Add cluster deployment artifacts and Helm chart

.devcontainer/init-setup.sh

@@ -20,8 +20,8 @@ set -e
 # - To build the project, use:
 #     ./gradlew build
 #
-# - To run the lint/format/secret checks, use:
-#     task pre-commit
+# - For running pre-commit hooks (if configured), use:
+#     pre-commit run --all-files
 #
 # Make sure you are in the project root directory after this script executes.
 # =============================================================================
@@ -70,6 +70,6 @@ echo ""
 echo "  To build the project: "
 echo -e "\e[34m    gradle build\e[0m"
 echo ""
-echo "  To run the lint/format/secret checks:"
-echo -e "\e[34m    task pre-commit\e[0m"
+echo "  To run pre-commit hooks (if configured):"
+echo -e "\e[34m    pre-commit run --all-files -c .pre-commit-config.yaml\e[0m"
 echo "=================================================================="

.dockerignore

@@ -8,8 +8,6 @@
 build/
 */build/
 **/build/
-# ...but re-include the Quarkus runner-jar so docker/quarkus/Dockerfile can layer it on the base image
-!app/core/build/*-runner.jar
 out/
 target/
 **/target/
@@ -28,9 +26,8 @@ version_builds/
 node_modules/
 **/node_modules/
 frontend/node_modules/
-frontend/editor/dist/
-frontend/dist-portal/
-frontend/editor/playwright-report/
+frontend/dist/
+frontend/playwright-report/
 .npm/
 .yarn/
 

.env.saas.example

@@ -1,20 +1,20 @@
 ###############################################################################
-# Stirling-PDF SaaS environment defaults.
+# Stirling-PDF SaaS local environment template.
 #
-# This file is committed and provides non-secret defaults loaded by
-# `task backend:dev:saas`. Put real values for secrets (passwords, project
-# refs, edge function secrets) in `.env.saas.local` - any variable set there
-# takes precedence over what's defined here.
+# Copy this file to `.env.saas.local` (gitignored) and fill in real values.
+# Loaded by `task backend:dev:saas` via Taskfile's `dotenv:` directive, then
+# read by Spring Boot's `${...}` placeholders in application-saas.properties
+# and application-dev.properties.
 #
-# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
+# DO NOT commit `.env.saas.local`. Only `.env.saas.example` is checked in.
 ###############################################################################
 
 # ---------- Supabase project ----------
 # Project reference (the subdomain part of <ref>.supabase.co). Required.
-# Set in .env.saas.local.
+# Example dev project:
 SAAS_DB_PROJECT_REF=
 
-# Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
+# Edge function secret used by billing/license rollup calls.
 SUPABASE_EDGE_FUNCTION_SECRET=
 
 # ---------- Database (saas profile) ----------
@@ -28,7 +28,7 @@ SAAS_DB_PASSWORD=
 # ---------- Database (dev profile overrides) ----------
 # Used when `--spring.profiles.include=dev` is active. The dev profile
 # defaults the URL/username to the shared dev Supabase project, but the
-# password must still be provided in .env.saas.local.
+# password must still be provided here.
 SAAS_DEV_DB_URL=
 SAAS_DEV_DB_USERNAME=postgres
 SAAS_DEV_DB_PASSWORD=

.github/actions/setup-bot/action.yml

@@ -24,7 +24,7 @@ runs:
       id: generate-token
       uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       with:
-        client-id: ${{ inputs.app-id }}
+        app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
     - name: Configure Git
       run: |

.github/aur/stirling-pdf-desktop/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.13.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')

.github/aur/stirling-pdf-server-bin/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.13.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')

.github/config/.files.yaml

@@ -1,8 +1,6 @@
 build: &build
   - build.gradle
   - app/(common|core|proprietary)/build.gradle
-  - Taskfile.yml
-  - .taskfiles/backend.yml
 
 openapi: &openapi
   - *build
@@ -40,11 +38,6 @@ project: &project
   - frontend/**
   - docker/**
   - scripts/RestartHelper.java
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .taskfiles/docker.yml
-  - scripts/db-migration/**
-  - .github/workflows/db-migration-test.yml
 
 frontend: &frontend
   - frontend/**
@@ -60,9 +53,6 @@ frontend: &frontend
   - scripts/summarize_type3_signatures.py
   - scripts/type3_to_cff.py
   - scripts/update_type3_library.py
-  - Taskfile.yml
-  - .taskfiles/frontend.yml
-  - .taskfiles/e2e.yml
 
 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
@@ -74,8 +64,6 @@ tauri: &tauri
   - frontend/package-lock.json
   - frontend/editor/vite.config.ts
   - .github/workflows/tauri-build.yml
-  - Taskfile.yml
-  - .taskfiles/desktop.yml
 
 # Files that affect the AI engine (Python tool models, fixers, tests). Gate
 # the engine validation job on changes to engine sources or to the Java
@@ -84,8 +72,6 @@ engine: &engine
   - engine/**
   - app/(common|core|proprietary)/src/main/java/**
   - .github/workflows/ai-engine.yml
-  - Taskfile.yml
-  - .taskfiles/engine.yml
 
 licenses-frontend: &licenses-frontend
   - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -114,4 +100,4 @@ proprietary: &proprietary
   - configs/settings.yml.template
   - build.gradle
   - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml
+  - .github/workflows/build-enterprise.yml

.github/scripts/check_language_toml.py

@@ -13,7 +13,7 @@ Usage:
 """
 
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-US/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
 
 import argparse
 import glob
@@ -184,7 +184,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
     if len(file_list) == 1:
         file_arr = file_list[0].split()
 
-    base_dir = Path.cwd() / "frontend" / "editor" / "public" / "locales"
+    base_dir = Path.cwd() / "frontend" / "public" / "locales"
 
     for file_path in file_arr:
         file_path = Path(file_path)
@@ -211,7 +211,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
             )
             continue
 
-        if basename_current_file == basename_reference_file and locale_dir == "en-US":
+        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
             continue
 
         if (
@@ -308,7 +308,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-US/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -372,7 +372,6 @@ if __name__ == "__main__":
                 os.path.join(
                     os.getcwd(),
                     "frontend",
-                    "editor",
                     "public",
                     "locales",
                     "*",

.github/scripts/requirements_pre_commit.in

@@ -0,0 +1 @@
+pre-commit

.github/scripts/requirements_pre_commit.txt

@@ -0,0 +1,121 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
+#
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+    # via pre-commit
+distlib==0.4.0 \
+    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
+    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
+    # via virtualenv
+filelock==3.29.0 \
+    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
+    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+    # via
+    #   python-discovery
+    #   virtualenv
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+    # via pre-commit
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+    # via pre-commit
+platformdirs==4.9.6 \
+    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
+    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+    # via -r .github/scripts/requirements_pre_commit.in
+python-discovery==1.2.2 \
+    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
+    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+    # via virtualenv
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via pre-commit
+virtualenv==21.2.4 \
+    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
+    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+    # via pre-commit

.github/scripts/verify-updater-signatures.py

@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
-
-Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
-"""
-
-import binascii
-import sys
-import json
-import base64
-import hashlib
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from cryptography.exceptions import InvalidSignature
-
-ART_ROOT = Path(sys.argv[1])
-CONF = Path(
-    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
-)
-
-
-def load_pubkey():
-    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
-    # [2 algo][8 key-id][32 ed25519 public key].
-    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
-    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
-    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
-
-
-def hash_file(path: Path) -> bytes:
-    h = hashlib.blake2b(digest_size=64)
-    with path.open("rb") as f:
-        for chunk in iter(lambda: f.read(1 << 16), b""):
-            h.update(chunk)
-    return h.digest()
-
-
-def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
-    # tauri .sig = base64 of a minisign signature file (4 lines).
-    try:
-        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
-        sig_blob = base64.b64decode(lines[1])
-    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
-        return f"FAIL malformed sig ({type(e).__name__})"
-    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
-    if keyid != keyid_pub:
-        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
-    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
-    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
-    try:
-        pub.verify(sig, msg)
-    except InvalidSignature:
-        return f"FAIL signature invalid (algo={algo.decode()})"
-    # Global signature covers sig + trusted_comment.
-    gc = "global-sig FAIL"
-    try:
-        tc = lines[2].split("trusted comment: ", 1)[1]
-        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
-        gc = "global-sig OK"
-    except (InvalidSignature, IndexError, binascii.Error):
-        pass
-    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
-
-
-keyid_pub, pub = load_pubkey()
-print(f"updater pubkey keyid={keyid_pub.hex()}\n")
-sigs = sorted(ART_ROOT.rglob("*.sig"))
-if not sigs:
-    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
-    sys.exit(0)
-bad = 0
-for sig_file in sigs:
-    artifact = sig_file.with_suffix("")
-    if not artifact.exists():
-        print(f"  ? {sig_file.name}: artifact missing")
-        bad += 1
-        continue
-    res = verify(artifact, sig_file, keyid_pub, pub)
-    print(f"  {artifact.name}: {res}")
-    if not res.startswith("VALID") or "global-sig FAIL" in res:
-        bad += 1
-print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
-sys.exit(1 if bad else 0)

.github/workflows/PR-Auto-Deploy-V2.yml

@@ -239,7 +239,7 @@ jobs:
 
       - name: Build and push V2 image (Depot)
         if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -287,13 +287,12 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "false"
                 SECURITY_ENABLELOGIN: "true"
                 SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
                 SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
                 UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
@@ -310,7 +309,7 @@ jobs:
 
           ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
             # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
+            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}
 
             # Move docker-compose file to correct location
             mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -222,10 +222,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Run Gradle Command
         run: |
           if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -256,7 +256,7 @@ jobs:
 
       - name: Build and push PR-specific image (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -285,7 +285,7 @@ jobs:
 
       - name: Build and push engine image (Depot)
         if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: ./engine
@@ -388,7 +388,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                 SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
                 UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
                 UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"

.github/workflows/ai-engine.yml

@@ -1,9 +1,8 @@
 name: AI Engine CI
 
-# Validates the Python AI engine: regenerates tool models and runs the
-# engine quality gate (lint, type-check, format-check, tests). Called from
-# build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net.
+# Validates the Python AI engine: regenerates tool models, runs fixers,
+# lint, type-check, and tests. Called from build.yml on PRs and merge_group;
+# also runs directly on push to main as a post-merge safety net.
 on:
   workflow_call:
   push:
@@ -43,104 +42,36 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Regenerate tool models
         run: task engine:tool-models
 
       - name: Verify tool models are up to date
-        id: tool-models-check
-        continue-on-error: true
-        run: git diff --exit-code engine/src/stirling/models/tool_models.py
-
-      - name: Comment on tool models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.tool-models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const body = [
-              marker,
-              '### Tool Models Check Failed',
-              '',
-              'The generated `engine/src/stirling/models/tool_models.py` is out of date with the Java OpenAPI spec and will need to be regenerated before it can be merged in.',
-              '',
-              'Run `task engine:tool-models` to regenerate, then commit the updated file.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if tool models check failed
-        if: steps.tool-models-check.outcome == 'failure'
         run: |
-          echo "============================================"
-          echo "  Tool Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "The generated engine/src/stirling/models/tool_models.py"
-          echo "is out of date with the Java OpenAPI spec and will"
-          echo "need to be regenerated before it can be merged in."
-          echo ""
-          echo "Run 'task engine:tool-models' to regenerate, then"
-          echo "commit the updated file."
-          echo "============================================"
-          exit 1
+          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
+            echo "tool_models.py is out of date."
+            echo "Run 'task engine:tool-models' locally and commit the updated file."
+            exit 1
+          fi
 
-      - name: Remove tool models check comment on success
-        if: steps.tool-models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run fixers
+        run: task engine:fix
 
-      - name: Quality-check engine
-        id: engine-check
-        run: task engine:check
-        continue-on-error: true
+      - name: Verify fixes are committed
+        id: fixer_changes
+        run: |
+          if ! git diff --quiet; then
+            git --no-pager diff --stat
+            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
+            exit 1
+          fi
 
-      - name: Comment on engine check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
+      - name: Comment on fixer failures
+        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
         continue-on-error: true
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -176,39 +107,11 @@ jobs:
               });
             }
 
-      - name: Fail if engine check failed
-        if: steps.engine-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Engine Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your Python code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task engine:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task engine:check'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
+      - name: Run linting
+        run: task engine:lint
 
-      - name: Remove engine check comment on success
-        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run type checking
+        run: task engine:typecheck
+
+      - name: Run tests
+        run: task engine:test

.github/workflows/backend-build.yml

@@ -1,14 +1,8 @@
 name: Backend build, format check, and coverage
 
 # Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
+# (JDK 25 × spring-security on/off), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
-#
-# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
-#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
-#   proprietary  - default build, no saas
-#   saas         - proprietary + the saas subproject (build + JUnit only,
-#                  never any runtime/integration testing)
 on:
   workflow_call:
 
@@ -31,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         jdk-version: [25]
-        flavor: [core, proprietary, saas]
+        spring-security: [true, false]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -58,16 +52,13 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check Java formatting (Spotless)
-        # Runs once per matrix combination - pick the cheapest leg
-        # (core - no proprietary, no saas) so we don't wait for the
-        # heavier flavors just to fail formatting.
-        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
+        if: matrix.jdk-version == 25 && matrix.spring-security == false
         id: spotless-check
         run: task backend:format:check
         continue-on-error: true
@@ -76,7 +67,7 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
-      - name: Comment on backend format check failure
+      - name: Comment on Java formatting failure
         # Only post a comment on PRs. github-script's PR helpers need an
         # issue/PR number, which doesn't exist on merge_group runs.
         if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
@@ -87,11 +78,15 @@ jobs:
             const marker = '<!-- java-formatting-check -->';
             const body = [
               marker,
-              '### Backend Format Check Failed',
+              '### Java Formatting Check Failed',
               '',
-              'There are formatting issues in your Java code that will need to be fixed before they can be merged in.',
+              'Your code has formatting issues. Run the following command to fix them:',
               '',
-              'Run `task backend:format` to auto-fix, then commit and push the changes.',
+              '```bash',
+              'task backend:format',
+              '```',
+              '',
+              'Then commit and push the changes.',
             ].join('\n');
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
@@ -115,61 +110,33 @@ jobs:
               });
             }
 
-      - name: Fail if backend format check failed
+      - name: Fail if Java formatting issues found
         if: steps.spotless-check.outcome == 'failure'
         run: |
           echo "============================================"
-          echo "  Backend Format Check Failed"
+          echo "  Java Formatting Check Failed"
           echo "============================================"
           echo ""
-          echo "There are formatting issues in your Java code"
-          echo "that will need to be fixed before they can be"
-          echo "merged in."
+          echo "Your code has formatting issues."
+          echo "Run the following command to fix them:"
           echo ""
-          echo "Run 'task backend:format' to auto-fix, then"
-          echo "commit and push the changes."
+          echo "  task backend:format"
+          echo ""
+          echo "Then commit and push the changes."
           echo "============================================"
           exit 1
 
-      - name: Remove backend format check comment on success
-        if: steps.spotless-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
-      - name: Build with Gradle (flavor=${{ matrix.flavor }})
-        # STIRLING_FLAVOR is read by settings.gradle and expands into the
-        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
-        # so we don't have to set them by hand. The saas flavor pulls in
-        # the app/saas subproject (unit tests only - no runtime tests).
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
         run: task backend:build:ci
         env:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          STIRLING_FLAVOR: ${{ matrix.flavor }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
 
       - name: Check Test Reports Exist
         if: always()
         run: |
-          # Common + core + proprietary always build (proprietary is
-          # excluded only at runtime, not from the gradle subproject
-          # graph). Saas builds add a fourth report dir.
           declare -a dirs=(
             "app/core/build/reports/tests/"
             "app/core/build/test-results/"
@@ -178,9 +145,6 @@ jobs:
             "app/proprietary/build/reports/tests/"
             "app/proprietary/build/test-results/"
           )
-          if [ "${{ matrix.flavor }}" = "saas" ]; then
-            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
-          fi
           for dir in "${dirs[@]}"; do
             if [ ! -d "$dir" ]; then
               echo "Missing $dir"
@@ -192,7 +156,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
           path: |
             app/**/build/reports/jacoco/test
             app/**/build/reports/tests/
@@ -202,47 +166,7 @@ jobs:
           retention-days: 3
           if-no-files-found: warn
 
