart(body, boundary);
-
-        HttpRequest.Builder requestBuilder =
-                HttpRequest.newBuilder()
-                        .uri(URI.create(url))
-                        .timeout(readTimeout)
-                        .header("Content-Type", "multipart/form-data; boundary=" + boundary)
-                        .POST(HttpRequest.BodyPublishers.ofByteArray(multipartBody));
-
+        HttpHeaders headers = new HttpHeaders();
         String apiKey = getApiKeyForUser();
         if (apiKey != null && !apiKey.isEmpty()) {
-            requestBuilder.header("X-API-KEY", apiKey);
+            headers.add("X-API-KEY", apiKey);
         }
         // Tag the sub-step as automation so PAYG bills it under AUTOMATION regardless of which
         // tool-level @RequiresFeature annotation the dispatched controller carries (e.g. an AI-OCR
         // step inside a policy run must bill as AUTOMATION, not AI). Set unconditionally because
         // every caller of this dispatcher is an automation surface by design.
-        requestBuilder.header(AUTOMATION_HEADER, "true");
+        headers.add(AUTOMATION_HEADER, "true");
 
-        try {
-            HttpResponse<InputStream> response =
-                    httpClient.send(
-                            requestBuilder.build(), HttpResponse.BodyHandlers.ofInputStream());
-            try (InputStream responseBody = response.body()) {
-                TempFile tempFile = tempFileManager.createManagedTempFile("internal-api");
-                Files.copy(
-                        responseBody,
-                        tempFile.getPath(),
-                        java.nio.file.StandardCopyOption.REPLACE_EXISTING);
-                String filename =
-                        extractFilename(
-                                response.headers().firstValue("Content-Disposition").orElse(null));
-                TempFileResource resource = new TempFileResource(tempFile, filename);
-                Response.ResponseBuilder rb =
-                        Response.status(response.statusCode()).entity(resource);
-                response.headers().map().forEach((k, vs) -> vs.forEach(v -> rb.header(k, v)));
-                return rb.build();
-            }
-        } catch (HttpTimeoutException e) {
-            throw new InternalApiTimeoutException(endpointPath, readTimeout, e);
-        } catch (ConnectException e) {
-            throw new UncheckedIOException(new IOException("Internal API connection failed", e));
-        } catch (IOException e) {
-            throw new UncheckedIOException(e);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            throw new RuntimeException("Internal API dispatch interrupted", e);
+        // A no-file ai/tools call (e.g. create-pdf-from-html-agent) sends only string params, so
+        // without this RestTemplate would use urlencoded instead of the multipart the controller
+        // expects. File-bearing calls get the right multipart content-type from RestTemplate.
+        boolean isAiTool = endpointPath.startsWith("/api/v1/ai/tools/");
+        boolean hasFilePart =
+                body.values().stream()
+                        .flatMap(java.util.List::stream)
+                        .anyMatch(v -> v instanceof Resource);
+        if (isAiTool && !hasFilePart) {
+            headers.setContentType(MediaType.MULTIPART_FORM_DATA);
         }
-    }
+        HttpEntity<MultiValueMap<String, Object>> entity = new HttpEntity<>(body, headers);
+        RequestCallback requestCallback = restTemplate.httpEntityCallback(entity, Resource.class);
 
-    /**
-     * Encode a multipart/form-data body. File parts are {@link Resource}; others are form fields.
-     */
-    private static byte[] encodeMultipart(Map<String, List<Object>> body, String boundary) {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
         try {
-            for (Map.Entry<String, List<Object>> entry : body.entrySet()) {
-                String name = entry.getKey();
-                for (Object value : entry.getValue()) {
-                    baos.write(("--" + boundary + "\r\n").getBytes(StandardCharsets.UTF_8));
-                    if (value instanceof Resource resource) {
-                        String fn = resource.getFilename() != null ? resource.getFilename() : name;
-                        baos.write(
-                                ("Content-Disposition: form-data; name=\""
-                                                + name
-                                                + "\"; filename=\""
-                                                + fn
-                                                + "\"\r\n"
-                                                + "Content-Type: application/octet-stream\r\n\r\n")
-                                        .getBytes(StandardCharsets.UTF_8));
-                        try (InputStream in = resource.getInputStream()) {
-                            in.transferTo(baos);
+            return restTemplate.execute(
+                    url,
+                    HttpMethod.POST,
+                    requestCallback,
+                    response -> {
+                        try {
+                            TempFile tempFile =
+                                    tempFileManager.createManagedTempFile("internal-api");
+                            Files.copy(
+                                    response.getBody(),
+                                    tempFile.getPath(),
+                                    java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                            String filename = extractFilename(response.getHeaders());
+                            TempFileResource resource = new TempFileResource(tempFile, filename);
+                            return ResponseEntity.status(response.getStatusCode())
+                                    .headers(response.getHeaders())
+                                    .body(resource);
+                        } catch (IOException e) {
+                            throw new UncheckedIOException(e);
                         }
-                        baos.write("\r\n".getBytes(StandardCharsets.UTF_8));
-                    } else {
-                        baos.write(
-                                ("Content-Disposition: form-data; name=\"" + name + "\"\r\n\r\n")
-                                        .getBytes(StandardCharsets.UTF_8));
-                        baos.write(String.valueOf(value).getBytes(StandardCharsets.UTF_8));
-                        baos.write("\r\n".getBytes(StandardCharsets.UTF_8));
-                    }
-                }
+                    });
+        } catch (ResourceAccessException e) {
+            // RestTemplate wraps low-level I/O failures in ResourceAccessException. Only the
+            // SocketTimeoutException-rooted case is a real timeout; other I/O failures (connection
+            // refused, DNS, etc.) propagate as-is so the upstream generic handler can describe
+            // them accurately.
+            if (e.getCause() instanceof java.net.SocketTimeoutException) {
+                throw new InternalApiTimeoutException(endpointPath, readTimeout, e);
             }
-            baos.write(("--" + boundary + "--\r\n").getBytes(StandardCharsets.UTF_8));
-        } catch (IOException e) {
-            throw new UncheckedIOException(e);
+            throw e;
         }
-        return baos.toByteArray();
     }
 