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml to
-        # silence security scanners that pattern-match on the stdlib
-        # xml.etree.ElementTree.parse call.
-        if: always() && matrix.flavor == 'saas'
-        run: python -m pip install --quiet defusedxml
-
-      - name: JaCoCo coverage step summary
-        # Only the saas leg posts the JUnit summary - it's a strict
-        # superset of the core + proprietary legs (same .exec files plus
-        # the saas subproject). Posting from all three would mean three
-        # near-identical tables crowding out the aggregate report.
-        if: always() && matrix.flavor == 'saas'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
-            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload raw JUnit .exec for aggregate merge
-        # Same dedup rationale as the summary step: upload from the saas
-        # leg only (the most complete set, includes app/saas/.../test.exec)
-        # so the aggregate workflow merges the union rather than three
-        # overlapping subsets.
-        #
-        # Separate artifact from the HTML reports so the aggregate
-        # workflow can grab just the .exec files with a name pattern
-        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
-        # tarball.
-        if: always() && matrix.flavor == 'saas'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
-          path: app/*/build/jacoco/*.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
         # The action only supports the pull_request event (it posts a PR comment),
         # so skip it for merge_group runs and workflow_dispatch.
         if: github.event_name == 'pull_request'

.github/workflows/build-enterprise.yml

@@ -78,7 +78,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install Playwright (chromium only)
         run: task e2e:install -- chromium
       - name: Build frontend (needed for playwright's vite preview webServer)

.github/workflows/build.yml

@@ -68,18 +68,6 @@ jobs:
     uses: ./.github/workflows/backend-build.yml
     secrets: inherit
 
-  db-migration-test:
-    # Boots the current bootJar against H2 fixtures captured from past
-    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
-    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
-    # the `project` filter so doc-only PRs skip this ~5-minute job.
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/db-migration-test.yml
-    secrets: inherit
-
   check-generateOpenApiDocs:
     if: needs.files-changed.outputs.openapi == 'true'
     needs: [files-changed]
@@ -185,24 +173,6 @@ jobs:
     uses: ./.github/workflows/dependency-review.yml
     secrets: inherit
 
-  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
-  # artifacts produced by the jobs above into one report, plus pulls
-  # in vitest + Playwright frontend coverage for the per-area matrix.
-  # `if: always()` so a producer failing partway still gets credit
-  # for whatever did record. Advisory only - intentionally NOT in
-  # all-checks-passed, so a flaky aggregate run never blocks merging.
-  coverage-aggregate:
-    if: always()
-    needs:
-      - build
-      - playwright-e2e-live
-      - docker-compose-tests
-      - frontend-validation
-    permissions:
-      contents: read
-    uses: ./.github/workflows/coverage-aggregate.yml
-    secrets: inherit
-
   # Single status check that branch protection should mark as required.
   # Succeeds when every upstream job is either `success` or `skipped` (path-
   # gated jobs that didn't apply this run). Any `failure` or `cancelled`
@@ -214,7 +184,6 @@ jobs:
     needs:
       - files-changed
       - build
-      - db-migration-test
       - check-generateOpenApiDocs
       - frontend-validation
       - playwright-e2e
@@ -239,7 +208,6 @@ jobs:
           RESULTS: |
             files-changed=${{ needs.files-changed.result }}
             build=${{ needs.build.result }}
-            db-migration-test=${{ needs.db-migration-test.result }}
             check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
             frontend-validation=${{ needs.frontend-validation.result }}
             playwright-e2e=${{ needs.playwright-e2e.result }}

.github/workflows/check-licence.yml

@@ -40,11 +40,11 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check licenses for compatibility
         run: task backend:licenses:check
         env:

.github/workflows/check-openapi.yml

@@ -45,11 +45,11 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Generate OpenAPI documentation
         run: task backend:swagger
         env:

.github/workflows/check_toml.yml

@@ -166,16 +166,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
+            if (changedFiles.includes("frontend/editor/public/locales/en-GB/translation.toml")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/editor/public/locales/en-GB/translation.toml",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-US.toml";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -183,11 +183,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/editor/public/locales/en-GB/translation.toml",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-US.toml";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -293,6 +293,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/coverage-aggregate.yml

@@ -1,230 +0,0 @@
-name: Aggregate backend coverage
-
-# Reusable workflow called from build.yml after every backend coverage
-# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
-# .exec, merges them into one JaCoCo report, and posts a combined step
-# summary alongside the per-source ones.
-#
-# Kept separate from the per-source jobs so:
-#   - the per-source jobs stay fast and independent (no cross-job waits)
-#   - this job can `if: always()` and still produce something useful when
-#     one of the producers fails partway through
-#   - frontend producers can be added later without touching the
-#     producers themselves
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  aggregate:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 15
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.3.1
-          cache-disabled: true
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for coverage scripts
-        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
-        # XML through defusedxml - see the script headers for context.
-        run: python -m pip install --quiet defusedxml
-
-      # Pattern matches every artifact this PR's producers might upload:
-      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
-      #                                         leg of backend-build, which
-      #                                         is a strict superset of the
-      #                                         core + proprietary legs)
-      #   jacoco-exec-e2e-live
-      #   jacoco-exec-cucumber
-      # Each lands as a sibling dir under coverage-execs/, with the .exec
-      # files preserving their original relative paths.
-      - name: Download all .exec artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          pattern: jacoco-exec-*
-          path: coverage-execs/
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Inventory .exec files
-        id: inventory
-        # Splits the downloaded artifacts into two buckets:
-        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
-        #   * all       = the above plus JUnit (everything we test)
-        #
-        # Bucketing is by artifact-name prefix: download-artifact preserves
-        # the artifact name as the top-level dir, so JUnit's `.exec`s live
-        # under coverage-execs/jacoco-exec-junit-*/... while the others
-        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
-        #
-        # If nothing was uploaded (e.g. all producers crashed before
-        # writing) we exit gracefully so this advisory job never fails CI.
-        run: |
-          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
-          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
-          if [ "${#all_execs[@]}" -eq 0 ]; then
-            echo "::warning::No .exec artifacts found - skipping aggregate report"
-            echo "found_all=false" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          printf 'All %d .exec files:\n' "${#all_execs[@]}"
-          printf '  %s\n' "${all_execs[@]}"
-          IFS=','; all_joined="${all_execs[*]}"
-          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
-          echo "found_all=true" >> "$GITHUB_OUTPUT"
-          if [ "${#e2e_execs[@]}" -eq 0 ]; then
-            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-          else
-            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
-            printf '  %s\n' "${e2e_execs[@]}"
-            unset IFS
-            IFS=','; e2e_joined="${e2e_execs[*]}"
-            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Compile classes for JaCoCo class lookup
-        # jacocoReportFromExec only needs the compiled .class files
-        # under each subproject's build/classes/java/main/. `classes`
-        # (compileJava + processResources) is enough; we skipped the
-        # heavier `assemble` to avoid building bootJar / fat jars that
-        # add 60+ seconds per run for no gain to the report.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: ./gradlew classes -PnoSpotless
-
-      - name: Generate e2e-only JaCoCo report
-        # "Real user-flow" coverage: only counts code reached by an actual
-        # HTTP request from cucumber or live Playwright. Useful for
-        # questions like "how much of our backend does a user actually
-        # hit?". Skipped when neither producer uploaded a .exec.
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
-            -PreportDir=build/reports/jacoco/aggregate-e2e \
-            -PnoSpotless
-
-      - name: Generate combined JaCoCo report (everything)
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
-            -PreportDir=build/reports/jacoco/aggregate-all \
-            -PnoSpotless
-
-      - name: E2E-only step summary
-        # Rendered first so it gets prime real estate in the Summary
-        # tab - this is the number most readers actually want
-        # ("how much of the backend do real user flows cover?").
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: ALL-sources step summary
-        # Separate call (not a multi-input one) because the helper's
-        # rightmost "Aggregate" column would sum the two reports - which
-        # is meaningless when one is a strict superset of the other.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload combined aggregate report
-        if: steps.inventory.outputs.found_all == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-all-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-all/
-          retention-days: 14
-
-      - name: Upload e2e-only aggregate report
-        if: steps.inventory.outputs.found_e2e == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-e2e-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-e2e/
-          retention-days: 14
-
-      # --------------------------------------------------------------
-      # Per-area matrix: rolls backend + frontend coverage into one
-      # table indexed by core/proprietary/saas/desktop. Pulls the
-      # frontend artifacts now (after the JaCoCo step has done its
-      # work) so the per-source backend summaries still render first
-      # even if the matrix step fails.
-      # --------------------------------------------------------------
-      - name: Download vitest coverage artifact
-        # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence so a backend-only PR still produces the matrix with
-        # just backend rows populated.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: frontend-coverage
-          path: matrix-inputs/vitest/
-        continue-on-error: true
-
-      - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads as `playwright-frontend-coverage-<run_id>`.
-        # Same tolerance as vitest - matrix script handles missing inputs.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: matrix-inputs/playwright/
-        continue-on-error: true
-
-      - name: Coverage matrix step summary
-        if: always()
-        # Matrix references the two aggregate JaCoCo XMLs (already
-        # generated above) plus whichever frontend artifacts landed.
-        # Every input is optional; missing ones render as "-".
-        run: |
-          python scripts/coverage-matrix.py \
-            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
-            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
-            --vitest matrix-inputs/vitest/coverage-summary.json \
-            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
-            --title "Coverage matrix (per-area, e2e vs all)" \
-            --github-step-summary

.github/workflows/db-migration-test.yml

@@ -1,95 +0,0 @@
-name: DB migration smoke test
-
-# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
-# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
-# Catches schema changes that would break existing user databases under
-# Hibernate's `ddl-auto=update` upgrade path.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  migration-test:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    timeout-minutes: 30
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: 25
-          distribution: temurin
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.5.1
-          cache-disabled: true
-
-      # No `-PnoSpotless` here yet because the upstream cache layer matches the
-      # backend build's; reuse keeps cold-cache cost identical.
-      - name: Build Stirling-PDF JAR
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:quarkusBuild -PnoSpotless --no-daemon
-
-      - name: Locate built JAR
-        id: jar
-        run: |
-          # Quarkus (quarkus.package.jar.type=uber-jar) emits a standalone runnable
-          # jar at app/core/build/<name>-runner.jar, replacing the Spring Boot bootJar
-          # that used to land in app/core/build/libs.
-          jar=$(find app/core/build -maxdepth 1 -name '*-runner.jar' 2>/dev/null | head -n 1)
-          if [[ -z "$jar" ]]; then
-            echo "::error::No *-runner.jar under app/core/build"
-            ls -lah app/core/build || true
-            exit 1
-          fi
-          # Absolute path - the migration script pushd's into a temp workdir
-          # before invoking java, which would dangle a relative path.
-          jar=$(realpath "$jar")
-          echo "path=$jar" >> "$GITHUB_OUTPUT"
-          echo "Built JAR: $jar"
-
-      - name: Run migration smoke test
-        env:
-          STIRLING_JAR: ${{ steps.jar.outputs.path }}
-        run: bash scripts/db-migration/run-migration-test.sh
-
-      - name: Upload app logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: db-migration-app-logs
-          # Path matches the preserved workdir in run-migration-test.sh -
-          # only failing fixtures leave a directory behind.
-          path: /tmp/stirling-migration-failed-*/app.log
-          retention-days: 7
-          if-no-files-found: warn

.github/workflows/deploy-on-v2-commit.yml

@@ -107,7 +107,7 @@ jobs:
 
       - name: Build and push frontend image (Depot)
         if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -136,7 +136,7 @@ jobs:
 
       - name: Build and push backend image (Depot)
         if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -188,7 +188,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF V2"
                 UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
                 UI_APPNAMENAVBAR: "V2 Deployment"

.github/workflows/docker-compose-tests.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Set up Docker Buildx
@@ -87,12 +87,6 @@ jobs:
         run: |
           pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
 
-      - name: Extract JaCoCo agent for cucumber coverage
-        # Stages build/jacoco/jacocoagent.jar where the coverage override
-        # file bind-mounts it into the cucumber container. The agent jar
-        # never goes into the published image - this is host-only.
-        run: ./gradlew copyJacocoAgent -PnoSpotless
-
       - name: Run Docker Compose Tests
         run: |
           chmod +x ./testing/test_webpages.sh
@@ -104,62 +98,6 @@ jobs:
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
-          # over the cucumber compose so the container starts with the
-          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
-          STIRLING_PDF_TEST_COVERAGE: "1"
-
-      - name: Generate cucumber JaCoCo report
-        # `if: always()` so a behave failure still produces partial
-        # coverage from whatever endpoints did run. The exec file only
-        # exists when the container shut down cleanly - guard so the step
-        # is silent on the (rare) crash path.
-        if: always()
-        id: cucumber-coverage
-        run: |
-          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=testing/cucumber-coverage/cucumber.exec \
-              -PreportDir=build/reports/jacoco/cucumber \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml -
-        # see the script header for context.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-
-      - name: Cucumber coverage step summary
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Cucumber (docker) JaCoCo coverage" \
-            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload cucumber JaCoCo report
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-cucumber-${{ github.run_id }}
-          path: build/reports/jacoco/cucumber/
-          retention-days: 7
-
-      - name: Upload raw cucumber .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-cucumber
-          path: testing/cucumber-coverage/cucumber.exec
-          retention-days: 7
-          if-no-files-found: warn
 
       - name: Upload Cucumber Report
         if: always()

.github/workflows/e2e-live.yml

@@ -42,139 +42,16 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install Playwright (chromium only)
         run: task e2e:install -- chromium
       - name: Build frontend (production bundle for vite preview)
         env:
           VITE_BUILD_FOR_PREVIEW: "1"
         run: task frontend:build
-      - name: Run live E2E tests (chromium) with coverage
+      - name: Run live E2E tests (chromium)
         id: live-tests
-        env:
-          # Attaches the JaCoCo agent to the bootRun JVM (see
-          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
-          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
-          # report step below sees a populated file.
-          COVERAGE: "1"
-          # Tells the Playwright fixture (test-base.ts) to capture per-test
-          # V8 JS coverage. Raw dumps land under
-          # .test-state/playwright/coverage-pw/ for the post-process step
-          # to aggregate. Chromium-only - other engines silently skip.
-          PW_COVERAGE: "1"
         run: task e2e:live
-      - name: Generate JaCoCo report from e2e:live .exec
-        if: always()
-        id: live-coverage
-        # `if: always()` so even a failed test run still produces a
-        # report from whatever flows did exercise the backend before
-        # the failure. The task itself tolerates a missing .exec
-        # (jacoco emits an empty report rather than crashing) but we
-        # guard with `test -s` to keep the job log clean.
-        run: |
-          if [ -s .test-state/playwright/jacoco.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=.test-state/playwright/jacoco.exec \
-              -PreportDir=build/reports/jacoco/e2e-live \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set up Python for coverage summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
-        # to dodge XXE / billion-laughs scanner findings.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-      - name: e2e:live coverage step summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live backend) JaCoCo coverage" \
-            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
-            --github-step-summary
-      - name: Upload e2e:live JaCoCo report
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-e2e-live-${{ github.run_id }}
-          path: build/reports/jacoco/e2e-live/
-          retention-days: 7
-
-      - name: Upload raw e2e:live .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-e2e-live
-          path: .test-state/playwright/jacoco.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Set up Python for frontend coverage summary
-        # Separate from the backend-coverage python step because the
-        # frontend path doesn't depend on a JaCoCo report - it produces
-        # a summary even on backend failure, as long as some Playwright
-        # tests ran far enough to dump V8 coverage.
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for frontend coverage summary
-        # Idempotent re-install: the backend-coverage step may have
-        # installed it already, but this leg can run on its own when the
-        # backend report step skips (e.g. .exec missing).
-        if: always()
-        run: python -m pip install --quiet defusedxml
-
-      - name: Aggregate Playwright frontend (V8) coverage
-        # Rolls per-test V8 dumps from the test-base fixture into one
-        # vitest-shaped coverage-summary.json. Tolerates a missing dump
-        # dir (firefox/webkit runs, or a failure before any test got
-        # far enough to dump).
-        if: always()
-        id: pw-frontend-coverage
-        run: |
-          if [ -d .test-state/playwright/coverage-pw ] && \
-             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            python scripts/playwright-coverage-summary.py \
-              .test-state/playwright/coverage-pw \
-              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
-            echo "summary=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
-            echo "summary=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Playwright frontend coverage step summary
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live) frontend coverage" \
-            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-            --github-step-summary
-
-      - name: Upload Playwright frontend coverage
-        # Bundle both the aggregated summary and the raw V8 dumps so
-        # someone debugging "why is this function showing as covered"
-        # can trace it back to the source dump.
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: |
-            .test-state/playwright/coverage-pw-summary/
-            .test-state/playwright/coverage-pw/
-          retention-days: 7
-
       - name: Print backend log on failure
         if: failure() && steps.live-tests.conclusion == 'failure'
         run: |
@@ -188,30 +65,10 @@ jobs:
           name: backend-log-live-${{ github.run_id }}
           path: .test-state/playwright/backend.log
           retention-days: 7
-      - name: List Playwright output locations (debug)
-        if: always()
-        run: |
-          echo "::group::Playwright output dirs"
-          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend/editor has
-          # none), so artifacts land under frontend/, not frontend/editor/.
-          ls -la frontend/playwright-report 2>/dev/null \
-            || echo "no playwright-report at frontend/"
-          ls -la frontend/test-results 2>/dev/null \
-            || echo "no test-results at frontend/"
-          find . -name node_modules -prune -o -name 'trace.zip' -print 2>/dev/null || true
-          echo "::endgroup::"
-      - name: Upload Playwright report + traces
+      - name: Upload Playwright report
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report-live-${{ github.run_id }}
-          # test-results/ holds the per-test trace.zip (with browser console
-          # logs) + screenshots/video; playwright-report/ is the HTML report.
-          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend/editor has none).
-          path: |
-            frontend/playwright-report/
-            frontend/test-results/
+          path: frontend/editor/playwright-report/
           retention-days: 7
-          if-no-files-found: warn