     /**
-     * Extract the filename from a {@code Content-Disposition} header value. Returns {@code null} if
-     * the header is missing or has no filename.
+     * Extract the filename from a response's {@code Content-Disposition} header. Returns {@code
+     * null} if the header is missing or has no filename.
      */
-    private static String extractFilename(String contentDisposition) {
+    private static String extractFilename(HttpHeaders headers) {
+        String contentDisposition = headers.getFirst(HttpHeaders.CONTENT_DISPOSITION);
         if (contentDisposition == null || contentDisposition.isBlank()) {
             return null;
         }
@@ -228,13 +184,12 @@ public class InternalApiClient {
     }
 
     private String getBaseUrl() {
-        // Resolve the port lazily so desktop mode dispatches to the actual bound port.
-        // TODO: Migration required - verify Quarkus exposes the bound port via config. Quarkus uses
-        // "quarkus.http.port" and, for random-port test/dev runs, "quarkus.http.test-port"; the old
-        // "local.server.port"/"server.port" keys came from Spring Boot's WebServerInitializedEvent.
-        String port = config.getOptionalValue("quarkus.http.port", String.class).orElse(null);
+        // Resolve the port lazily so desktop mode (server.port=0, OS-assigned) dispatches to the
+        // actual bound port. Spring publishes local.server.port once the web server is up; fall
+        // back to the configured server.port for early calls (tests, non-web contexts).
+        String port = environment.getProperty("local.server.port");
         if (port == null) {
-            port = config.getOptionalValue("server.port", String.class).orElse("8080");
+            port = environment.getProperty("server.port", "8080");
         }
         return "http://localhost:" + port + servletContext.getContextPath();
     }

app/common/src/main/java/stirling/software/common/service/JobExecutorService.java

@@ -9,56 +9,51 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Supplier;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.Resource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Instance;
-import jakarta.ws.rs.core.HttpHeaders;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.StreamingOutput;
+import jakarta.servlet.http.HttpServletRequest;
 
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.model.MultipartFile;
-import stirling.software.common.model.io.Resource;
 import stirling.software.common.model.job.JobResponse;
 import stirling.software.common.util.ExecutorFactory;
 import stirling.software.common.util.RegexPatternUtils;
 
 /** Service for executing jobs asynchronously or synchronously */
-@ApplicationScoped
+@Service
 @Slf4j
 public class JobExecutorService {
 
-    private static final String APPLICATION_PDF_VALUE = "application/pdf";
-
     private final TaskManager taskManager;
     private final FileStorage fileStorage;
-    // Reactive-safe: the undertow HttpServletRequest proxy throws UT000048 on RESTEasy Reactive
-    // worker threads, so the per-request "jobId" attribute is stored on the Vert.x RoutingContext
-    // instead (read back via AutoJobAspect). Off a live request this degrades to a no-op.
-    private final io.quarkus.vertx.http.runtime.CurrentVertxRequest currentVertxRequest;
+    private final HttpServletRequest request;
     private final ResourceMonitor resourceMonitor;
     private final JobQueue jobQueue;
     private final ExecutorService executor = ExecutorFactory.newVirtualThreadExecutor();
     private final long effectiveTimeoutMs;
 
-    @jakarta.inject.Inject Instance<JobOwnershipService> jobOwnershipService;
+    @Autowired(required = false)
+    private JobOwnershipService jobOwnershipService;
 
     public JobExecutorService(
             TaskManager taskManager,
             FileStorage fileStorage,
-            io.quarkus.vertx.http.runtime.CurrentVertxRequest currentVertxRequest,
+            HttpServletRequest request,
             ResourceMonitor resourceMonitor,
             JobQueue jobQueue,
-            @ConfigProperty(name = "spring.mvc.async.request-timeout", defaultValue = "1200000")
-                    long asyncRequestTimeoutMs,
-            @ConfigProperty(name = "server.servlet.session.timeout", defaultValue = "30m")
-                    String sessionTimeout) {
+            @Value("${spring.mvc.async.request-timeout:1200000}") long asyncRequestTimeoutMs,
+            @Value("${server.servlet.session.timeout:30m}") String sessionTimeout) {
         this.taskManager = taskManager;
         this.fileStorage = fileStorage;
-        this.currentVertxRequest = currentVertxRequest;
+        this.request = request;
         this.resourceMonitor = resourceMonitor;
         this.jobQueue = jobQueue;
 
@@ -68,15 +63,16 @@ public class JobExecutorService {
                 "Job executor configured with effective timeout of {} ms", this.effectiveTimeoutMs);
     }
 
-    public Response runJobGeneric(boolean async, Supplier<Object> work) {
+    public ResponseEntity<?> runJobGeneric(boolean async, Supplier<Object> work) {
         return runJobGeneric(async, work, -1);
     }
 
-    public Response runJobGeneric(boolean async, Supplier<Object> work, long customTimeoutMs) {
+    public ResponseEntity<?> runJobGeneric(
+            boolean async, Supplier<Object> work, long customTimeoutMs) {
         return runJobGeneric(async, work, customTimeoutMs, false, 50);
     }
 
-    public Response runJobGeneric(
+    public ResponseEntity<?> runJobGeneric(
             boolean async,
             Supplier<Object> work,
             long customTimeoutMs,
@@ -87,20 +83,15 @@ public class JobExecutorService {
 
         log.debug("Generated jobId: {} (base: {})", scopedJobKey, baseJobId);
 
-        try {
-            var current = currentVertxRequest.getCurrent();
-            if (current != null) {
-                current.put("jobId", scopedJobKey);
-            }
-        } catch (RuntimeException ignored) {
-            // No active request (e.g. async/background execution) - jobId attribute is optional.
+        if (request != null) {
+            request.setAttribute("jobId", scopedJobKey);
         }
 