.github/workflows/e2e-stubbed.yml

@@ -36,7 +36,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install Playwright (chromium only)
         run: task e2e:install -- chromium
       - name: Build frontend (production bundle for vite preview)

.github/workflows/frontend-backend-licenses-update.yml

@@ -97,7 +97,7 @@ jobs:
         run: npm ci --ignore-scripts --audit=false --fund=false
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Generate frontend license report (internal PR)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
         env:
@@ -110,8 +110,8 @@ jobs:
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
         working-directory: frontend
         run: |
-          mkdir -p editor/src/assets
-          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json
 
       - name: Postprocess with project script (BASE version)
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
@@ -349,10 +349,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Check licenses and generate report
         id: license-check
         run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV

.github/workflows/frontend-validation.yml

@@ -31,7 +31,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Quality-check frontend
         id: frontend-check
         run: task frontend:check:all
@@ -109,41 +109,6 @@ jobs:
                 comment_id: existing.id,
               });
             }
-      - name: Vitest coverage
-        # Separate from `frontend:check:all` so the quality-gate run stays
-        # uninstrumented (faster signal) and coverage stays an informational
-        # follow-up. Continue-on-error keeps the workflow green even when
-        # a handful of test files refuse to import (e.g. missing icon
-        # specifiers) - the summary still gets posted with whatever
-        # vitest managed to instrument.
-        id: frontend-coverage
-        continue-on-error: true
-        run: task frontend:test:coverage
-      - name: Set up Python for coverage summary
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # See coverage-summary.py header - it parses XML through defusedxml
-        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
-        if: always()
-        run: python -m pip install --quiet defusedxml
-      - name: Vitest coverage step summary
-        if: always()
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Frontend Vitest coverage" \
-            --vitest frontend/editor/coverage/coverage-summary.json \
-            --github-step-summary
-      - name: Upload vitest coverage report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-coverage
-          path: frontend/editor/coverage/
-          retention-days: 7
-          if-no-files-found: warn
       - name: Upload frontend build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

.github/workflows/multiOSReleases.yml

@@ -73,10 +73,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Get version number
         id: versionNumber
         run: |
@@ -148,7 +148,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
@@ -159,7 +159,7 @@ jobs:
           cache-dependency-path: frontend/package-lock.json
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Build JAR
         run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
@@ -252,10 +252,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       # Build the universal JRE before desktop:prepare so the jlink:runtime
       # task short-circuits on its `test -d runtime/jre` status check.
@@ -442,6 +442,10 @@ jobs:
           echo "Generated tauri.windows.conf.json (alias masked):"
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
 
+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+
       - name: Import release GPG signing key (Linux)
         if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
         run: |
@@ -491,7 +495,6 @@ jobs:
           projectPath: ./frontend/editor
           tauriScript: npx tauri
           args: ${{ matrix.args }}
-          updaterJsonKeepUniversal: true
 
       - name: Clear release GPG key from runner keyring (Linux)
         if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -583,37 +586,21 @@ jobs:
         if: always() && steps.digicert-setup.conclusion != 'failure'
         shell: bash
         run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
+          mkdir -p ./dist
           cd ./frontend/editor/src-tauri/target
 
-          echo "=== tauri bundle artifacts ==="
-          find . -path "*/bundle/*" \( -name "*.msi" -o -name "*.deb" \
-            -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.dmg" \
-            -o -name "*.app.tar.gz" -o -name "*.sig" \) 2>/dev/null | sort || true
-          echo "=============================="
-
-          # createUpdaterArtifacts:true signs the native installers in place;
-          # each <bundle> ships with a sibling <bundle>.sig consumed by latest.json.
+          # Find and rename artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
-            find . -name "*.msi.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi.sig" \;
+            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
+            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            # DMG = manual install; .app.tar.gz (+ .sig) = updater payload.
-            # Raw .app is intentionally not shipped (hundreds of MB of uncompressed input).
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app.tar.gz" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz" \;
-            find . -name "*.app.tar.gz.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz.sig" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
           else
-            # The raw .AppImage IS its updater payload (signed -> .AppImage.sig),
-            # not a .tar.gz wrapper - that's only produced under v1Compatible.
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.deb.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb.sig" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.rpm.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm.sig" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-            find . -name "*.AppImage.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage.sig" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
       - name: Upload build artifacts
@@ -624,7 +611,8 @@ jobs:
           path: ./dist/*
           retention-days: 1
 
-  collect-and-release:
+  create-release:
+    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
     needs: [pick, determine-matrix, build, build-jars]
     runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
     permissions:
@@ -635,16 +623,6 @@ jobs:
         with:
           egress-policy: audit
 
-      # Sparse-check out the verifier + pubkey before the artifact downloads
-      # so the checkout cannot clobber ./artifacts.
-      - name: Checkout updater verifier
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          sparse-checkout: |
-            .github/scripts/verify-updater-signatures.py
-            frontend/editor/src-tauri/tauri.conf.json
-          sparse-checkout-cone-mode: false
-
       - name: Download all Tauri artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -672,146 +650,17 @@ jobs:
       - name: Display structure of downloaded files
         run: ls -R ./artifacts
 
-      # tauri-action only emits latest.json when it also publishes the release
-      # (tagName/releaseId set). We publish separately via action-gh-release,
-      # so build latest.json here from the per-platform .sig files.
-      - name: Generate updater latest.json
-        env:
-          VERSION: ${{ needs.determine-matrix.outputs.version }}
-          TAG: v${{ needs.determine-matrix.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: |
-          python3 - << 'PYEOF'
-          import json, os, sys
-          from pathlib import Path
-          from datetime import datetime, timezone
-
-          VERSION = os.environ['VERSION']
-          TAG = os.environ['TAG']
-          REPO = os.environ['REPO']
-
-          ART = Path('./artifacts/tauri')
-
-          # Tauri updater looks up {os}-{arch}-{installer} (e.g. linux-x86_64-deb)
-          # before bare {os}-{arch}, so per-format Linux keys let deb/rpm/appimage
-          # each self-update from their matching file. macOS universal serves both
-          # arches from the one .app.tar.gz.
-          PLATFORM_MAP = [
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.deb'],
-                  'targets': ['linux-x86_64-deb'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.rpm'],
-                  'targets': ['linux-x86_64-rpm'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.AppImage'],
-                  'targets': ['linux-x86_64-appimage'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-windows-x86_64.msi'],
-                  'targets': ['windows-x86_64-msi', 'windows-x86_64'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-macos-universal.app.tar.gz'],
-                  'targets': ['darwin-x86_64', 'darwin-aarch64'],
-              },
-          ]
-
-          # rglob() because download-artifact varies layout: one artifact -> flat,
-          # many -> nested under <artifact-name>/.
-          def find_signed(name):
-              for bundle_path in sorted(ART.rglob(name)):
-                  sig_path = bundle_path.with_name(bundle_path.name + '.sig')
-                  if sig_path.exists():
-                      return bundle_path, sig_path
-              return None
-
-          platforms = {}
-          skipped = []
-          for entry in PLATFORM_MAP:
-              picked = None
-              for name in entry['bundles']:
-                  picked = find_signed(name)
-                  if picked:
-                      break
-              if not picked:
-                  skipped.append(
-                      f"{entry['targets']} (no signed bundle among "
-                      f"{entry['bundles']} - TAURI_SIGNING_PRIVATE_KEY unset "
-                      f"or createUpdaterArtifacts disabled?)"
-                  )
-                  continue
-              bundle_path, sig_path = picked
-              signature = sig_path.read_text(encoding='utf-8').strip()
-              url = f"https://github.com/{REPO}/releases/download/{TAG}/{bundle_path.name}"
-              for target in entry['targets']:
-                  platforms[target] = {'signature': signature, 'url': url}
-              print(f"Added {entry['targets']} from {bundle_path.name}")
-
-          if skipped:
-              print("Skipped platforms:")
-              for s in skipped:
-                  print(f"  - {s}")
-
-          if not platforms:
-              print(
-                  "WARN: no signed updater bundles found - "
-                  "skipping latest.json generation"
-              )
-              sys.exit(0)
-
-          manifest = {
-              'version': VERSION,
-              'notes': f"See https://github.com/{REPO}/releases/tag/{TAG}",
-              'pub_date': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'),
-              'platforms': platforms,
-          }
-
-          out = Path('./artifacts/latest.json')
-          out.write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
-          print(f"Generated {out} with platforms: {sorted(platforms.keys())}")
-          PYEOF
-
-      - name: Upload merged artifacts for review
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: release-artifacts
-          path: ./artifacts/
-          retention-days: 7
-
-      # Gate publish on valid updater sigs. Runs after the review upload (so
-      # artifacts survive for debugging) and before action-gh-release.
-      - name: Verify updater signatures
-        run: |
-          python3 -m pip install --quiet 'cryptography==44.0.0'
-          python3 .github/scripts/verify-updater-signatures.py \
-            ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
-
-      # workflow_dispatch path requires platform=='all' so a single-platform
-      # dispatch can't overwrite an existing release's full latest.json with a
-      # partial one (action-gh-release defaults overwrite_files:true).
-      # release / V2-master always build the full matrix so no extra guard needed.
-      # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
-      # instead of silently shipping a broken auto-update.
       - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
           generate_release_notes: true
-          fail_on_unmatched_files: true
-          # Installers + updater payloads + manifest. .sig contents are embedded
-          # in latest.json so the .sig files themselves are not uploaded.
           files: |
             ./artifacts/**/*.jar
             ./artifacts/**/*.msi
             ./artifacts/**/*.dmg
-            ./artifacts/**/*.app.tar.gz
             ./artifacts/**/*.deb
             ./artifacts/**/*.rpm
             ./artifacts/**/*.AppImage
-            ./artifacts/latest.json
           draft: false
           prerelease: false

.github/workflows/nightly.yml

@@ -37,7 +37,7 @@ jobs:
           cache-dependency-path: frontend/package-lock.json
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Install all Playwright browsers
         run: task e2e:install
 

.github/workflows/pre_commit.yml

@@ -1,7 +1,8 @@
 name: Pre-commit
 
-# Runs the repo-wide lint/format/secret checks via `task pre-commit`.
-# Called from build.yml on PRs and merge_group; also runnable on demand via workflow_dispatch.
+# Runs `pre-commit run` for ruff / codespell / gitleaks / EOF / trailing-ws.
+# Called from build.yml on PRs and merge_group; also runnable on demand via
+# workflow_dispatch for manual local-equivalent linting.
 on:
   workflow_call:
   workflow_dispatch:
@@ -12,6 +13,10 @@ permissions:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -24,13 +29,23 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          enable-cache: true
+          python-version: 3.12
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt
 
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Run Pre-Commit Hooks
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt
 
-      - name: Run pre-commit checks
-        run: task pre-commit
+      - name: Run Pre-Commit
+        run: |
+          pre-commit run ruff --all-files -c .pre-commit-config.yaml
+          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
+          pre-commit run codespell --all-files -c .pre-commit-config.yaml
+          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
+          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
+          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
+          git diff --exit-code

.github/workflows/push-docker-base.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Generate tags for base image
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base

.github/workflows/push-docker.yml

@@ -78,14 +78,14 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -129,7 +129,7 @@ jobs:
       - name: Generate tags for latest
         id: meta
         if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: |
             ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -178,7 +178,7 @@ jobs:
 
       - name: Generate tags for latest-fat
         id: meta-fat
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |
@@ -222,7 +222,7 @@ jobs:
 
       - name: Generate tags for ultra-lite
         id: meta-lite
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
         with:
           images: |

.github/workflows/stale.yml

@@ -22,7 +22,7 @@ jobs:
           egress-policy: audit
 
       - name: 30 days stale issues
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/swagger.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -63,7 +63,7 @@ jobs:
           SWAGGERHUB_USER: "Frooodle"
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Get version number
         id: versionNumber
         run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT

.github/workflows/sync_files_v2.yml

@@ -58,23 +58,15 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          enable-cache: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt
 
       - name: Sync translation TOML files
         run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-GB/translation.toml" --branch main
 
-      - name: Sort translation TOML files
+      - name: pre-commit run
         run: |
-          task pre-commit:toml-sort FIX=1
+          pre-commit run toml-sort-fix --all-files
 
       - name: Commit translation files
         run: |
@@ -108,7 +100,7 @@ jobs:
             This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
+            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
             - **Format**: TOML

.github/workflows/tauri-build.yml

@@ -136,10 +136,10 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Setup Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
 
       - name: Build universal macOS JRE
         if: matrix.platform == 'macos-15'
@@ -157,9 +157,6 @@ jobs:
           JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
         run: task desktop:prepare
 
-      - name: Run Tauri/Cargo tests
-        run: task desktop:test
-
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
@@ -271,6 +268,10 @@ jobs:
           echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> $GITHUB_ENV
           echo "Certificate imported successfully."
 
+      - name: Sign JPDFium dylibs inside bootJar (macOS only)
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        run: bash frontend/scripts/sign-jpdfium-dylibs-in-bootjar.sh
+
       - name: Check DMG creation dependencies (macOS only)
         if: matrix.platform == 'macos-15'
         run: |
@@ -416,22 +417,20 @@ jobs:
       - name: Rename artifacts
         shell: bash
         run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
+          mkdir -p ./dist
           cd ./frontend/editor/src-tauri/target
 
           # Find and rename artifacts based on platform
           if [ "${{ matrix.platform }}" = "windows-latest" ]; then
             # Only ship the MSI installer. The loose exe and WiX toolset exes
             # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
           elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
           else
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
           fi
 
       # Verify the MSI AND the inner exe extracted from it are signed.

.github/workflows/test-build-docker.yml

@@ -106,11 +106,11 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
           cache-disabled: true
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
       - name: Build application
         run: task backend:build
         env:
@@ -157,7 +157,7 @@ jobs:
 
       - name: Build ${{ matrix.docker-rev }} (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -230,7 +230,7 @@ jobs:
 
       - name: Build docker/unoserver/Dockerfile (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .

.github/workflows/testdriver.yml

@@ -51,7 +51,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.5.1
+          gradle-version: 9.3.1
 
       - name: Build with Gradle
         run: ./gradlew build
@@ -83,7 +83,7 @@ jobs:
 
       - name: Build and push test image (Depot)
         if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
+        uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.16.0
         with:
           project: ${{ vars.DEPOT_PROJECT_ID }}
           context: .
@@ -129,7 +129,7 @@ jobs:
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "true"
                 SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                 UI_APPNAME: "Stirling-PDF Test"
                 UI_HOMEDESCRIPTION: "Test Deployment"
                 UI_APPNAMENAVBAR: "Test"

.gitignore

@@ -23,10 +23,6 @@ customFiles/
 configs/
 watchedFolders/
 clientWebUI/
-# Scratch dir used by local fixture-regeneration runs (see
-# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
-# Holds downloaded JARs and disposable workdirs. Never committed.
-.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
@@ -42,20 +38,10 @@ SwaggerDoc.json
 # Runtime storage for uploaded files and user data (not Java source code)
 app/core/storage/
 
-# Frontend build artifacts copied to Quarkus static resources
-# Generated by `npm build` + the copyFrontendAssets/copyFrontendIndexHtml tasks; never committed.
-# The React bundle goes to META-INF/resources/ (Quarkus serves these over HTTP); index.html is the
-# only generated file in static/ (ReactRoutingController serves it). See app/core/build.gradle.
-app/core/src/main/resources/META-INF/resources/
-app/core/src/main/resources/static/index.html
-# Migration cleanup: earlier builds emitted the whole bundle into static/. Keep these ignored so
-# any stale generated assets left in static/ are not accidentally committed.
+# Frontend build artifacts copied to backend static resources
+# These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
-# Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
-app/core/src/main/resources/static/*.html
-!app/core/src/main/resources/static/api-landing.html
-# Prerendered nested-route pages (e.g. settings/people.html)
-app/core/src/main/resources/static/settings/
+app/core/src/main/resources/static/index.html
 app/core/src/main/resources/static/locales/
 app/core/src/main/resources/static/Login/
 app/core/src/main/resources/static/classic-logo/
@@ -63,15 +49,11 @@ app/core/src/main/resources/static/modern-logo/
 app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/sw-folder-retry.js
 app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
-app/core/src/main/resources/static/**/*.gz
-app/core/src/main/resources/static/**/*.br
-# Note: Keep backend-managed files like fonts/, css/, js/, etc.
+# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
 
 # Gradle
 .gradle
@@ -192,6 +174,7 @@ venv.bak/
 
 # Env files (secrets / local overrides). Subproject .gitignore files whitelist any committed defaults.
 .env*
+!.env.saas.example
 
 # VS Code
 /.vscode/**/*
@@ -226,7 +209,7 @@ out/
 *.asc
 
 # Allow test fixture certificates (synthetic, no real credentials)
-!frontend/editor/src/core/tests/test-fixtures/certs/**
+!frontend/src/core/tests/test-fixtures/certs/**
 
 # SSH Keys
 *.pub
@@ -268,7 +251,7 @@ node_modules/
 *compact*.json
 test_batch.json
 *.backup.*.json
-frontend/editor/public/locales/*/translation.backup*.json
+frontend/public/locales/*/translation.backup*.json
 
 # Development/build artifacts
 .gradle-cache/
@@ -285,27 +268,9 @@ docs/type3/signatures/
 
 **/application-dev-local.properties
 
-# AI agent session/local files - may contain tokens and secrets
+# Claude
 .claude/
-.agents/
-.cursor/
-.codex/
-.opencode/
-.copilot/
-.cline/
-.continue/
-.windsurf/
-.junie/
-.pi/
-.roo/
-.augment/
-.aider*
-CLAUDE.local.md
-skills-lock.json
 
 # Playwright MCP screenshots / traces
 .playwright-mcp/
 *.playwright-mcp.png
-
-# Local screenshot artifacts from *-screenshots.spec.ts
-frontend/editor/screenshots/

.gitleaksignore

@@ -1,21 +0,0 @@
-# PostHog project-level key - phc_ prefix keys are public/client-side by design
-# (PostHog client-side tracking embeds them in the browser bundle). Committed
-# intentionally in #6150 so engine/.env has a working default, with real
-# credentials overridden via engine/.env.local.
-engine/.env:generic-api-key:41
-
-# MCP test fixtures / harness - no real secrets:
-# - test-only API key constant in an integration test
-# - JDBC URL + throwaway Keycloak creds in the local test compose
-# - placeholder / shell-variable Bearer headers in curl-based validation scripts
-app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
-testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
-testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
-testing/compose/validate-mcp-test.sh:curl-auth-header:92
-testing/compose/validate-mcp-test.sh:curl-auth-header:116
-
-# Storybook example showing curl with a fake Bearer token placeholder (sk_live_a3f8...).
-frontend/shared/components/CodeBlock.stories.tsx:curl-auth-header:4
-
-# Truncated placeholder API key in portal docs example (sk_live_8f2c...e10) - not a real secret.
-frontend/portal/src/components/docs/GettingStartedSection.tsx:generic-api-key:31

.pre-commit-config.yaml

@@ -1,14 +1,52 @@
-# The actual checks live in .taskfiles/pre-commit.yml (with helper scripts under
-# scripts/pre-commit/) and are driven by Task. This hook just delegates to `task
-# pre-commit` so the git pre-commit hook, CI and a manual `task pre-commit` all
-# run the exact same thing. Requires `task` and `uv` on PATH. To auto-fix instead
-# of only checking, run `task pre-commit:fix`.
 repos:
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.14
     hooks:
-      - id: task-pre-commit
-        name: task pre-commit
-        entry: task pre-commit
-        language: system
-        pass_filenames: false
-        always_run: true
+      - id: ruff
+        args:
+          - --fix
+          - --line-length=127
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+      - id: ruff-format
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.2
+    hooks:
+      - id: codespell
+        args:
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment
+          - --skip="./.*,*.csv,*.json,*.ambr"
+          - --quiet-level=2
+        files: \.(html|css|js|py|md)$
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/editor/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+      - id: trailing-whitespace
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+  - repo: https://github.com/pappasam/toml-sort
+    rev: v0.24.4
+    hooks:
+      - id: toml-sort-fix
+        files: frontend/editor/public/locales/.*\.toml$
+        args: ['--in-place', '--all', '--ignore-case']
+  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
+  #   rev: v16.21.1
+  #   hooks:
+  #     - id: stylelint
+  #       additional_dependencies:
+  #         - stylelint@16.21.1
+  #         - stylelint-config-standard@38.0.0
+  #         - "@stylistic/stylelint-plugin@3.1.3"
+  #       files: \.(css)$
+  #       args: [--fix]

.taskfiles/backend.yml

@@ -18,28 +18,16 @@ version: '3'
 tasks:
   dev:
     desc: "Start backend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-
-  dev:proprietary:
-    desc: "Start backend dev server in proprietary mode"
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
       AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
     env:
       SERVER_PORT: '{{.PORT}}'
     cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
         platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}./gradlew :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}./gradlew :stirling-pdf:bootRun'
         platforms: [linux, darwin]
 
   dev:bundled:
@@ -52,24 +40,18 @@ tasks:
         platforms: [linux, darwin]
 
   dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
+    desc: "Start backend in SaaS flavor against Supabase (loads .env.saas.local)"
     # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
+    # subtaskfile is included with `dir: .`. Drop the file at the repo root.
+    dotenv: ['.env.saas.local']
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
       # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
       PROFILES: '{{.PROFILES | default "dev"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
     env:
       SERVER_PORT: '{{.PORT}}'
       STIRLING_FLAVOR: saas
-      AIENGINE_URL: '{{.AIENGINE_URL}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
     cmds:
       - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
         platforms: [windows]

.taskfiles/desktop.yml

@@ -1,9 +1,7 @@
 version: '3'
 
 vars:
-  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
-  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
+  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"
 
   # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
   JPDFIUM_PLATFORMS:
@@ -64,28 +62,21 @@ tasks:
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles app
 
   build:dev:windows:
     desc: "Build Tauri desktop NSIS installer (Windows)"
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles nsis
 
   build:dev:linux:
     desc: "Build Tauri desktop AppImage (Linux)"
     deps: [prepare]
     dir: editor
     cmds:
-      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  test:
-    desc: "Run Tauri/Cargo tests"
-    deps: [prepare]
-    dir: editor/src-tauri
-    cmds:
-      - cargo test
+      - npx tauri build --bundles appimage
 
   clean:
     desc: "Clean Tauri/Cargo build artifacts"
@@ -127,38 +118,16 @@ tasks:
     cmds:
       - rm -rf runtime/jre
       - mkdir -p runtime
-      - |
-        JLINK_COMPRESS="$(jlink --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-        jlink \
-          --add-modules {{.JLINK_MODULES}} \
-          --strip-debug \
-          --compress="$JLINK_COMPRESS" \
-          --no-header-files \
-          --no-man-pages \
-          --output runtime/jre
-      # jlink emits its files mode 444 (read-only). Tauri's build-script
-      # resource copier preserves source permissions when staging
-      # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
-      # staged copies are read-only too. On any subsequent incremental
-      # build the copier tries to overwrite them and fails with a bare
-      # `Permission denied (os error 13)` (Rust's io::Error Display drops
-      # the path, so the failure is opaque). Make the source writable here
-      # so the staged destinations are writable and can be overwritten.
-      #
-      # Trade-off: this task runs for both `task desktop:dev` and
-      # `task desktop:build`, so production bundles also ship mode-644
-      # JRE files instead of 444. Functionally harmless on POSIX (the
-      # `other` bit is `r--` either way, and on macOS code signing is the
-      # real integrity check) and on Windows the DOS read-only attribute
-      # isn't load-bearing for the bundled JDK. If we ever need strict
-      # 444 in production, split the chmod into a dev-only step and have
-      # `desktop:build` run `jlink:clean` first to force a fresh build.
-      - cmd: chmod -R u+w runtime/jre
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
-        platforms: [windows]
+      - >-
+        jlink
+        --add-modules {{.JLINK_MODULES}}
+        --strip-debug
+        --compress=zip-6
+        --no-header-files
+        --no-man-pages
+        --output runtime/jre
     status:
-      - test -f runtime/jre/release
+      - test -d editor/src-tauri/runtime/jre
 
   jlink:clean:
     desc: "Remove JLink runtime and bundled JARs"

.taskfiles/docker.yml

@@ -20,11 +20,6 @@ tasks:
     cmds:
       - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .
 
-  build:backend:
-    desc: "Build backend-only Docker image (no embedded frontend)"
-    cmds:
-      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
-
   build:frontend:
     desc: "Build frontend-only Docker image"
     cmds:

.taskfiles/e2e.yml

@@ -34,9 +34,6 @@ tasks:
     ignore_error: true
     vars:
       BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
-    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
-    # Off by default to keep local dev runs uninstrumented; CI flips it.
     env:
       STIRLING_BASE_PATH: '{{.BASE_DIR}}'
       # Suppress the analytics opt-in modal that fires on first admin login.
@@ -61,19 +58,12 @@ tasks:
           set -e
           rm -rf "{{.BASE_DIR}}"
           mkdir -p "{{.BASE_DIR}}"
-          GRADLE_ARGS=":stirling-pdf:bootRun"
-          if [ -n "${COVERAGE:-}" ]; then
-            # copyJacocoAgent is wired as a dependency of bootRun when
-            # -PjacocoAgent=true, so we do not need to invoke it separately.
-            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
-            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
-          fi
           # Background gradle and record its PID so the runner can clean up
           # the exact process tree (wrapper + forked Spring Boot JVM) without
           # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
           # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
           # synchronised.
-          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
+          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
           GRADLE_PID=$!
           echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
           wait $GRADLE_PID
@@ -212,55 +202,3 @@ tasks:
     desc: "Stop the SAML keycloak test environment"
     cmds:
       - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
-
-  mcp:up:
-    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
-    summary: |
-      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
-      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:mcp:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:mcp:up -- --validate --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:manual:
-    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
-    summary: |
-      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
-      access token so you can drive your own MCP client (Inspector, curl, ...).
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
-      Add --nobuild if the images are already built:
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:apikey:
-    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
-    summary: |
-      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
-      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
-      Add --nobuild if images are already built:
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:validate:
-    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
-    cmds:
-      - bash testing/compose/validate-mcp-test.sh
-
-  mcp:validate-apikey:
-    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
-    cmds:
-      - bash testing/compose/validate-mcp-apikey.sh
-
-  mcp:down:
-    desc: "Stop the MCP keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v

.taskfiles/engine.yml

@@ -33,7 +33,7 @@ tasks:
     env:
       PYTHONUNBUFFERED: "1"
     cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}
 
   dev:
     desc: "Start engine dev server with hot reload"

.taskfiles/frontend.yml

@@ -40,21 +40,6 @@ tasks:
     cmds:
       - node editor/scripts/generate-icons.js
 
-  prepare:og:
-    internal: true
-    run: when_changed
-    desc: "Regenerate OG/social-preview metadata from the tool registry"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs
-    sources:
-      - editor/src/core/types/toolId.ts
-      - editor/src/core/utils/urlMapping.ts
-      - editor/src/core/data/useTranslatedToolRegistry.tsx
-      - editor/public/og_images/*.png
-    generates:
-      - editor/src/core/data/ogImageMap.json
-      - editor/public/og-metadata.json
-
   prepare:
     desc: "Set up dev environment"
     run: when_changed
@@ -64,7 +49,6 @@ tasks:
       - task: prepare:env
         vars: { MODE: '{{.MODE}}' }
       - prepare:icons
-      - prepare:og
 
   # ============================================================
   # Development
@@ -128,12 +112,6 @@ tasks:
       - task: dev:_run
         vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
 
-  dev:portal:
-    desc: "Start developer portal dev server"
-    deps: [install]
-    cmds:
-      - npx vite portal --port {{.PORT | default "5173"}}{{if .OPEN}} --open{{end}}
-
   # ============================================================
   # Build
   # ============================================================
@@ -178,24 +156,6 @@ tasks:
     cmds:
       - npx vite build editor --mode prototypes
 
-  build:portal:
-    desc: "Build developer portal"
-    deps: [install]
-    cmds:
-      - npx vite build portal
-
-  storybook:
-    desc: "Start Storybook dev server"
-    deps: [install]
-    cmds:
-      - npx storybook dev -p 6006 {{.CLI_ARGS}}
-
-  storybook:build:
-    desc: "Build static Storybook"
-    deps: [install]
-    cmds:
-      - npx storybook build {{.CLI_ARGS}}
-
   # ============================================================
   # Code quality
   # ============================================================
@@ -203,23 +163,9 @@ tasks:
   lint:
     desc: "Run linting"
     deps: [install]
-    cmds:
-      - task: lint:eslint
-      - task: lint:dpdm
-
-  lint:eslint:
-    desc: "Run ESLint linting"
-    deps: [install]
     cmds:
       - npx eslint --max-warnings=0
-
-  lint:dpdm:
-    desc: "Run circular import linting"
-    deps: [install]
-    cmds:
-      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
-      # shell-agnostic. Covers editor, portal, and the shared design system.
-      - npx dpdm "editor/src/**/*.{ts,tsx}" "portal/src/**/*.{ts,tsx}" "shared/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
+      - npx dpdm editor/src --circular --no-warning --no-tree --exit-code circular:1
 
   lint:fix:
     desc: "Auto-fix lint issues"
@@ -278,12 +224,6 @@ tasks:
     cmds:
       - npx tsc --noEmit --project editor/src/desktop/tsconfig.json
 
-  typecheck:cloud:
-    desc: "Typecheck cloud shared layer (standalone)"
-    deps: [prepare]
-    cmds:
-      - npx tsc --noEmit --project editor/src/cloud/tsconfig.json
-
   typecheck:scripts:
     desc: "Typecheck scripts"
     deps: [prepare]
@@ -296,18 +236,6 @@ tasks:
     cmds:
       - npx tsc --noEmit --project editor/src/prototypes/tsconfig.json
 
-  typecheck:portal:
-    desc: "Typecheck developer portal build variant"
-    deps: [install]
-    cmds:
-      - npx tsc --noEmit --project portal/tsconfig.json
-
-  typecheck:shared:
-    desc: "Typecheck the shared design system"
-    deps: [install]
-    cmds:
-      - npx tsc --noEmit --project shared/tsconfig.json
-
   typecheck:all:
     desc: "Typecheck all build variants"
     cmds:
@@ -315,11 +243,8 @@ tasks:
       - task: typecheck:proprietary
       - task: typecheck:saas
       - task: typecheck:desktop
-      - task: typecheck:cloud
       - task: typecheck:scripts
       - task: typecheck:prototypes
-      - task: typecheck:portal
-      - task: typecheck:shared
 
   # ============================================================
   # Quality Gate
@@ -333,24 +258,14 @@ tasks:
       - task: format:check
       - task: test
 
-  og:check:
-    desc: "Fail if committed OG/social-preview metadata is out of date"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs --check
-
   check:all:
     desc: "Full CI quality gate"
     cmds:
-      # Runs first, before prepare regenerates: guards the committed og-metadata.json /
-      # ogImageMap.json that the Cloudflare Pages (plain `vite build`) deploy relies on.
-      - task: og:check
       - task: typecheck:all
       - task: lint
       - task: format:check
       - task: build
-      - task: build:portal
       - task: test
-      - task: storybook:build
 
   # ============================================================
   # Test
@@ -358,36 +273,21 @@ tasks:
 
   test:
     desc: "Run tests"
-    deps: [prepare]
+    deps: [install]
     cmds:
       - npx vitest run --root editor
 
   test:watch:
     desc: "Run tests in watch mode"
-    deps: [prepare]
+    deps: [install]
     cmds:
       - npx vitest --watch --root editor
 
   test:coverage:
-    desc: "Run tests with coverage (one-shot; CI-friendly)."
-    deps: [prepare]
+    desc: "Run tests with coverage"
+    deps: [install]
     cmds:
-      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
-      # mode). Explicit reporter list because v8 + json-summary is what the
-      # coverage-summary.py helper consumes; html/text are kept for humans.
-      #
-      # reportsDirectory is pinned to ./coverage relative to vitest's root
-      # (--root editor), so output lands at frontend/editor/coverage/. The
-      # CI upload step reads from that path. An earlier attempt with
-      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
-      # pinning future-proofs against vitest changing the default.
-      - >
-        npx vitest run --root editor --coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage
+      - npx vitest --coverage --root editor
 
   # ============================================================
   # Code Generation
@@ -398,15 +298,3 @@ tasks:
     deps: [install]
     cmds:
       - node editor/scripts/generate-licenses.js
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean build artifacts and caches"
-    cmds:
-      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, editor/dist, dist, dist-portal
-        platforms: [windows]
-      - cmd: rm -rf node_modules/.vite editor/dist dist dist-portal
-        platforms: [linux, darwin]