         String jobId = scopedJobKey;
 
         final String jobOwner =
-                jobOwnershipService.isResolvable()
-                        ? jobOwnershipService.get().getCurrentUserId().orElse(null)
+                jobOwnershipService != null
+                        ? jobOwnershipService.getCurrentUserId().orElse(null)
                         : null;
 
         long timeoutToUse = customTimeoutMs > 0 ? customTimeoutMs : effectiveTimeoutMs;
@@ -150,10 +141,10 @@ public class JobExecutorService {
                         }
                     };
 
-            CompletableFuture<Response> future =
+            CompletableFuture<ResponseEntity<?>> future =
                     jobQueue.queueJob(jobId, resourceWeight, wrappedWork, timeoutToUse);
 
-            return Response.ok(new JobResponse<>(true, jobId, null)).build();
+            return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
 
@@ -182,7 +173,7 @@ public class JobExecutorService {
                         }
                     });
 
-            return Response.ok(new JobResponse<>(true, jobId, null)).build();
+            return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else {
             try {
                 log.debug("Running sync job with timeout {} ms", timeoutToUse);
@@ -190,16 +181,15 @@ public class JobExecutorService {
                 stirling.software.common.util.JobContext.setJobId(jobId);
                 Object result = executeWithTimeout(() -> work.get(), timeoutToUse);
 
-                if (result instanceof Response) {
-                    return (Response) result;
+                if (result instanceof ResponseEntity) {
+                    return (ResponseEntity<?>) result;
                 }
 
                 return handleResultForSyncJob(result);
             } catch (TimeoutException te) {
                 log.error("Synchronous job timed out after {} ms", timeoutToUse);
-                return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                        .entity(Map.of("error", "Job timed out after " + timeoutToUse + " ms"))
-                        .build();
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("error", "Job timed out after " + timeoutToUse + " ms"));
             } catch (RuntimeException e) {
                 Throwable cause = e.getCause();
                 if (e instanceof IllegalArgumentException
@@ -213,14 +203,12 @@ public class JobExecutorService {
                     throw e;
                 }
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
-                return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                        .entity(Map.of("error", "Job failed: " + e.getMessage()))
-                        .build();
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("error", "Job failed: " + e.getMessage()));
             } catch (Exception e) {
                 log.error("Error executing synchronous job: {}", e.getMessage(), e);
-                return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                        .entity(Map.of("error", "Job failed: " + e.getMessage()))
-                        .build();
+                return ResponseEntity.internalServerError()
+                        .body(Map.of("error", "Job failed: " + e.getMessage()));
             } finally {
                 stirling.software.common.util.JobContext.clear();
             }
@@ -231,11 +219,12 @@ public class JobExecutorService {
         try {
             if (result instanceof byte[]) {
                 String fileId = fileStorage.storeBytes((byte[]) result, "result.pdf");
-                taskManager.setFileResult(jobId, fileId, "result.pdf", APPLICATION_PDF_VALUE);
+                taskManager.setFileResult(
+                        jobId, fileId, "result.pdf", MediaType.APPLICATION_PDF_VALUE);
                 log.debug("Stored byte[] result with fileId: {}", fileId);
-            } else if (result instanceof Response) {
-                Response response = (Response) result;
-                Object body = response.getEntity();
+            } else if (result instanceof ResponseEntity) {
+                ResponseEntity<?> response = (ResponseEntity<?>) result;
+                Object body = response.getBody();
 
                 if (body instanceof byte[]) {
                     String filename = extractResponseFilename(response);
@@ -243,23 +232,23 @@ public class JobExecutorService {
 
                     String fileId = fileStorage.storeBytes((byte[]) body, filename);
                     taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug("Stored Response<byte[]> result with fileId: {}", fileId);
-                } else if (body instanceof StreamingOutput streamingBody) {
-                    // JAX-RS Response carries a StreamingOutput for streamed bodies (migrated from
-                    // Spring's StreamingResponseBody).
+                    log.debug("Stored ResponseEntity<byte[]> result with fileId: {}", fileId);
+                } else if (body instanceof StreamingResponseBody streamingBody) {
                     String filename = extractResponseFilename(response);
                     String contentType = extractResponseContentType(response);
 
                     String fileId = fileStorage.storeFromStreamingBody(streamingBody, filename);
                     taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug("Stored Response<StreamingOutput> result with fileId: {}", fileId);
+                    log.debug(
+                            "Stored ResponseEntity<StreamingResponseBody> result with fileId: {}",
+                            fileId);
                 } else if (body instanceof Resource resource) {
                     String filename = extractResponseFilename(response);
                     String contentType = extractResponseContentType(response);
 
                     String fileId = fileStorage.storeFromResource(resource, filename);
                     taskManager.setFileResult(jobId, fileId, filename, contentType);
-                    log.debug("Stored Response<Resource> result with fileId: {}", fileId);
+                    log.debug("Stored ResponseEntity<Resource> result with fileId: {}", fileId);
                 } else {
                     if (body != null && body.toString().contains("fileId")) {
                         try {
@@ -269,7 +258,7 @@ public class JobExecutorService {
 
                             if (fileId != null && !fileId.isEmpty()) {
                                 String filename = "result.pdf";
-                                String contentType = APPLICATION_PDF_VALUE;
+                                String contentType = MediaType.APPLICATION_PDF_VALUE;
 
                                 try {
                                     java.lang.reflect.Method getOriginalFileName =
@@ -323,7 +312,7 @@ public class JobExecutorService {
 
                         if (fileId != null && !fileId.isEmpty()) {
                             String filename = "result.pdf";
-                            String contentType = APPLICATION_PDF_VALUE;
+                            String contentType = MediaType.APPLICATION_PDF_VALUE;
 