.taskfiles/pre-commit.yml

@@ -1,159 +0,0 @@
-version: '3'
-
-# Repo-wide lint/format/secret checks - the single source of truth that the git
-# pre-commit hook (.pre-commit-config.yaml) and CI (pre_commit.yml) both call.
-
-vars:
-  GITLEAKS: '8.30.0'
-
-  # File selections as git pathspecs: git does the include/exclude matching, so
-  # there is no grep/xargs and it behaves identically on every platform.
-  PY_FILES: >-
-    'scripts/*.py'
-    '.github/scripts/*.py'
-    'app/core/src/main/resources/static/python/*.py'
-    ':(exclude)*split_photos.py'
-  SPELL_FILES: >-
-    '*.html'
-    '*.css'
-    '*.js'
-    '*.py'
-    '*.md'
-    ':(exclude).vscode/*'
-    ':(exclude).devcontainer/*'
-    ':(exclude)app/core/src/main/resources/*'
-    ':(exclude)app/proprietary/src/main/resources/*'
-    ':(exclude)frontend/editor/public/vendor/*'
-    ':(exclude)*Dockerfile*'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-  WS_FILES: >-
-    '*.js'
-    '*.java'
-    '*.py'
-    '*.yml'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-    ':(exclude).github/workflows/*'
-  LOCALE_TOML: 'frontend/editor/public/locales/*/translation.toml'
-
-  GITLEAKS_BIN: '.task/bin/gitleaks-{{.GITLEAKS}}{{if eq OS "windows"}}.exe{{end}}'
-
-tasks:
-  default:
-    desc: "Check formatting, spelling, and secrets across the repo"
-    cmds:
-      - task: ruff
-      - task: ruff-format
-      - task: codespell
-      - task: gitleaks
-      - task: whitespace
-      - task: toml-sort
-
-  fix:
-    desc: "Auto-fix formatting, spelling, and secrets issues across the repo"
-    cmds:
-      # Auto-fixers first, then the report-only tools (codespell, gitleaks) so a
-      # finding there does not stop the fixers from running.
-      - task: ruff
-        vars: { FIX: '1' }
-      - task: ruff-format
-        vars: { FIX: '1' }
-      - task: whitespace
-        vars: { FIX: '1' }
-      - task: toml-sort
-        vars: { FIX: '1' }
-      - task: codespell
-      - task: gitleaks
-
-  install:
-    desc: "Install the pinned pre-commit Python tools (ruff, codespell, toml-sort)"
-    run: once
-    cmds:
-      - uv sync --project scripts/pre-commit --locked
-    sources:
-      - scripts/pre-commit/uv.lock
-      - scripts/pre-commit/pyproject.toml
-    status:
-      - test -d scripts/pre-commit/.venv
-
-  clean:
-    desc: "Remove the cache/build artifacts"
-    cmds:
-      - task: '{{if eq OS "windows"}}clean-windows{{else}}clean-unix{{end}}'
-
-  clean-unix:
-    internal: true
-    cmds:
-      - rm -rf scripts/pre-commit/.venv .task/bin/gitleaks-*
-
-  # On Windows, use PowerShell so it matches the same paths and tolerates absent
-  # files without erroring.
-  clean-windows:
-    internal: true
-    ignore_error: true
-    cmds:
-      - powershell -NoProfile -Command "Remove-Item -Recurse -Force -ErrorAction SilentlyContinue scripts/pre-commit/.venv, .task/bin/gitleaks-*"
-
-  # Individual checks (hidden from `task --list`, but callable, e.g.
-  # `task pre-commit:toml-sort FIX=1`). Pass FIX=1 to auto-fix where supported.
-  ruff:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
-
-  ruff-format:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
-
-  codespell:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment,vertx --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
-
-  toml-sort:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync toml-sort --all --ignore-case {{if .FIX}}--in-place{{else}}--check{{end}} {{.LOCALE_TOML}}
-
-  whitespace:
-    cmds:
-      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}$(git ls-files {{.WS_FILES}})
-
-  gitleaks:
-    deps: [gitleaks-bin]
-    # Scan staged changes only, matching the old hook: the git-mode fingerprints
-    # in .gitleaksignore (file:rule:line) still apply, and with nothing staged
-    # this is a no-op. Secrets are never auto-fixed, so FIX has no effect.
-    cmds:
-      - "{{.GITLEAKS_BIN}} git --pre-commit --redact --staged --verbose"
-
-  gitleaks-bin:
-    internal: true
-    desc: "Ensure the pinned gitleaks binary is cached in .task/bin"
-    status:
-      - test -f {{.GITLEAKS_BIN}}
-    vars:
-      GL_ARCH: '{{if eq ARCH "amd64"}}x64{{else if eq ARCH "arm64"}}arm64{{else if eq ARCH "386"}}x32{{else}}{{ARCH}}{{end}}'
-      GL_PLATFORM: '{{OS}}_{{.GL_ARCH}}'
-      GL_URL: 'https://github.com/gitleaks/gitleaks/releases/download/v{{.GITLEAKS}}/gitleaks_{{.GITLEAKS}}_{{.GL_PLATFORM}}'
-      # SHA-256 of each release asset, from gitleaks_{{.GITLEAKS}}_checksums.txt.
-      GL_SHA: >-
-        {{if eq .GL_PLATFORM "linux_x64"}}79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e
-        {{- else if eq .GL_PLATFORM "linux_arm64"}}b4cbbb6ddf7d1b2a603088cd03a4e3f7ce48ee7fd449b51f7de6ee2906f5fa2f
-        {{- else if eq .GL_PLATFORM "darwin_x64"}}ca221d012d247080c2f6f61f4b7a83bffa2453806b0c195c795bbe9a8c775ed5
-        {{- else if eq .GL_PLATFORM "darwin_arm64"}}b251ab2bcd4cd8ba9e56ff37698c033ebf38582b477d21ebd86586d927cf87e7
-        {{- else if eq .GL_PLATFORM "windows_x64"}}54fe94f644b832dd08e8c3a5915efb3bfa862386d59fb27ca0792cb687a83573
-        {{- end}}
-    cmds:
-      - cmd: bash scripts/pre-commit/install-gitleaks.sh "{{.GL_URL}}.tar.gz" "{{.GL_SHA}}" "{{.GITLEAKS_BIN}}"
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -File scripts/pre-commit/install-gitleaks.ps1 -Url "{{.GL_URL}}.zip" -Sha "{{.GL_SHA}}" -Dest "{{.GITLEAKS_BIN}}"
-        platforms: [windows]

ADDING_TOOLS.md

@@ -200,9 +200,9 @@ const [ToolName] = (props: BaseToolProps) => {
 ```
 
 ## 5. Add Translations
-Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.
+Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/editor/public/locales/en-US/translation.toml`
+**File to update:** `frontend/editor/public/locales/en-GB/translation.toml`
 
 **Required Translation Keys**:
 ```toml
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-US` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-US/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

AGENTS.md

@@ -169,31 +169,7 @@ import { useFileContext } from "@proprietary/contexts/FileContext";
 - Building layer-specific override that wraps a lower layer's component
 - Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version
 
-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/saas/desktop/cloud) and handles the fallback cascade — see "Frontend `cloud/` Layer" below for the full per-flavor order.
-
-#### Frontend `cloud/` Layer
-
-`@app/*` resolves through a per-flavor cascade — first existing file wins (shadow/override):
-
-- **core** → core
-- **proprietary** → proprietary → core
-- **saas** → saas → cloud → proprietary → core
-- **desktop** → desktop → cloud → proprietary → core
-- **cloud** → cloud → proprietary → core
-
-What goes where:
-
-- **core** — OSS base.
-- **proprietary** — licensed / offline features.
-- **cloud** — the SHARED hosted/SaaS experience used by BOTH saas + desktop: PAYG, wallet, plan, billing, usage meters, cloud config/team/onboarding.
-- **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
-- **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.
-
-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
-
-Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).
-
-**Cloud feature flags on desktop.** The local `AppConfigContext` reads `/api/v1/config/app-config` from the LOCAL bundled backend, so cloud-only flags (`aiEngineEnabled`, `premiumEnabled`, …) are never seen on desktop. To read the cloud's view, use `useSaasAppConfig()` (`desktop/hooks/useSaasAppConfig.ts`, backed by the general `saasAppConfigService` — SaaS-mode-only, public endpoint, native HTTP, 5-min cache). It returns `null` outside SaaS mode, so cloud features stay off in local/self-hosted and the server keeps the on/off switch (no desktop release needed to flip a flag). Gate a feature behind a per-platform seam — e.g. `useAiEngineEnabled()` (core reads `useAppConfig()`, desktop reads `useSaasAppConfig()`) — rather than hardcoding the flag on.
+The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.
 
 #### Component Override Pattern (Stub/Shadow)
 Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
@@ -450,7 +426,7 @@ The frontend is organized with a clear separation of concerns:
 
 ## Translation Rules
 
-- **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
+- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
 - Translation files are located in `frontend/editor/public/locales/`
 
 ## Important Notes

DeveloperGuide.md

@@ -52,17 +52,6 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)
 
-### Optional System Dependencies
-
-These are not required to run the app but enable specific features. The app detects them at startup and disables the relevant features if they are missing.
-
-| Dependency | Feature | Install |
-|---|---|---|
-| LibreOffice | File-to-PDF conversions | `brew install libreoffice` / `apt install libreoffice` |
-| Tesseract | OCR | `brew install tesseract` / `apt install tesseract-ocr` |
-| WeasyPrint | AI document creation | `brew install weasyprint` / `apt install weasyprint` |
-| qpdf | PDF optimisation | `brew install qpdf` / `apt install qpdf` |
-
 ### Setup Steps
 
 1. Clone the repository:
@@ -587,7 +576,7 @@ When adding a new feature or modifying existing ones in Stirling-PDF, you'll nee
 Find the existing `messages.properties` files in the `stirling-pdf/src/main/resources` directory. You'll see files like:
 
 - `messages.properties` (default, usually English)
-- `messages_en_US.properties`
+- `messages_en_GB.properties`
 - `messages_fr_FR.properties`
 - `messages_de_DE.properties`
 - etc.

LICENSE

@@ -10,18 +10,14 @@ if that directory exists, is licensed under the license defined in "app/propriet
 if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
-* All content that resides under the "frontend/editor/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/proprietary/LICENSE".
-* All content that resides under the "frontend/editor/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/desktop/LICENSE".
-* All content that resides under the "frontend/editor/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/saas/LICENSE".
-* All content that resides under the "frontend/editor/src/cloud/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/cloud/LICENSE".
-* All content that resides under the "frontend/editor/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
-* All content that resides under the "frontend/portal/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/portal/LICENSE".
+* All content that resides under the "frontend/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
+* All content that resides under the "frontend/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
+* All content that resides under the "frontend/src/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
+* All content that resides under the "frontend/src/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 

QUARKUS_MIGRATION_HANDOFF.md

@@ -1,563 +0,0 @@
-# Stirling-PDF: Spring Boot → Quarkus Migration — Continuation Handoff
-
-> **Purpose:** everything needed to resume this migration in a fresh session. Read this top-to-bottom
-> before touching anything. Companion doc `migration-report.md` has the higher-level summary; this
-> file is the working/continuation guide with the concrete state, commands, fixed bugs, remaining
-> bugs, and the recurring patterns you need to apply.
-
----
-
-## 0. TL;DR status
-
-- **2026-06-19 — merged `main` (136 commits) into `migration/run-02`.** Resolved 69 conflicts and
-  did **full Spring removal + Quarkus migration of every newly pulled-in file** (36 Spring-bearing
-  files: 21 proprietary + 15 saas). Net effect on main: legacy credits engine deleted (#6687,
-  replaced by PAYG #6589); the proprietary **policy** subsystem and the new **PAYG** subsystem
-  migrated to CDI/JAX-RS/Panache. Verified: 0 conflict markers, 0 `org.springframework` imports in
-  any main source. **`core` + `proprietary` compile; `proprietary` Quarkus-augments + boots + serves
-  real traffic; `saas` now compiles AND augments too** (previously ~28 CDI issues). Cross-file fix:
-  `PolicyExecutor`/`DownstreamEntitlementError` now carry HTTP status+body via
-  `jakarta.ws.rs.WebApplicationException` (was Spring `RestClientResponseException`);
-  `AiWorkflowService.paygLimitResponseOrNull` rewired to it. Repo `save()` shim added to the Panache
-  repos whose callers/tests expect Spring-Data `save()`.
-- **Branch:** `migration/run-01` (all work committed locally, **nothing pushed** — `origin` is the
-  public `Stirling-Tools/Stirling-PDF` repo; do not push without the owner's say-so).
-- **Default flavor (`proprietary`):** compiles, Quarkus-augments, boots, and serves real traffic in
-  Docker. ✅
-- **Cucumber API e2e (full-tool Docker image):** baselines, newest first:
-  - **Run 2 (login off, this session's fixes, no JWT mechanism): 223 / 258 pass**, 35 failed, 80
-    skipped. Up from the prior **183 / 258** baseline (+40). Eliminated buckets: split
-    `PDF corrupted` 8→0, `FileAlreadyExists` 8→0, `Admin login failed (500)` 17→0.
-  - **Run 3 (login off + `V2=true` + the new JWT Bearer mechanism): the 80 JWT/admin scenarios now
-    RUN (0 skipped)** because the `login → /me` probe passes. See §6.E / "Session 2". Final tally
-    recorded in §9.
-- **Stack:** Quarkus 3.33.2 LTS, **Java 25** (mandatory — see §2), Hibernate ORM Panache,
-  quarkus-rest (RESTEasy Reactive), quarkus-oidc, quarkus-undertow (servlet, for filters), OpenSAML 5.
-- **`saas` flavor:** compiles but full augmentation has ~28 CDI issues (design-level follow-up).
-- **JWT Bearer login:** ✅ works end-to-end (token issue + validate → `SecurityIdentity`, role
-  mapping, `@RolesAllowed`). **OAuth2/OIDC + SAML2 SSO:** ✅ both work end-to-end against the
-  `testing/compose` Keycloak stacks; `validate-oauth-test.sh` and `validate-saml-test.sh` both pass
-  (see §6.F). The default e2e Docker image + build helper are committed at `docker/quarkus/` (§3.3).
-
----
-
-## 1. Repo / flavor layout
-
-Multi-module Gradle build, three selectable flavors via `STIRLING_FLAVOR` (or `ENABLE_SAAS` /
-`DISABLE_ADDITIONAL_FEATURES`):
-
-| Flavor | Modules included | Notes |
-|--------|------------------|-------|
-| `core` | `:common`, `:stirling-pdf` (core) | OSS only |
-| `proprietary` (**default**) | + `:proprietary` | what all the e2e work targets |
-| `saas` | + `:saas` | opt-in: `STIRLING_FLAVOR=saas`; not yet augmentable |
-
-Module → directory:
-- `:stirling-pdf` → `app/core` (the runnable Quarkus app; applies the `io.quarkus` gradle plugin)
-- `:common` → `app/common` (library; CDI beans / JAX-RS / entities)
-- `:proprietary` → `app/proprietary` (library)
-- `:saas` → `app/saas` (library, only on saas flavor)
-
-Quarkus only discovers beans/entities in dependency jars that carry a **Jandex index**; the library
-modules are indexed via `quarkus.index-dependency.*` in
-`app/core/src/main/resources/application.properties`.
-
----
-
-## 2. Java 25 is mandatory (don't regress this)
-
-- The build uses a **JDK 25 toolchain** (`build.gradle` `subprojects { java { toolchain = 25 } }`).
-- The app is compiled to **class-file version 69 (Java 25)** — it will NOT run on JDK 21.
-- **The host's default `java` on the PATH is JDK 21.** Use the toolchain JDK 25 explicitly:
-  - `JAVA_HOME` points to a Temurin 25 JDK (`C:\Users\systo\scoop\apps\temurin25-jdk\current`).
-  - In Git Bash run the jar with `"$JAVA_HOME/bin/java" -jar ...` (host `java` = 21 → `UnsupportedClassVersionError`).
-- The Docker base image `stirlingtools/stirling-pdf-base:1.0.2` ships **Temurin 25.0.2** — so the
-  container runtime is JDK 25 already. Keep it that way; do not switch the base image to a JRE < 25.
-- Gradle build images / CI also pin `gradle:9.3.1-jdk25` and `eclipse-temurin:25-jre-noble`.
-
----
-
-## 3. Build → package → run → test (the exact loop)
-
-### 3.1 Build the runnable jar
-```bash
-./gradlew :stirling-pdf:quarkusBuild -x test --console=plain
-```
-- Produces the **runnable uber-jar** at: `app/core/build/stirling-pdf-2.12.0-runner.jar`
-  - `Main-Class: stirling.software.SPDF.SPDFApplication`.
-- ⚠️ **GOTCHA:** `app/core/build/libs/stirling-pdf-2.12.0.jar` is the *plain* (non-runnable) jar with
-  an empty manifest. The upstream `docker/embedded/Dockerfile` copies `libs/*.jar` — that's now the
-  WRONG jar. Always use the `-runner.jar`. (`quarkus.package.jar.type=uber-jar` is set in
-  application.properties.)
-- ⚠️ If the build fails with `Unable to delete .../-runner.jar`, a previous `java -jar` is still
-  holding it. Kill it: PowerShell `Get-CimInstance Win32_Process -Filter "Name='java.exe'" | ?{ $_.CommandLine -like '*stirling-pdf-2.12.0-runner*' } | %{ Stop-Process -Id $_.ProcessId -Force }`.
-
-### 3.2 Run standalone for a quick boot check (host JDK 25, fastest)
-```bash
-SECURITY_ENABLELOGIN=false QUARKUS_HTTP_PORT=8095 \
-QUARKUS_DATASOURCE_JDBC_URL="jdbc:h2:mem:t;DB_CLOSE_DELAY=-1;MODE=PostgreSQL" \
-nohup "$JAVA_HOME/bin/java" -jar app/core/build/stirling-pdf-2.12.0-runner.jar > /tmp/boot.log 2>&1 &
-# success line in log: "Stirling-PDF running on port: 8095"  (this app does NOT print Quarkus' "Listening on")
-```
-Health: `curl localhost:8095/api/v1/info/status` → `{"version":"2.12.0","status":"UP"}`.
-
-### 3.3 The "normal" Docker image (full tools) — what the cucumber e2e uses
-The upstream `docker/embedded/Dockerfile` is **Spring-Boot-specific** (uses
-`java -Djarmode=tools -jar app.jar extract --layers` + `spring-boot-loader` layers) and does NOT
-work with the Quarkus jar. For e2e I built an ad-hoc image layering the runner-jar on the prebuilt
-**base image** (which already has Java 25 + LibreOffice + Tesseract + qpdf + Ghostscript + Calibre +
-Python). **This Dockerfile lives in a temp dir and needs to be committed into the repo** (see §6 TODO).
-
-Build context (currently ephemeral at the bash path `/tmp/sp-full` =
-`C:\Users\systo\AppData\Local\Temp\sp-full`): `app.jar` (the runner jar), `fonts/*.ttf`, and this
-Dockerfile:
-```dockerfile
-FROM stirlingtools/stirling-pdf-base:1.0.2          # Java 25 + all tools
-WORKDIR /app
-COPY --chown=1000:1000 app.jar /app/app.jar
-COPY fonts/*.ttf /usr/share/fonts/truetype/
-RUN fc-cache -f \
-    && mkdir -p /storage \
-    && chown stirlingpdfuser:stirlingpdfgroup /storage /app \
-    && ln -sf /configs /app/configs && ln -sf /logs /app/logs \
-    && ln -sf /customFiles /app/customFiles && ln -sf /pipeline /app/pipeline \
-    && ln -sf /storage /app/storage \
-    && chown -h stirlingpdfuser:stirlingpdfgroup /app/configs /app/logs /app/customFiles /app/pipeline /app/storage
-ENV HOME=/home/stirlingpdfuser STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
-    TMPDIR=/tmp/stirling-pdf TEMP=/tmp/stirling-pdf TMP=/tmp/stirling-pdf \
-    SAL_TMP=/tmp/stirling-pdf/libre DBUS_SESSION_BUS_ADDRESS=/dev/null \
-    JAVA_OPTS="-XX:+UseG1GC -Djava.awt.headless=true" \
-    QUARKUS_HTTP_HOST=0.0.0.0 QUARKUS_HTTP_PORT=8080
-EXPOSE 8080/tcp
-STOPSIGNAL SIGTERM
-USER stirlingpdfuser
-ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
-```
-Stage + build + run:
-```bash
-# stage (bash /tmp resolves to %LOCALAPPDATA%\Temp)
-mkdir -p /tmp/sp-full/fonts
-cp app/core/build/stirling-pdf-2.12.0-runner.jar /tmp/sp-full/app.jar
-cp app/core/src/main/resources/static/fonts/*.ttf /tmp/sp-full/fonts/
-# (write the Dockerfile above to C:\Users\systo\AppData\Local\Temp\sp-full\Dockerfile)
-cd /tmp/sp-full && docker build -t stirling-pdf-quarkus:full .
-docker rm -f sp-e2e
-docker run -d --name sp-e2e -p 8080:8080 \
-  -e SECURITY_ENABLELOGIN=false -e METRICS_ENABLED=true \
-  -e SYSTEM_DEFAULTLOCALE=en-US -e SYSTEM_MAXFILESIZE=100 \
-  stirling-pdf-quarkus:full
-# wait for: curl localhost:8080/api/v1/info/status == 200
-```
-Base image was pulled with `docker pull stirlingtools/stirling-pdf-base:1.0.2`.
-
-### 3.4 Run the cucumber (behave) suite
-- Tests live in `testing/cucumber/` — Python **behave** (BDD), pure HTTP via `requests` (no browser).
-- **Target URL is hardcoded `http://localhost:8080`** in `features/steps/step_definitions.py`
-  (lines ~584/592/601) and `features/environment.py`. Easiest is to run the app on 8080.
-- `behave.ini` excludes `features/(enterprise|payg)` and tag `~@manual` by default.
-- `environment.py` probes `/api/v1/auth/login` (admin/stirling) at startup; if JWT/login is not
-  functional (login disabled / V2) it **skips** all `@jwt @login @me @refresh @token @mfa @apikey
-  @admin_settings @audit @signature @team @user_mgmt` scenarios → ~80 skips. That's expected.
-
-Install deps + run:
-```bash
-cd testing/cucumber
-pip install -r requirements.txt        # behave, requests, pypdf, reportlab, psycopg, pillow, ...
-TEST_CONTAINER_NAME=sp-e2e TEST_REPORT_DIR=/tmp python -m behave --no-capture --format progress2
-# single feature:  python -m behave features/general.feature
-# one scenario:    python -m behave features/general.feature:22 --format plain
-```
-The official CI driver is `testing/test.sh` (builds images via `docker/embedded/Dockerfile.*` and
-runs behave) — it will need the Dockerfile fixes from §6 before it works on Quarkus.
-
----
-
-## 4. Bugs FIXED this session (with the *why*, so you can spot siblings)
-
-### Session 2 (branch `claude/happy-chaplygin-906fe7`, fast-forwarded from `migration/run-01`)
-
-Newest first. These took the login-off suite **183 → 223** and then wired JWT so the **80 skipped
-JWT/admin scenarios run** (run 3, §9):
-
-1. **JWT Bearer → `SecurityIdentity` was never populated** → every user-scoped endpoint that reads
-   `SecurityIdentity.getPrincipal()` (folders, files, `/me`, user/team settings…) failed, and the
-   `environment.py` probe (`login → /me`) failed so ~80 scenarios auto-skipped. Added a custom
-   `HttpAuthenticationMechanism` + `IdentityProvider` in
-   `app/proprietary/.../security/identity/` (`JwtBearerAuthenticationMechanism`,
-   `JwtTokenIdentityProvider`): extract `Authorization: Bearer`, validate via the existing
-   `JwtService` (jjwt + keystore), build a `QuarkusSecurityIdentity` and map the `role` claim
-   (`ROLE_ADMIN` → also add `ADMIN` so `@RolesAllowed("ADMIN")` matches). Returns no identity when
-   no Bearer is present, so the X-API-KEY / login-off open-endpoint path is unaffected. **This is the
-   IdentityProvider that ~10 `// TODO: Migration required` comments across the security/storage code
-   asked for.** Run with `V2=true`.
-2. **No admin user was ever created** → all logins failed "No user found: admin". `InitialSecuritySetup`
-   was a Spring `@Component` (eagerly constructed, `@PostConstruct` ran every boot); the migration
-   made it a lazy `@ApplicationScoped` whose `@PostConstruct` never ran. Restored eager init via
-   `@Observes StartupEvent`. **Pattern: any migrated `@PostConstruct`-on-`@ApplicationScoped` startup
-   bean with no injector is dead code — grep for them.**
-3. **Eager init then exposed two latent bugs** (both real, both now fixed):
-   - `@Produces @ApplicationScoped DataSource` → Arc generated the client proxy in the JDK-sealed
-     `javax.sql` package → `NoClassDefFoundError` on first use. Fix: `@Singleton` (pseudo-scope, no
-     proxy). **Audit other `@Produces @ApplicationScoped` whose return type is a `java.*`/`javax.*`
-     type.**
-   - Panache `persist()` in the `StartupEvent` observer ran with no transaction (Spring Data wrapped
-     `save()` implicitly). Fix: `@Transactional` on the observer.
-4. **Login returned 500 instead of 401** for unknown user / bad password. `CustomUserDetailsService`
-   threw `IllegalArgumentException`, but `AuthController` catches the migration shim
-   `stirling.software.common.security.UsernameNotFoundException`. Made the service throw the shim
-   type. **Sibling: the locked-account path still throws `IllegalStateException` — wire it similarly
-   when needed.**
-5. **`@Transactional` missing on policy-store reads** (`JpaPolicyStore.all()`,
-   `findByTriggerType()`) → the scheduled folder-watch/schedule triggers threw
-   `ContextNotActiveException` off-request (§6.C). The reads are reached via the CDI proxy so a
-   method-level `@Transactional` applies even from the background virtual-thread executor.
-6. **Split scenarios sent a duplicate `fileInput` text part** (`| fileInput | fileInput |` in
-   `general.feature`) alongside the file part; Quarkus `@RestForm FileUpload` bound the *text* part
-   ("fileInput", 9 bytes) → "PDF corrupted". Spring ignored the stray part. Removed the redundant
-   rows (the file is already attached via the generate step). **Real clients send one part, so this
-   is a test artifact, not a server tolerance gap worth chasing.**
-7. **e2e Docker build is now first-class:** `docker/quarkus/Dockerfile` (+ `README.md`,
-   `build-and-run.sh`) layers the runner-jar on the base image, and `.dockerignore` re-includes
-   `app/core/build/*-runner.jar` (it was excluded by `**/build/`, so a clean `docker build` had been
-   silently relying on BuildKit cache).
-
-### Session 1
-
-1. **`MultipartFile.transferTo` didn't overwrite** (`a30d524ec`).
-   `app/common/.../model/MultipartFile.java` + `.../model/multipart/FileUploadMultipartFile.java`
-   used `Files.copy(in, dest)` without `REPLACE_EXISTING`. Callers do
-   `Files.createTempFile(...)` (creates the file) then `transferTo(thatPath)` → `FileAlreadyExistsException`.
-   Spring's `transferTo` overwrites. **Fixed** by adding `StandardCopyOption.REPLACE_EXISTING`.
-   Fixes the whole class of `/api/v1/misc/*` failures (scanner-effect, replace-invert, ocr,
-   update-metadata, unlock-pdf-forms, repair, extract-image-scans, add-page-numbers, …).
-
-2. **`maxDPI` defaulted to 0** (`a30d524ec`).
-   `ApplicationProperties.System.maxDPI` is a primitive `int` (→ 0 when not bound from settings).
-   Every DPI guard (`dpi > maxDPI`) then failed with *"maximum safe limit of 0"*. The
-   `settings.yml.template` default is 500. **Fixed** by `private int maxDPI = 500;`.
-   ⚠️ Root cause hint: this strongly suggests **settings.yml → ApplicationProperties config binding
-   is incomplete in the Quarkus migration**. Other primitive/unset fields may also be silently
-   wrong. Worth a dedicated audit (see §5).
-
-3. **Request-path `HttpServletRequest` → `UT000048` "No request is currently active"** (`860bd6e63`,
-   `4b572852c`). This was the dominant blocker. `quarkus-rest` (RESTEasy Reactive) runs handlers on
-   reactive/worker threads where the undertow servlet request context is NOT active, so ANY
-   `HttpServletRequest.getX()` throws. Fixed in:
-   - `GlobalExceptionHandler` (an `ExceptionMapper` that threw while handling *every* error, masking
-     the real cause) → `@Context UriInfo` + exception-safe `requestUri()`.
-   - `ControllerAuditAspect`, `AuditAspect` → route through the already-guarded
-     `AuditService.getCurrentRequest()` (returns null off-request) + a guarded `safeResponse()`.
-   - `AutoJobAspect`, `JobExecutorService` → inject `io.quarkus.vertx.http.runtime.CurrentVertxRequest`,
-     read query-param/method/path/attributes from the Vert.x request, degrade to null/no-op.
-   - `AuthController`, `UserController`, `ConfigController` → `@Context UriInfo` / `HttpHeaders` /
-     `io.vertx.core.http.HttpServerRequest`.
-   This unblocked the entire `@AutoJobPostMapping` chain (most PDF endpoints).
-
-4. **License singleton PK race** (`860bd6e63`). `UserLicenseSettings` has a manually-assigned
-   `@Id = 1L`. Spring Data `save()` on a non-new (pre-set-id) entity does a **MERGE (upsert)**; the
-   migration converted it to `persist()` (INSERT-only). The startup license sync raced the first
-   request, both inserted id=1 → `JdbcSQLIntegrityConstraintViolationException` → app crash. **Fixed**
-   in `UserLicenseSettingsService.getOrCreateSettings()` with a JVM lock +
-   `io.quarkus.narayana.jta.QuarkusTransaction.requiringNew()` create-once, then reload into the
-   caller's tx. **⚠️ This `save()`→`persist()`-should-be-`merge()` bug almost certainly exists for
-   OTHER manually-`@Id`'d entities — audit them (see §5).**
-
-5. **App couldn't boot without Redis** (`4665cceeb`).
-   - `quarkus.oidc.enabled=false` default (quarkus-oidc aborts startup without `auth-server-url`;
-     re-enable for an OAuth2 deployment).
-   - Valkey backplane beans eagerly injected the inactive `RedisDataSource`. Gated all 7 with
-     **build-time** `@io.quarkus.arc.properties.IfBuildProperty(name="cluster.backplane", stringValue="valkey")`
-     (NOT `@LookupIfProperty` — that leaves the bean in the build, so `RedisDataSource` still has a
-     consumer and Quarkus emits an eager startup observer that fails). Plus
-     `quarkus.redis.health.enabled=false`.
-
-6. **Runtime boot fixes** (`20b25ad76`): `quarkus.hibernate-orm.mapping.format.global=ignore` (JSON
-   columns), Quartz cron `0 0 0 * * MON` → `0 0 0 ? * MON` (Quartz rejects `*` in both day fields),
-   `@Scheduled(every="7d")` → `"P7D"`, `quarkus.arc.fail-on-intercepted-private-method=false`.
-
-7. **CDI augmentation** (`185ac88b3`): interceptor bindings made `@InterceptorBinding`
-   (`@EnterpriseEndpoint`, `@PremiumEndpoint`), a `tools.jackson.databind.ObjectMapper` producer
-   added in `AppConfig` (92 injection points), ambiguous beans resolved (`@DefaultBean`),
-   `Optional<X>`→`Instance<X>`, collection `List<X>`→`@All List<X>`, nested `SAML2` config producer.
-
-8. **Test layer** (`d51228af6`): a content-based exclude in root `build.gradle subprojects` skips any