                             try {
                                 java.lang.reflect.Method getOriginalFileName =
@@ -369,35 +358,31 @@ public class JobExecutorService {
         }
     }
 
-    private Response handleResultForSyncJob(Object result) throws IOException {
+    private ResponseEntity<?> handleResultForSyncJob(Object result) throws IOException {
         if (result instanceof byte[]) {
-            return Response.ok(result)
-                    .type(MediaType.valueOf(APPLICATION_PDF_VALUE))
+            return ResponseEntity.ok()
+                    .contentType(MediaType.APPLICATION_PDF)
                     .header(
                             HttpHeaders.CONTENT_DISPOSITION,
                             "form-data; name=\"attachment\"; filename=\"result.pdf\"")
-                    .build();
+                    .body(result);
         } else if (result instanceof MultipartFile file) {
-            return Response.ok(file.getBytes())
-                    .type(MediaType.valueOf(file.getContentType()))
+            return ResponseEntity.ok()
+                    .contentType(MediaType.parseMediaType(file.getContentType()))
                     .header(
                             HttpHeaders.CONTENT_DISPOSITION,
                             "form-data; name=\"attachment\"; filename=\""
                                     + file.getOriginalFilename()
                                     + "\"")
-                    .build();
+                    .body(file.getBytes());
         } else {
-            return Response.ok(result).build();
+            return ResponseEntity.ok(result);
         }
     }
 
-    private static String extractResponseFilename(Response response) {
-        // JAX-RS exposes Content-Disposition as a raw header string; parse the filename token out
-        // of
-        // it (Spring previously used ContentDisposition#getFilename()).
-        String contentDisposition = response.getHeaderString(HttpHeaders.CONTENT_DISPOSITION);
-        if (contentDisposition != null) {
-            String filename = parseFilenameFromContentDisposition(contentDisposition);
+    private static String extractResponseFilename(ResponseEntity<?> response) {
+        if (response.getHeaders().getContentDisposition() != null) {
+            String filename = response.getHeaders().getContentDisposition().getFilename();
             if (filename != null && !filename.isEmpty()) {
                 return filename;
             }
@@ -405,23 +390,9 @@ public class JobExecutorService {
         return "result.pdf";
     }
 
-    private static String parseFilenameFromContentDisposition(String contentDisposition) {
-        for (String part : contentDisposition.split(";")) {
-            String trimmed = part.trim();
-            if (trimmed.regionMatches(true, 0, "filename=", 0, "filename=".length())) {
-                String value = trimmed.substring("filename=".length()).trim();
-                if (value.length() >= 2 && value.startsWith("\"") && value.endsWith("\"")) {
-                    value = value.substring(1, value.length() - 1);
-                }
-                return value;
-            }
-        }
-        return null;
-    }
-
-    private static String extractResponseContentType(Response response) {
-        MediaType mediaType = response.getMediaType();
-        return mediaType != null ? mediaType.toString() : APPLICATION_PDF_VALUE;
+    private static String extractResponseContentType(ResponseEntity<?> response) {
+        MediaType mediaType = response.getHeaders().getContentType();
+        return mediaType != null ? mediaType.toString() : MediaType.APPLICATION_PDF_VALUE;
     }
 
     private long parseSessionTimeout(String timeout) {
@@ -492,8 +463,8 @@ public class JobExecutorService {
     }
 
     private String getScopedJobKey(String baseJobId) {
-        if (jobOwnershipService.isResolvable()) {
-            return jobOwnershipService.get().createScopedJobKey(baseJobId);
+        if (jobOwnershipService != null) {
+            return jobOwnershipService.createScopedJobKey(baseJobId);
         }
         return baseJobId;
     }

app/common/src/main/java/stirling/software/common/service/JobQueue.java

@@ -5,14 +5,10 @@ import java.util.Map;
 import java.util.concurrent.*;
 import java.util.function.Supplier;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-
-import io.quarkus.runtime.StartupEvent;
-
-import jakarta.annotation.PreDestroy;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.event.Observes;
-import jakarta.ws.rs.core.Response;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.SmartLifecycle;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Service;
 
 import lombok.AllArgsConstructor;
 import lombok.Data;
@@ -26,33 +22,25 @@ import stirling.software.common.util.SpringContextHolder;
  * Manages a queue of jobs with dynamic sizing based on system resources. Used when system resources
  * are limited to prevent overloading.
  */
-// TODO: Migration required - the original class implemented Spring's SmartLifecycle, which has no
-// direct Quarkus equivalent. start() is now driven by a StartupEvent observer and stop() by
-// @PreDestroy. The SmartLifecycle phase/auto-startup ordering semantics (getPhase()==10) cannot be
-// expressed in CDI; if precise startup/shutdown ordering relative to other beans is required,
-// revisit using @Priority on the observer or @io.quarkus.runtime.Startup with an ordering strategy.
-@ApplicationScoped
+@Service
 @Slf4j
-public class JobQueue {
+public class JobQueue implements SmartLifecycle {
 
     private volatile boolean running = false;
 
     private final ResourceMonitor resourceMonitor;
 
-    // Field-default values mirror the @ConfigProperty defaults so they hold sane values during
-    // construction (the configured values are injected by CDI only after the constructor runs, and
-    // the constructor below sizes the queue from baseQueueCapacity/minQueueCapacity).
-    @ConfigProperty(name = "stirling.job.queue.base-capacity", defaultValue = "10")
-    int baseQueueCapacity = 10;
+    @Value("${stirling.job.queue.base-capacity:10}")
+    private int baseQueueCapacity = 10;
 
-    @ConfigProperty(name = "stirling.job.queue.min-capacity", defaultValue = "2")
-    int minQueueCapacity = 2;
+    @Value("${stirling.job.queue.min-capacity:2}")
+    private int minQueueCapacity = 2;
 
-    @ConfigProperty(name = "stirling.job.queue.check-interval-ms", defaultValue = "1000")
-    long queueCheckIntervalMs = 1000;
+    @Value("${stirling.job.queue.check-interval-ms:1000}")
+    private long queueCheckIntervalMs = 1000;
 