-   test still importing `org.springframework`/`com.nimbusds` (self-maintaining), plus an explicit
-   list for tests asserting changed production signatures.
-
----
-
-## 5. Recurring patterns / gotchas (apply these everywhere)
-
-- **HttpServletRequest is poison on reactive threads.** ~35 main-source files still reference
-  `HttpServletRequest` (see §6 list). For each in the request path, replace with:
-  - path/URI → `@Context jakarta.ws.rs.core.UriInfo` (`uriInfo.getRequestUri().getPath()`), or in a
-    non-JAX-RS bean inject `io.quarkus.vertx.http.runtime.CurrentVertxRequest`
-    (`currentVertxRequest.getCurrent().request().path()`), guarded in try/catch returning null/"".
-  - headers → `@Context jakarta.ws.rs.core.HttpHeaders` (`getHeaderString(name)`).
-  - remote addr / method → `@Context io.vertx.core.http.HttpServerRequest`.
-  - request attributes (`get/setAttribute`) → Vert.x `RoutingContext.get/put` via `CurrentVertxRequest`.
-  - In services that already have a guarded accessor, reuse `AuditService.getCurrentRequest()`.
-- **Spring `save()` → Panache:** if the entity uses `@GeneratedValue` (new on insert) → `persist()`.
-  If the entity has a **manually-assigned `@Id`** (caller sets the id, "upsert" semantics) →
-  `getEntityManager().merge()` (NOT `persist()`), and consider concurrency.
-- **Config gating:** runtime selection that must REMOVE a bean (so its deps don't get wired) →
-  build-time `@IfBuildProperty`/`@UnlessBuildProperty`. `@LookupIfProperty` only disables *lookup*,
-  the bean and its injection points stay in the build.
-- **`quarkus.*` build-time props** (e.g. `quarkus.oidc.enabled`, `quarkus.hibernate-orm.*`,
-  `quarkus.arc.*`) can't be overridden by env at runtime — they require a rebuild.
-- **settings.yml binding is suspect** (see maxDPI). Audit `ApplicationProperties` for primitive
-  fields that need non-zero/template defaults, and verify the settings.yml → ApplicationProperties
-  binding path actually works in Quarkus (it was Spring `@ConfigurationProperties` + a custom YAML
-  property source — see the `YamlPropertySourceFactory` / `ConfigInitializer` TODOs).
-- **Augment gate:** `compileJava` passing ≠ working. `./gradlew :stirling-pdf:quarkusBuild` surfaces
-  CDI wiring errors; only *running* surfaces the `UT000048` / config / race bugs. Always run.
-- **Jackson 2 vs 3 coexist:** ~100 files use `tools.jackson` (Jackson 3, from Spring Boot 4); REST
-  (de)serialization uses Quarkus' Jackson 2. Don't "fix" `tools.jackson` imports — there's a producer.
-
----
-
-## 6. REMAINING WORK (prioritized)
-
-### A. Make the e2e Docker build first-class
-- [x] **DONE (Session 2):** `docker/quarkus/Dockerfile` (+ `README.md`, `build-and-run.sh`) committed,
-      uses the runner-jar, copies fonts; `.dockerignore` re-includes `app/core/build/*-runner.jar`.
-- [ ] Rewrite/replace `docker/embedded/Dockerfile`, `Dockerfile.fat`, `Dockerfile.ultra-lite` for
-      Quarkus: drop the Spring-Boot `-Djarmode=tools extract --layers` + `spring-boot-loader` layer
-      copies; either copy the uber `-runner.jar` to `/app/app.jar` or use the Quarkus fast-jar
-      (`quarkus-app/`) layout. The stage-1 `gradle clean build -PbuildWithFrontend=true` still builds
-      the frontend (fine).
-- [ ] Update `scripts/init.sh` / `init-without-ocr.sh` — they have Spring-loader fallbacks and AOT
-      machinery; the primary `java -jar /app.jar` path works for the uber-jar, but verify the AOT
-      cache + `restart-helper.jar` paths.
-- [ ] Then `testing/test.sh` (the official cucumber driver) should work end-to-end.
-
-### B. Real per-endpoint bugs surfaced by cucumber (login-off suite)
-Last measured failure buckets (before the transferTo/maxDPI fixes — re-run to refresh):
-- [ ] **`PdfCorruptedException` (~48)** on `convert/pdf/{word,vector,presentation,text,pdfa,...}`,
-      `convert/{html,cbz}/pdf`. Investigate `CustomPDFDocumentFactory` (PDF loading) — is it
-      misreporting valid PDFs as corrupted, or do these convert paths need LibreOffice/handling that
-      errors first and gets wrapped? Check one: `python -m behave features/convert_new.feature:NN --format plain`
-      then read `docker logs sp-e2e` for the real cause.
-- [ ] **`ClassCastException: String cannot be cast to ...` (~6)** — form/param binding type mismatch.
-      Likely a `@RestForm`/`@QueryParam` bound to the wrong type, or a Map/JSON form field. Check
-      `form/fill`, `form_advanced.feature`.
-- [ ] **Remaining `500`s** after A/B fixes — `misc/compress-pdf`, `general/split-pdf-by-chapters`,
-      `misc/add-image`, etc. Triage each via container logs.
-- [ ] **`400`s (~5)** — multipart `@RestForm` binding gaps. The migration left several request DTOs
-      with `MultipartFile`/POJO-list fields not bound to RESTEasy `FileUpload` (AI/workflow/sign DTOs
-      explicitly flagged). See `migration-report.md` "Representative deferred code".
-- [ ] **temp-file collisions other than transferTo** — also check `GeneralUtils.createTempFile`
-      (`app/common/.../util/GeneralUtils.java:79/85`) and any `Files.createFile`/`Files.copy`/
-      `Files.move` without `REPLACE_EXISTING`. `temp<rand>genericNonCustomisableName.pdf` and
-      `/tmp/stirling-pdf/stirling-pdf-<rand>.pdf` were two such names.
-
-### C. Background scheduled-task errors (log noise, not request-breaking)
-- [ ] `FolderWatchTrigger` (reconcile) and `ScheduleTrigger` (sweep) throw
-      `jakarta.enterprise.context.ContextNotActiveException` ("neither a transaction nor a CDI
-      request context is active") because they hit Panache/`PolicyRepository` off-request. Add
-      `@Transactional` (and/or `@ActivateRequestContext`) to those scheduled methods, or wrap the EM
-      access in `QuarkusTransaction.requiringNew()`. Files:
-      `app/proprietary/.../policy/trigger/FolderWatchTrigger.java`,
-      `.../policy/trigger/ScheduleTrigger.java`, `.../policy/store/JpaPolicyStore.java`.
-
-### D. The remaining ~35 `HttpServletRequest` files (apply §5 pattern as they surface)
-Not all are in the hot path; fix the ones that throw `UT000048` when their endpoints are exercised.
-Get the list any time with:
-```bash
-grep -rln "HttpServletRequest" app/core/src/main app/proprietary/src/main app/common/src/main --include=*.java
-```
-Known-fixed already: GlobalExceptionHandler, ControllerAuditAspect, AuditAspect, AutoJobAspect,
-JobExecutorService, AuthController, UserController, ConfigController. Everything else is unverified.
-High-risk: security filters (`UserAuthenticationFilter`, rate-limit filters, `JwtAuthenticationFilter`),
-anything reading headers/cookies/remote-addr per request.
-
-### E. Auth / JWT / login — DONE (Session 2)
-The whole Quarkus auth-identity layer is now in place (`app/proprietary/.../security/identity/`):
-- [x] **JWT Bearer** → `JwtBearerAuthenticationMechanism` + `JwtTokenIdentityProvider` (validate via
-      `JwtService`, map `role` claim). Run with `V2=true`.
-- [x] **X-API-KEY** → `ApiKeyAuthenticationMechanism` + `ApiKeyAuthenticationRequest` +
-      `ApiKeyIdentityProvider` (resolve via `userService.getUserByApiKey`). Lets `X-API-KEY` requests
-      authenticate (e.g. `/me`), and lets the suite run `SECURITY_ENABLELOGIN=true`.
-- [x] **User-as-principal** → `UserSecurityIdentityAugmentor` re-loads the `User` and sets it as the
-      `SecurityIdentity` principal; `User implements Principal`. This satisfies the ~7
-      `principal instanceof User` sites (folders, file storage, sessions, audit, UserController) — the
-      augmentor every `// TODO: Migration required` in security/storage asked for.
-- [x] **Config binding** → `ApplicationPropertiesConfigOverlay` overlays env/config onto
-      `ApplicationProperties` at startup (the Spring `@ConfigurationProperties` bind was never
-      migrated, so `SECURITY_ENABLELOGIN` / `SECURITY_CUSTOMGLOBALAPIKEY` / `STORAGE_ENABLED` were
-      ignored — root cause of the maxDPI/loginAttemptCount class too). **Currently a focused subset
-      (auth/storage/SSO toggles); a complete generic bind (all ~445 fields + settings.yml) is still
-      TODO.**
-- Validated on a login-ON probe (`SECURITY_ENABLELOGIN=true V2=true STORAGE_ENABLED=true
-  SECURITY_CUSTOMGLOBALAPIKEY=123456789`): open PDF endpoints (anon), JWT login+/me, X-API-KEY /me,
-  folder list/create all work. The 183 open endpoints stay open (no global `quarkus.http.auth.*`
-  policy), so login-ON does not regress them.
-
-### F. SAML / SSO — DONE (Session 2), both flows work end-to-end
-
-**Both `validate-oauth-test.sh` and `validate-saml-test.sh` pass, and both full login flows were
-verified end-to-end against the Keycloak compose** (login -> IdP -> callback/ACS -> auto-created
-user -> app JWT cookie -> `/me` 200). Run with `PREMIUM_KEY=<your enterprise license key>`. Tag the Quarkus image as
-`docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest` so the compose uses it (or repoint the
-`image:`); `start-saml-test.sh` generates the SP certs + fetches Keycloak's cert.
-
-- **OAuth2 / OIDC** (`security/oauth2/`): `OAuth2LoginController` (JAX-RS) serves
-  `/oauth2/authorization/{id}` -> IdP authorize redirect; `OAuth2CallbackServlet` (`@WebServlet
-  /login/oauth2/code/*`) does the code exchange + userinfo + auto-create + JWT cookie. **Why a
-  servlet for the callback:** quarkus-undertow's default servlet owns the `/login/*` prefix and
-  query-strips/intercepts the extension-less callback before RESTEasy sees it; a registered
-  `@WebServlet` takes precedence. (Same reason the SAML SP endpoints are servlets.)
-- **SAML2** (`security/saml2/`): `Saml2Service` (OpenSAML 5) initialises the library, loads SP
-  key/cert + IdP cert, builds SP metadata, builds+signs the redirect-binding AuthnRequest, and
-  validates the SAMLResponse signature (`SAMLSignatureProfileValidator` + `SignatureValidator`
-  against the IdP cert). `SamlMetadataServlet` -> `/saml2/service-provider-metadata/{id}`;
-  `SamlSpServlet` -> `/saml2/authenticate/{id}` (login init) + `/login/saml2/sso/{id}` (ACS).
-  **Gotcha:** the SP entityId must equal the SP-metadata URL (`{backendUrl}/saml2/service-provider-
-  metadata/{id}`), which is what Keycloak's SAML client is keyed on - NOT the bare
-  `SECURITY_SAML2_SP_ENTITYID` host (`SamlConfig` derives it). Keycloak's realm has
-  `saml.client.signature=false` (AuthnRequest signature optional) + `saml.server.signature=true`
-  (so the ACS validates the response against Keycloak's cert).
-- Both flows finish by issuing the app JWT as the `stirling_jwt` cookie, which
-  `JwtBearerAuthenticationMechanism` now also reads (not just the `Authorization` header) -> feeds
-  the `UserSecurityIdentityAugmentor` (principal = User).
-- Follow-ups: logout/SLO endpoints; encrypted-assertion handling; the `mcp` Keycloak compose;
-  desktop/Tauri RelayState (`TauriSamlUtils` preserved). Multi-provider (google/github) OAuth uses
-  the same pattern keyed by registrationId.
-
-### F-old. (superseded) original SAML/SSO scoping
-The `validate-*-test.sh` scripts are **endpoint-existence
-checks** (Keycloak up + Stirling serves the SSO endpoint), not full browser logins.
-
-Prereqs for any run: the compose files use `image: docker.stirlingpdf.com/.../stirling-pdf:latest`
-(the published Spring image) — **repoint to `stirling-pdf-quarkus:jwt`** (or wire
-`docker/quarkus/Dockerfile`). The SAML compose mounts `saml-private-key.key`/`saml-public-cert.crt`/
-`keycloak-saml-cert.pem` which **do not exist in the repo** — generate them (the SP signing
-key/cert; `start-saml-test.sh` may do this). SAML/OAuth need the **Enterprise license** env.
-
-**OAuth2 / OIDC** (more tractable — Quarkus has `quarkus-oidc`):
-- [ ] Extend `ApplicationPropertiesConfigOverlay` for `security.oauth2.*` (client issuer/clientId/
-      clientSecret/scopes/useAsUsername) — currently only the `enabled` toggle is bound.
-- [ ] Serve `GET /oauth2/authorization/{registrationId}` → 302 to the IdP authorize URL (login
-      initiation; the OAuth `validate` script checks this responds). Build from issuer + clientId +
-      redirect-uri `/login/oauth2/code/{registrationId}`.
-- [ ] Serve the callback `GET /login/oauth2/code/{registrationId}` → exchange code (REST Client to
-      the token endpoint), fetch userinfo, auto-create/login the user (reuse `CustomOAuth2UserService`
-      logic), issue the app JWT via `JwtService`. `quarkus.oidc.enabled` is **build-time** and aborts
-      startup with no `auth-server-url`, so either hand-roll the flow (simplest, no build-time gate)
-      or enable oidc with a runtime-disabled default tenant.
-
-**SAML2** (larger — no Quarkus SAML extension; OpenSAML 5 from scratch):
-- [ ] `Saml2Configuration` already loads the SP/IdP certs and computes entityId/ACS/SLO URLs and
-      customizes the AuthnRequest (all preserved). Build on it:
-  - [ ] `GET /saml2/service-provider-metadata/{registrationId}` → SP `EntityDescriptor` XML
-        (ACS=`/login/saml2/sso/{id}`, SP signing cert) marshalled via OpenSAML 5. (The SAML `validate`
-        script checks this.)
-  - [ ] login initiation → build+sign an `AuthnRequest` (use `customizeAuthnRequest`) and
-        redirect/POST to `samlConf.getIdpSingleLoginUrl()`.
-  - [ ] `POST /login/saml2/sso/{registrationId}` (ACS) → validate the SAML response/assertion against
-        the IdP cert, extract the NameID/attributes, auto-create/login the user, issue the app JWT.
-  - Host these as Jakarta `@WebServlet` (quarkus-undertow) or JAX-RS resources; gate on
-        `security.saml2.enabled`.
-- [ ] Both flows then feed the existing `UserSecurityIdentityAugmentor` (principal=User) once they
-      establish the session/JWT.
-
-### G. `saas` flavor full augmentation (optional, non-default)
-- [ ] `STIRLING_FLAVOR=saas ./gradlew :stirling-pdf:quarkusBuild` → ~28 Arc deployment problems
-      (Supabase second datasource via `quarkus.datasource."supabase".*`, `SecurityFilterChain`/
-      `JwtDecoder` → `quarkus.http.auth.*`+OIDC, credit `HandlerInterceptor`/`@RestControllerAdvice`
-      → JAX-RS `@Provider`/`ExceptionMapper`, `@ConfigurationProperties` → `@ConfigMapping`,
-      RestTemplate → REST Client). ~90 `// TODO: Migration required` across 34 saas files.
-
-### H. Test suite (unit/integration) re-enablement
-- [ ] ~180 test files are excluded from compilation (content filter on `org.springframework`/
-      `com.nimbusds` imports + an explicit list in `build.gradle`). Port them to `@QuarkusTest`
-      incrementally; as a file's Spring imports go away it auto-re-enters the build.
-
-### I. Loose ends
-- [ ] `/q/openapi` returns 500 (`UT000048`) — known quarkus-undertow + smallrye-openapi interaction;
-      swagger-ui works, live API works. Affects API-doc tooling only.
-- [ ] Jackson 2/3 convergence (drop `tools.jackson`).
-- [ ] ~437 `// TODO: Migration required` markers across the codebase document every deferred decision;
-      `grep -rn "TODO: Migration required" app/*/src/main` to enumerate.
-
----
-
-## 7. Quick reference — env vars used in e2e
-
-| Var | Value | Why |
-|-----|-------|-----|
-| `SECURITY_ENABLELOGIN` | `false` | run without auth (most API tests); set `true` for the JWT suite |
-| `METRICS_ENABLED` | `true` | enables `/api/v1/info/*` (info.feature) |
-| `SYSTEM_DEFAULTLOCALE` | `en-US` | matches default-language change |
-| `SYSTEM_MAXFILESIZE` | `100` | upload limit for tests |
-| `QUARKUS_HTTP_PORT` | `8080` | cucumber steps hardcode 8080 |
-| `QUARKUS_DATASOURCE_JDBC_URL` | `jdbc:h2:mem:...` | use a fresh in-mem DB for clean runs (avoids stale H2 file lock) |
-
-Default datasource (in `application.properties`) is **H2 file** at
-`./configs/stirling-pdf-DB-2.3.232` — fine in a container; for repeated host runs override to
-`jdbc:h2:mem:...` to dodge the file lock (`Database may be already in use`).
-
----
-
-## 8. Useful diagnostic one-liners
-
-```bash
-# container alive + real error (strip ANSI, drop known background noise)
-docker logs sp-e2e 2>&1 | sed 's/\x1b\[[0-9;]*m//g' \
-  | grep -iE "ERROR|Caused by|Exception" \
-  | grep -viE "Log4j|LogManager|ForkJoinPool|FolderWatch|ScheduleTrigger|policy-" | tail -30
-
-# categorize cucumber failures
-cd testing/cucumber && TEST_CONTAINER_NAME=sp-e2e python -m behave --no-capture --format plain --no-skipped > /tmp/behave.txt 2>&1
-grep -oE "Expected status code [0-9]+ but got [0-9]+" /tmp/behave.txt | sort | uniq -c | sort -rn
-grep -oE "features/[a-z_]+\.feature" /tmp/behave.txt | sort | uniq -c | sort -rn   # rough; use a junit reporter for precise
-
-# what still touches the servlet request
-grep -rln "HttpServletRequest" app/*/src/main --include=*.java
-
-# enumerate deferred work
-grep -rn "TODO: Migration required" app/*/src/main --include=*.java | wc -l
-```
-
----
-
-## 9. Measured cucumber results — newest first
-
-**Run 5 — LOGIN ON (`SECURITY_ENABLELOGIN=true V2=true STORAGE_ENABLED=true
-SECURITY_CUSTOMGLOBALAPIKEY=123456789`):**
-```
-18 features passed, 7 failed, 0 skipped
-304 scenarios passed, 34 failed, 0 skipped     <-- folders + user-scoped features now pass
-```
-X-API-KEY mechanism + User-principal augmentor + config overlay made login-ON work without
-regressing the open endpoints (0 folder failures). Trajectory: **183 → 223 → 272 → 291 → 304**.
-
-**Run 4 — login off + lockout fix:** `291 passed, 47 failed, 0 skipped`.
-
-**Run 3 — login off + `V2=true` + JWT Bearer mechanism (Session 2):**
-```
-17 features passed, 8 failed, 0 skipped
-272 scenarios passed, 66 failed, 0 skipped     <-- 0 skipped: all JWT/admin scenarios now run
-```
-The JWT mechanism unskipped all 80 and added +49 passing over run 2 with no regressions. Remaining
-66 failures, biggest buckets:
-- **~38 = login-lockout cascade (FIXED, pending re-measure).** `loginAttemptCount` defaulted to 0
-  (template = 5) → admin locked after one failed-login test → every later admin scenario blocked
-  ("Admin login failed" 21×, "Folder list returned" 17×). Fixed the primitive default (same as
-  maxDPI). **Re-run to confirm; expect ~300+.**
-- 10×(200→403) feature-gated/disabled (mostly not bugs).
-- 5×(200→401) + 2×(401→403) — auth scenarios asserting specific codes; triage individually.
-- 3×(200→500) — real per-endpoint bugs (e.g. `user/get-api-key`). Triage via container logs.
-
-**Run 2 — login off, Session 2 fixes, no JWT mechanism:**
-```
-16 features passed, 5 failed, 4 skipped
-223 scenarios passed, 35 failed, 80 skipped
-```
-
-**Run 1 — original baseline (login off):**
-```
-183 scenarios passed, 75 failed, 80 skipped
-```
-
-Trajectory this session: **183 → 223 (boot/login/test fixes) → 272 (JWT mechanism), 0 skipped.**