-    @ConfigProperty(name = "stirling.job.queue.max-wait-time-ms", defaultValue = "600000")
-    long maxWaitTimeMs = 600000; // 10 minutes
+    @Value("${stirling.job.queue.max-wait-time-ms:600000}")
+    private long maxWaitTimeMs = 600000; // 10 minutes
 
     private volatile BlockingQueue<QueuedJob> jobQueue;
     private final Map<String, QueuedJob> jobMap = new ConcurrentHashMap<>();
@@ -79,23 +67,20 @@ public class JobQueue {
         private final Supplier<Object> work;
         private final long timeoutMs;
         private final Instant queuedAt;
-        private CompletableFuture<Response> future;
+        private CompletableFuture<ResponseEntity<?>> future;
         private volatile boolean cancelled = false;
     }
 
     public JobQueue(ResourceMonitor resourceMonitor) {
         this.resourceMonitor = resourceMonitor;
 
-        // Initialize the queue with a dynamic capacity in the constructor (not in
-        // initializeSchedulers) so it is usable immediately after construction, before the
-        // StartupEvent observer starts the schedulers. Uses the field-default capacities since the
-        // configured values are injected only after construction; updateQueueCapacity() re-sizes
-        // once the configured values are available.
+        // Initialize with dynamic capacity
         int capacity =
                 resourceMonitor.calculateDynamicQueueCapacity(baseQueueCapacity, minQueueCapacity);
         this.jobQueue = new LinkedBlockingQueue<>(capacity);
     }
 
+    // Remove @PostConstruct to let SmartLifecycle control startup
     private void initializeSchedulers() {
         log.debug(
                 "Starting job queue with base capacity {}, min capacity {}",
@@ -114,6 +99,7 @@ public class JobQueue {
                 TimeUnit.MILLISECONDS);
     }
 
+    // Remove @PreDestroy to let SmartLifecycle control shutdown
     private void shutdownSchedulers() {
         log.info("Shutting down job queue");
         shuttingDown = true;
@@ -150,12 +136,9 @@ public class JobQueue {
                 rejectedJobs);
     }
 
-    // Lifecycle methods (migrated from Spring SmartLifecycle)
-
-    void onStart(@Observes StartupEvent event) {
-        start();
-    }
+    // SmartLifecycle methods
 
+    @Override
     public void start() {
         log.info("Starting JobQueue lifecycle");
         if (!running) {
@@ -164,17 +147,29 @@ public class JobQueue {
         }
     }
 
-    @PreDestroy
+    @Override
     public void stop() {
         log.info("Stopping JobQueue lifecycle");
         shutdownSchedulers();
         running = false;
     }
 
+    @Override
     public boolean isRunning() {
         return running;
     }
 
+    @Override
+    public int getPhase() {
+        // Start earlier than most components, but shutdown later
+        return 10;
+    }
+
+    @Override
+    public boolean isAutoStartup() {
+        return true;
+    }
+
     /**
      * Queues a job for execution when resources permit.
      *
@@ -184,11 +179,11 @@ public class JobQueue {
      * @param timeoutMs The timeout in milliseconds
      * @return A CompletableFuture that will complete when the job is executed
      */
-    public CompletableFuture<Response> queueJob(
+    public CompletableFuture<ResponseEntity<?>> queueJob(
             String jobId, int resourceWeight, Supplier<Object> work, long timeoutMs) {
 
         // Create a CompletableFuture to track this job's completion
-        CompletableFuture<Response> future = new CompletableFuture<>();
+        CompletableFuture<ResponseEntity<?>> future = new CompletableFuture<>();
 
         // Create the queued job
         QueuedJob job =
@@ -383,10 +378,10 @@ public class JobQueue {
                         Object result = executeWithTimeout(job.work, job.timeoutMs);
 
                         // Process the result
-                        if (result instanceof Response) {
-                            job.future.complete((Response) result);
+                        if (result instanceof ResponseEntity) {
+                            job.future.complete((ResponseEntity<?>) result);
                         } else {
-                            job.future.complete(Response.ok(result).build());
+                            job.future.complete(ResponseEntity.ok(result));
                         }
 
                     } catch (Exception e) {

app/common/src/main/java/stirling/software/common/service/MobileScannerService.java

@@ -10,19 +10,17 @@ import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Pattern;
 
-import io.quarkus.scheduler.Scheduled;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
 
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.model.MultipartFile;
-
 /**
  * Service for handling mobile scanner file uploads and temporary storage. Files are stored
  * temporarily and automatically cleaned up after 10 minutes or upon retrieval.
  */
-@ApplicationScoped
+@Service
 @Slf4j
 public class MobileScannerService {
 
@@ -254,7 +252,7 @@ public class MobileScannerService {
     }
 
     /** Scheduled cleanup of expired sessions (runs every 5 minutes) */
-    @Scheduled(every = "5m")
+    @Scheduled(fixedRate = 5 * 60 * 1000)
     public void cleanupExpiredSessions() {
         long now = System.currentTimeMillis();
         List<String> expiredSessions = new ArrayList<>();

app/common/src/main/java/stirling/software/common/service/PdfAnnotationService.java

@@ -9,8 +9,7 @@ import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.color.PDColor;
 import org.apache.pdfbox.pdmodel.graphics.color.PDDeviceRGB;
 import org.apache.pdfbox.pdmodel.interactive.annotation.PDAnnotationText;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.stereotype.Service;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -29,7 +28,7 @@ import stirling.software.common.model.api.comments.StickyNoteSpec;
  * </ul>
  */
 @Slf4j
-@ApplicationScoped
+@Service
 public class PdfAnnotationService {
 
     /** Yellow sticky-note fill colour (R, G, B in 0..1 range). */

app/common/src/main/java/stirling/software/common/service/PdfMetadataService.java

@@ -7,32 +7,26 @@ import java.time.format.DateTimeFormatter;
 import java.util.Calendar;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Instance;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
 
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.PdfMetadata;
 
-@ApplicationScoped
+@Service
 public class PdfMetadataService {
 
     private final ApplicationProperties applicationProperties;
     private final String stirlingPDFLabel;
-    // MIGRATION: Spring's @Autowired(required=false) optional bean -> CDI Instance<>
-    // (UserServiceInterface
-    // is only present in security-enabled flavors). Resolve via isResolvable()/get().
-    private final Instance<UserServiceInterface> userService;
+    private final UserServiceInterface userService;
     private final boolean runningProOrHigher;
 
-    @Inject
     public PdfMetadataService(
             ApplicationProperties applicationProperties,
-            @Named("StirlingPDFLabel") String stirlingPDFLabel,
-            @Named("runningProOrHigher") boolean runningProOrHigher,
-            Instance<UserServiceInterface> userService) {
+            @Qualifier("StirlingPDFLabel") String stirlingPDFLabel,
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher,
+            @Autowired(required = false) UserServiceInterface userService) {
         this.applicationProperties = applicationProperties;
         this.stirlingPDFLabel = stirlingPDFLabel;
         this.userService = userService;
@@ -174,8 +168,8 @@ public class PdfMetadataService {
                             .getCustomMetadata()
                             .getAuthor();
 
-            if (userService.isResolvable()) {
-                String username = userService.get().getCurrentUsername();
+            if (userService != null) {
+                String username = userService.getCurrentUsername();
                 if (username != null) {
                     author = author.replace("username", username);
                 }

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -15,44 +15,39 @@ import java.util.Map;
 import java.util.TimeZone;
 
 import org.apache.commons.lang3.StringUtils;
-import org.eclipse.microprofile.config.Config;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.core.env.Environment;
+import org.springframework.stereotype.Service;
 
 import com.posthog.java.PostHog;
 
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Instance;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
-
 import stirling.software.common.model.ApplicationProperties;
 
-@ApplicationScoped
+@Service
 public class PostHogService {
     private final PostHog postHog;
     private final String uniqueId;
     private final String appVersion;
     private final ApplicationProperties applicationProperties;
-    // MIGRATION: optional bean (@Autowired(required=false)) -> CDI Instance<>.
-    private final Instance<UserServiceInterface> userService;
-    // MIGRATION: Spring Environment -> MicroProfile Config.
-    private final Config config;
+    private final UserServiceInterface userService;
+    private final Environment env;
     private boolean configDirMounted;
 
-    @Inject
     public PostHogService(
             PostHog postHog,
-            @Named("UUID") String uuid,
-            @Named("configDirMounted") boolean configDirMounted,
-            @Named("appVersion") String appVersion,
+            @Qualifier("UUID") String uuid,
+            @Qualifier("configDirMounted") boolean configDirMounted,
+            @Qualifier("appVersion") String appVersion,
             ApplicationProperties applicationProperties,
-            Instance<UserServiceInterface> userService,
-            Config config) {
+            @Autowired(required = false) UserServiceInterface userService,
+            Environment env) {
         this.postHog = postHog;
         this.uniqueId = uuid;
         this.appVersion = appVersion;
         this.applicationProperties = applicationProperties;
         this.userService = userService;
-        this.config = config;
+        this.env = env;
         this.configDirMounted = configDirMounted;
         captureSystemInfo();
     }
@@ -84,9 +79,7 @@ public class PostHogService {
             // Application version
             metrics.put("app_version", appVersion);
             String deploymentType = "JAR"; // default
-            if ("true"
-                    .equalsIgnoreCase(
-                            config.getOptionalValue("BROWSER_OPEN", String.class).orElse(null))) {
+            if ("true".equalsIgnoreCase(env.getProperty("BROWSER_OPEN"))) {
                 deploymentType = "EXE";
             } else if (isRunningInDocker()) {
                 deploymentType = "DOCKER";
@@ -155,8 +148,8 @@ public class PostHogService {
             }
             metrics.put("application_properties", captureApplicationProperties());
 
-            if (userService.isResolvable()) {
-                metrics.put("total_users_created", userService.get().getTotalUsersCount());
+            if (userService != null) {
+                metrics.put("total_users_created", userService.getTotalUsersCount());
             }
 
         } catch (Exception e) {

app/common/src/main/java/stirling/software/common/service/ResourceMonitor.java

@@ -11,11 +11,11 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
 
 import jakarta.annotation.PostConstruct;
 import jakarta.annotation.PreDestroy;
-import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
@@ -24,24 +24,24 @@ import lombok.extern.slf4j.Slf4j;
  * Monitors system resources (CPU, memory) to inform job scheduling decisions. Provides information
  * about available resources to prevent overloading the system.
  */
-@ApplicationScoped
+@Service
 @Slf4j
 public class ResourceMonitor {
 
-    @ConfigProperty(name = "stirling.resource.memory.critical-threshold", defaultValue = "0.9")
-    double memoryCriticalThreshold; // 90% usage is critical
+    @Value("${stirling.resource.memory.critical-threshold:0.9}")
+    private double memoryCriticalThreshold = 0.9; // 90% usage is critical
 
-    @ConfigProperty(name = "stirling.resource.memory.high-threshold", defaultValue = "0.75")
-    double memoryHighThreshold; // 75% usage is high
+    @Value("${stirling.resource.memory.high-threshold:0.75}")
+    private double memoryHighThreshold = 0.75; // 75% usage is high
 
-    @ConfigProperty(name = "stirling.resource.cpu.critical-threshold", defaultValue = "0.9")
-    double cpuCriticalThreshold; // 90% usage is critical
+    @Value("${stirling.resource.cpu.critical-threshold:0.9}")
+    private double cpuCriticalThreshold = 0.9; // 90% usage is critical
 
-    @ConfigProperty(name = "stirling.resource.cpu.high-threshold", defaultValue = "0.75")
-    double cpuHighThreshold; // 75% usage is high
+    @Value("${stirling.resource.cpu.high-threshold:0.75}")
+    private double cpuHighThreshold = 0.75; // 75% usage is high
 
-    @ConfigProperty(name = "stirling.resource.monitor.interval-ms", defaultValue = "60000")
-    long monitorIntervalMs; // 60 seconds
+    @Value("${stirling.resource.monitor.interval-ms:60000}")
+    private long monitorIntervalMs = 60000; // 60 seconds
 
     private final ScheduledExecutorService scheduler =
             Executors.newSingleThreadScheduledExecutor(

app/common/src/main/java/stirling/software/common/service/SsrfProtectionService.java

@@ -8,7 +8,7 @@ import java.net.UnknownHostException;
 import java.util.Locale;
 import java.util.regex.Pattern;
 
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -16,7 +16,7 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.RegexPatternUtils;
 
-@ApplicationScoped
+@Service
 @RequiredArgsConstructor
 @Slf4j
 public class SsrfProtectionService {

app/common/src/main/java/stirling/software/common/service/TaskManager.java

@@ -20,13 +20,14 @@ import java.util.concurrent.TimeUnit;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Service;
 
 import io.github.pixee.security.ZipSecurity;
 
 import jakarta.annotation.PreDestroy;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.inject.Inject;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -39,13 +40,13 @@ import stirling.software.common.model.job.JobStats;
 import stirling.software.common.model.job.ResultFile;
 
 /** Manages async tasks and their results */
-@ApplicationScoped
+@Service
 @Slf4j
 public class TaskManager {
     private final Map<String, JobResult> jobResults = new ConcurrentHashMap<>();
 
-    @ConfigProperty(name = "stirling.jobResultExpiryMinutes", defaultValue = "30")
-    int jobResultExpiryMinutes;
+    @Value("${stirling.jobResultExpiryMinutes:30}")
+    private int jobResultExpiryMinutes = 30;
 
     private final FileStorage fileStorage;
     private final JobStore jobStore;
@@ -54,7 +55,7 @@ public class TaskManager {
             Executors.newSingleThreadScheduledExecutor(
                     Thread.ofVirtual().name("task-cleanup-", 0).factory());
 
-    @Inject
+    @Autowired
     public TaskManager(
             FileStorage fileStorage, JobStore jobStore, ClusterBackplane clusterBackplane) {
         this.fileStorage = fileStorage;
@@ -474,27 +475,24 @@ public class TaskManager {
     /** Determine content type based on file extension */
     private String determineContentType(String fileName) {
         if (fileName == null) {
-            // jakarta.ws.rs.core.MediaType lacks PDF/JPEG/PNG constants and uses no _VALUE
-            // suffix, so the original Spring MediaType.*_VALUE strings are inlined here verbatim
-            // to preserve exact behavior.
-            return "application/octet-stream";
+            return MediaType.APPLICATION_OCTET_STREAM_VALUE;
         }
 
         String lowerName = fileName.toLowerCase(Locale.ROOT);
         if (lowerName.endsWith(".pdf")) {
-            return "application/pdf";
+            return MediaType.APPLICATION_PDF_VALUE;
         } else if (lowerName.endsWith(".txt")) {
-            return "text/plain";
+            return MediaType.TEXT_PLAIN_VALUE;
         } else if (lowerName.endsWith(".json")) {
-            return "application/json";
+            return MediaType.APPLICATION_JSON_VALUE;
         } else if (lowerName.endsWith(".xml")) {
-            return "application/xml";
+            return MediaType.APPLICATION_XML_VALUE;
         } else if (lowerName.endsWith(".jpg") || lowerName.endsWith(".jpeg")) {
-            return "image/jpeg";
+            return MediaType.IMAGE_JPEG_VALUE;
         } else if (lowerName.endsWith(".png")) {
-            return "image/png";
+            return MediaType.IMAGE_PNG_VALUE;
         } else {
-            return "application/octet-stream";
+            return MediaType.APPLICATION_OCTET_STREAM_VALUE;
         }
     }
 
@@ -551,8 +549,8 @@ public class TaskManager {
         if (jobStore != null) {
             // Propagate JobStore failures: returning null on a backplane outage would conflate
             // "no such file" with "lookup unavailable" and the caller would respond 404 to a
-            // transient blip that should be retried. Let the framework's exception handler
-            // surface a 5xx so clients know to retry.
+            // transient blip that should be retried. Let Spring's exception handler surface a
+            // 5xx so clients know to retry.
             try {
                 return jobStore.findJobIdByFileId(fileId).orElse(null);
             } catch (RuntimeException e) {

app/common/src/main/java/stirling/software/common/service/TempFileCleanupService.java

@@ -5,17 +5,18 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Arrays;
 import java.util.Set;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.Consumer;
 import java.util.function.Predicate;
 import java.util.stream.Stream;
 
-import io.quarkus.scheduler.Scheduled;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
 
 import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -31,7 +32,7 @@ import stirling.software.common.util.TempFileRegistry;
  * and directories.
  */
 @Slf4j
-@ApplicationScoped
+@Service
 @RequiredArgsConstructor
 public class TempFileCleanupService {
 
@@ -39,9 +40,9 @@ public class TempFileCleanupService {
     private final TempFileManager tempFileManager;
     private final ApplicationProperties applicationProperties;
 
-    @Inject
-    @Named("machineType")
-    String machineType;
+    @Autowired
+    @Qualifier("machineType")
+    private String machineType;
 
     // Maximum recursion depth for directory traversal
     private static final int MAX_RECURSION_DEPTH = 5;
@@ -126,17 +127,11 @@ public class TempFileCleanupService {
         }
     }
 
-    /**
-     * Scheduled task to clean up old temporary files. Runs at the configured interval.
-     *
-     * <p>TODO: Migration required - the Spring form used a SpEL expression ({@code
-     * fixedDelayString="#{applicationProperties.system.tempFileManagement.cleanupIntervalMinutes}"}).
-     * Quarkus {@code @Scheduled} cannot reference an arbitrary bean property; {@code every} only
-     * resolves a MicroProfile Config placeholder. The cleanup interval must therefore be exposed as
-     * a config key (e.g. {@code stirling.temp.cleanup-interval}) bound to the same value, and the
-     * minutes->duration mapping handled in config. Default below is 30m.
-     */
-    @Scheduled(every = "{stirling.temp.cleanup-interval:30m}")
+    /** Scheduled task to clean up old temporary files. Runs at the configured interval. */
+    @Scheduled(
+            fixedDelayString =
+                    "#{applicationProperties.system.tempFileManagement.cleanupIntervalMinutes}",
+            timeUnit = TimeUnit.MINUTES)
     public void scheduledCleanup() {
         log.info("Running scheduled temporary file cleanup");
         long maxAgeMillis = tempFileManager.getMaxAgeMillis();

app/common/src/main/java/stirling/software/common/util/AppArgsCapture.java

@@ -3,33 +3,27 @@ package stirling.software.common.util;
 import java.util.List;
 import java.util.concurrent.atomic.AtomicReference;
 
-import io.quarkus.runtime.StartupEvent;
-import io.quarkus.runtime.annotations.CommandLineArguments;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.event.Observes;
-import jakarta.inject.Inject;
+import org.springframework.boot.ApplicationArguments;
+import org.springframework.boot.ApplicationRunner;
+import org.springframework.stereotype.Component;
 
 import lombok.extern.slf4j.Slf4j;
 
 /**
  * Captures application command-line arguments at startup so they can be reused for restart
  * operations. This allows the application to restart with the same configuration.
- *
- * <p>MIGRATION (Spring -> Quarkus): replaced Spring's {@code ApplicationRunner}/{@code
- * ApplicationArguments} with a CDI startup observer ({@code @Observes StartupEvent}) and Quarkus'
- * {@code @CommandLineArguments String[]} injection.
  */
 @Slf4j
-@ApplicationScoped
-public class AppArgsCapture {
+@Component
+public class AppArgsCapture implements ApplicationRunner {
 
     public static final AtomicReference<List<String>> APP_ARGS = new AtomicReference<>(List.of());
 
-    @Inject @CommandLineArguments String[] args;
-
-    void onStart(@Observes StartupEvent event) {
-        APP_ARGS.set(List.of(args));
-        log.debug("Captured {} application arguments for restart capability", args.length);
+    @Override
+    public void run(ApplicationArguments args) {
+        APP_ARGS.set(List.of(args.getSourceArgs()));
+        log.debug(
+                "Captured {} application arguments for restart capability",
+                args.getSourceArgs().length);
     }
 }

app/common/src/main/java/stirling/software/common/util/ApplicationContextProvider.java

@@ -1,17 +1,23 @@
 package stirling.software.common.util;
 
-import io.quarkus.arc.Arc;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Instance;
-import jakarta.enterprise.inject.literal.NamedLiteral;
+import org.springframework.beans.BeansException;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.stereotype.Component;
 
 /**
- * Helper class that provides access to the CDI container. Useful for getting beans in classes that
- * are not managed by CDI.
+ * Helper class that provides access to the ApplicationContext. Useful for getting beans in classes
+ * that are not managed by Spring.
  */
-@ApplicationScoped
-public class ApplicationContextProvider {
+@Component
+public class ApplicationContextProvider implements ApplicationContextAware {
+
+    private static ApplicationContext applicationContext;
+
+    @Override
+    public void setApplicationContext(ApplicationContext context) throws BeansException {
+        applicationContext = context;
+    }
 
     /**
      * Get a bean by class type.
@@ -21,16 +27,12 @@ public class ApplicationContextProvider {
      * @return The bean instance, or null if not found
      */
     public static <T> T getBean(Class<T> beanClass) {
-        if (Arc.container() == null) {
+        if (applicationContext == null) {
             return null;
         }
         try {
-            Instance<T> instance = Arc.container().select(beanClass);
-            if (instance.isResolvable()) {
-                return instance.get();
-            }
-            return null;
-        } catch (RuntimeException e) {
+            return applicationContext.getBean(beanClass);
+        } catch (BeansException e) {
             return null;
         }
     }
@@ -44,16 +46,12 @@ public class ApplicationContextProvider {
      * @return The bean instance, or null if not found
      */
     public static <T> T getBean(String name, Class<T> beanClass) {
-        if (Arc.container() == null) {
+        if (applicationContext == null) {
             return null;
         }
         try {
-            Instance<T> instance = Arc.container().select(beanClass, NamedLiteral.of(name));
-            if (instance.isResolvable()) {
-                return instance.get();
-            }
-            return null;
-        } catch (RuntimeException e) {
+            return applicationContext.getBean(name, beanClass);
+        } catch (BeansException e) {
             return null;
         }
     }
@@ -65,12 +63,13 @@ public class ApplicationContextProvider {
      * @return true if the bean exists, false otherwise
      */
     public static boolean containsBean(Class<?> beanClass) {
-        if (Arc.container() == null) {
+        if (applicationContext == null) {
             return false;
         }
         try {
-            return Arc.container().select(beanClass).isResolvable();
-        } catch (RuntimeException e) {
+            applicationContext.getBean(beanClass);
+            return true;
+        } catch (BeansException e) {
             return false;
         }
     }

app/common/src/main/java/stirling/software/common/util/CbrUtils.java

@@ -14,6 +14,7 @@ import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
+import org.springframework.web.multipart.MultipartFile;
 
 import com.github.junrar.Archive;
 import com.github.junrar.exception.CorruptHeaderException;
@@ -23,7 +24,6 @@ import com.github.junrar.rarfile.FileHeader;
 import lombok.experimental.UtilityClass;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.model.MultipartFile;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 
 @Slf4j