README.md

@@ -60,7 +60,7 @@ For full installation options (including desktop and Kubernetes), see our [Docum
 
 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
-This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task dev` to get started running the editor, run `task` to see the most common commands, or see the [Developer Guide](DeveloperGuide.md) for full details.
+This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task install` to get started, or see the [Developer Guide](DeveloperGuide.md) for full details.
 
 For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
 

Taskfile.yml

@@ -25,28 +25,8 @@ includes:
   e2e:
     taskfile: .taskfiles/e2e.yml
     dir: .
-  pre-commit:
-    taskfile: .taskfiles/pre-commit.yml
-    dir: .
 
 tasks:
-  # ============================================================
-  # Help (shown when you run `task` with no arguments)
-  # ============================================================
-
-  default:
-    desc: "List the most common commands"
-    silent: true
-    cmds:
-      - |
-        echo "Common commands (run 'task --list' to see all):"
-        echo ""
-        echo "  task dev            Start backend & frontend on free ports"
-        echo "  task backend:dev    Start backend on default port"
-        echo "  task frontend:dev   Start frontend on default port"
-        echo "  task desktop:dev    Start desktop app"
-        echo "  task check          Quality gate (lint, typecheck, test, etc.)"
-
   # ============================================================
   # Setup & Prerequisites
   # ============================================================
@@ -78,22 +58,9 @@ tasks:
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
 
-  dev:saas:
-    desc: "Start SaaS backend + frontend concurrently on free ports"
-    cmds:
-      - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas }
-
   dev:all:
     desc: "Start backend + frontend + engine concurrently on free ports"
-    cmds:
-      - task: dev:_all
-
-  dev:_all:
-    internal: true
     vars:
-      FRONTEND: '{{.FRONTEND | default "proprietary"}}'
-      BACKEND: '{{.BACKEND | default "proprietary"}}'
       PORTS:
         sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
       BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -103,12 +70,11 @@ tasks:
       - task: engine:dev
         vars:
           PORT: '{{.ENGINE_PORT}}'
-      - task: 'backend:dev:{{.BACKEND}}'
+      - task: backend:dev
         vars:
           PORT: '{{.BACKEND_PORT}}'
           AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-          AIENGINE_ENABLED: "true"
-      - task: 'frontend:dev:{{.FRONTEND}}'
+      - task: frontend:dev:prototypes
         vars:
           PORT: '{{.FRONTEND_PORT}}'
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
@@ -192,6 +158,4 @@ tasks:
     desc: "Clean all build artifacts"
     cmds:
       - task: backend:clean
-      - task: frontend:clean
       - task: engine:clean
-      - task: pre-commit:clean

app/.gitignore

@@ -1,3 +0,0 @@
-# Whitelist committed env defaults. `.env.saas.local` (and any other .env*)
-# stays ignored via the root .gitignore.
-!.env.saas

app/allowed-licenses.json

@@ -1,9 +1,5 @@
 {
   "allowedLicenses": [
-    {
-      "moduleName": "org.jboss:jboss-transaction-spi",
-      "moduleLicense": "Public Domain"
-    },
     {
       "moduleName": ".*",
       "moduleLicense": "BSD License"
@@ -48,10 +44,6 @@
       "moduleName": ".*",
       "moduleLicense": "The MIT License"
     },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "MIT-0"
-    },
     {
       "moduleName": "com.github.jai-imageio:jai-imageio-core",
       "moduleLicense": "LICENSE.txt"

app/common/build.gradle

@@ -1,4 +1,7 @@
-// REMOVED: bootRun{enabled=false} - Spring Boot plugin task. :common is a Quarkus library module.
+// Configure bootRun to disable it or point to a main class
+bootRun {
+    enabled = false
+}
 spotless {
     java {
         target 'src/**/java/**/*.java'
@@ -27,29 +30,8 @@ spotless {
 }
 dependencies {
     api 'com.google.guava:guava:33.6.0-jre'
-
-    // spring-boot-starter-webmvc -> Quarkus REST stack (api-scoped so downstream modules inherit it).
-    api 'io.quarkus:quarkus-rest'
-    api 'io.quarkus:quarkus-rest-jackson'
-    // Servlet bridge: large amounts of controller/filter code use jakarta.servlet (HttpServletRequest,
-    // Filter, etc.). quarkus-undertow provides a servlet container on Quarkus so that API resolves and
-    // runs. TODO: Migration required - longer term, port servlet usage to JAX-RS (ContainerRequestContext)
-    //       and drop quarkus-undertow.
-    api 'io.quarkus:quarkus-undertow'
-    // Bean Validation (was transitively in spring-boot-starter-webmvc).
-    api 'io.quarkus:quarkus-hibernate-validator'
-    // @Scheduled support (was spring-context scheduling). quarkus-scheduler manages its own
-    // executor; the former SchedulingConfig TaskScheduler bean is no longer needed.
-    api 'io.quarkus:quarkus-scheduler'
-    // BCrypt implementation backing the Spring Security PasswordEncoder compatibility shim
-    // (replaces spring-security-crypto's BCryptPasswordEncoder). Standalone, no framework.
-    api 'at.favre.lib:bcrypt:0.10.2'
-    // Swagger/OpenAPI annotations (io.swagger.v3.oas.annotations.*) used by common's API marker
-    // interfaces; was transitive via springdoc. Quarkus' SmallRye OpenAPI also understands these.
-    api 'io.swagger.core.v3:swagger-core-jakarta:2.2.46'
-    // REMOVED: spring-boot-starter-aspectj. Quarkus has no AspectJ weaving; quarkus-arc provides
-    // CDI interceptors (@AroundInvoke / interceptor bindings) instead.
-    // TODO: Migration required - any @Aspect/@Around advice must be rewritten as CDI interceptors.
+    api 'org.springframework.boot:spring-boot-starter-webmvc'
+    api 'org.springframework.boot:spring-boot-starter-aspectj'
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
@@ -63,8 +45,7 @@ dependencies {
     api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    // springdoc-openapi-starter-webmvc-ui -> SmallRye OpenAPI (schema at /q/openapi, UI at /q/swagger-ui)
-    api 'io.quarkus:quarkus-smallrye-openapi'
+    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
     api 'org.simplejavamail:simple-java-mail:8.12.6'
     api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -79,7 +60,7 @@ dependencies {
         exclude group: 'com.google.code.gson', module: 'gson'
     }
 
-    api 'com.stirling:jpdfium:1.0.2'
+    api 'com.stirling:jpdfium:1.0.1'
 
     // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
     def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
@@ -94,17 +75,9 @@ dependencies {
     }
     logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
     jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.1"
     }
 
-    // Jackson 3 (tools.jackson) - retained because ~100 files migrated to the Jackson 3 namespace
-    // under Spring Boot 4. Quarkus integrates Jackson 2 for REST bodies; Jackson 3 coexists here as a
-    // plain library so those files compile and can still build/parse JSON directly.
-    // api-scoped so downstream modules (core, proprietary, saas) that import tools.jackson inherit it.
-    // TODO: Migration required - converge the codebase on a single Jackson major version.
-    api 'tools.jackson.core:jackson-databind:3.0.0'
-    api 'tools.jackson.core:jackson-core:3.0.0'
-
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)
     implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0'
 

app/common/src/main/java/stirling/software/SPDF/config/EndpointConfiguration.java

@@ -6,16 +6,15 @@ import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Service;
 
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 
-@ApplicationScoped
+@Service
 @Slf4j
 public class EndpointConfiguration {
 
@@ -53,10 +52,9 @@ public class EndpointConfiguration {
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
-    @Inject
     public EndpointConfiguration(
             ApplicationProperties applicationProperties,
-            @Named("runningProOrHigher") boolean runningProOrHigher) {
+            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
         this.applicationProperties = applicationProperties;
         this.runningProOrHigher = runningProOrHigher;
         init();

app/common/src/main/java/stirling/software/SPDF/pdf/parser/CompositeTableParser.java

@@ -0,0 +1,73 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.context.annotation.Primary;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Chains table parsers in priority order: Tabula lattice → Tabula stream → {@link
+ * LineAlignmentTableParser}. The first parser returning a result above {@link
+ * #TABULA_CONFIDENCE_THRESHOLD} wins; results from different parsers are never mixed on one page.
+ */
+@Service
+@Primary
+@RequiredArgsConstructor
+@Slf4j
+public class CompositeTableParser implements TableParser {
+
+    /** Min Tabula confidence to accept results; below this LineAlignment is tried instead. */
+    static final float TABULA_CONFIDENCE_THRESHOLD = 0.5f;
+
+    private final TabulaTableParser tabulaParser;
+    private final LineAlignmentTableParser lineAlignmentParser;
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        // Step 1: Tabula lattice mode (ruled/bordered tables).
+        List<TableFragment> latticeResults = filterConfident(tabulaParser.parse(document, rawPage));
+        if (!latticeResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula lattice ({} table(s))",
+                    rawPage.pageNumber(),
+                    latticeResults.size());
+            return latticeResults;
+        }
+
+        // Step 2: Tabula stream mode (borderless/whitespace-delimited tables).
+        // parseStream is not on the TableParser interface — this intentionally couples to the
+        // concrete TabulaTableParser since stream mode is a Tabula-specific concept.
+        List<TableFragment> streamResults =
+                filterConfident(tabulaParser.parseStream(document, rawPage));
+        if (!streamResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using Tabula stream ({} table(s))",
+                    rawPage.pageNumber(),
+                    streamResults.size());
+            return streamResults;
+        }
+
+        // Step 3: Geometry-based line-alignment fallback.
+        List<TableFragment> lineResults = lineAlignmentParser.parse(document, rawPage);
+        if (!lineResults.isEmpty()) {
+            log.debug(
+                    "Page {}: using LineAlignment ({} table(s))",
+                    rawPage.pageNumber(),
+                    lineResults.size());
+            return lineResults;
+        }
+
+        return List.of();
+    }
+
+    private List<TableFragment> filterConfident(List<TableFragment> tables) {
+        return tables.stream().filter(t -> t.confidence() >= TABULA_CONFIDENCE_THRESHOLD).toList();
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineAlignmentTableParser.java

@@ -0,0 +1,528 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.TreeMap;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Fallback {@link TableParser} for borderless financial tables using text geometry.
+ *
+ * <p>Identifies "anchor lines" (≥2 numeric tokens), builds a column grid from their right-edge
+ * positions, groups vertically proximate anchor lines into table candidates, then scores each group
+ * on column consistency and anchor density (confidence ceiling 0.85).
+ */
+@Service
+@Slf4j
+public class LineAlignmentTableParser implements TableParser {
+
+    /** Width in points of each column position bucket. */
+    static final float COLUMN_BUCKET_PT = 5f;
+
+    /** Tolerance in buckets when matching a token's right-edge to a confirmed column position. */
+    private static final int COLUMN_MATCH_BUCKETS = 2;
+
+    /** Maximum gap (as a multiple of modal line spacing) before splitting a group. */
+    private static final float MAX_GAP_FACTOR = 2.5f;
+
+    /** Minimum anchor rows (numeric-heavy) to form a valid table. */
+    static final int MIN_TABLE_ROWS = 3;
+
+    /** Minimum confirmed column positions to form a valid table. */
+    static final int MIN_COLUMNS = 2;
+
+    /**
+     * Min fraction of anchor lines a column must appear on to be confirmed (permissive for N/A
+     * rows).
+     */
+    private static final double COLUMN_MIN_FREQUENCY = 0.40;
+
+    /**
+     * Matches financial numeric tokens: integers, decimals, parenthetical negatives, currency,
+     * percent, nil dashes.
+     */
+    private static final Pattern NUMERIC =
+            Pattern.compile("^[\\(\\-\\$£€¥]?\\d[\\d,\\.]*[\\)%]?$|^[-–—]$");
+
+    /**
+     * Lines within this y-distance are merged into one row (restores rows split by LineBuilder's
+     * column-gap logic).
+     */
+    static final float ROW_MERGE_TOLERANCE_PT = 2f;
+
+    // ── public API ───────────────────────────────────────────────────────────────────────────────
+
+    @Override
+    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
+        List<RawLine> lines = rawPage.lines();
+        if (lines.size() < MIN_TABLE_ROWS) return List.of();
+
+        float modalSpacing = computeModalSpacing(lines);
+        List<TokenizedLine> tokenized =
+                mergeCoincidentLines(lines.stream().map(this::tokenize).toList());
+
+        List<TokenizedLine> anchors = tokenized.stream().filter(TokenizedLine::isAnchor).toList();
+
+        if (anchors.size() < MIN_TABLE_ROWS) return List.of();
+
+        List<Float> columnGrid = buildColumnGrid(anchors);
+        if (columnGrid.size() < MIN_COLUMNS) {
+            log.debug(
+                    "Page {}: LineAlignment — fewer than {} confirmed columns, skipping",
+                    rawPage.pageNumber(),
+                    MIN_COLUMNS);
+            return List.of();
+        }
+
+        List<List<TokenizedLine>> groups = groupRows(tokenized, columnGrid, modalSpacing);
+
+        List<TableFragment> results = new ArrayList<>();
+        for (int i = 0; i < groups.size(); i++) {
+            buildFragment(groups.get(i), columnGrid, rawPage.pageNumber(), i)
+                    .ifPresent(results::add);
+        }
+
+        log.debug(
+                "Page {}: LineAlignment detected {} table(s) ({} anchor lines, {} columns)",
+                rawPage.pageNumber(),
+                results.size(),
+                anchors.size(),
+                columnGrid.size());
+        return results;
+    }
+
+    // ── coincident-line merging ──────────────────────────────────────────────────────────────────
+
+    /**
+     * Merges tokenised lines sharing the same y-position into one row, rejoining label/value halves
+     * split by LineBuilder.
+     */
+    List<TokenizedLine> mergeCoincidentLines(List<TokenizedLine> tokenized) {
+        if (tokenized.size() < 2) return tokenized;
+
+        List<TokenizedLine> result = new ArrayList<>();
+        int i = 0;
+
+        while (i < tokenized.size()) {
+            float baseY = tokenized.get(i).line().bounds().y();
+            int j = i + 1;
+            while (j < tokenized.size()
+                    && Math.abs(tokenized.get(j).line().bounds().y() - baseY)
+                            <= ROW_MERGE_TOLERANCE_PT) {
+                j++;
+            }
+
+            if (j == i + 1) {
+                result.add(tokenized.get(i));
+            } else {
+                result.add(mergeGroup(tokenized.subList(i, j)));
+            }
+            i = j;
+        }
+
+        return result;
+    }
+
+    private TokenizedLine mergeGroup(List<TokenizedLine> group) {
+        List<TextFragment> mergedFragments =
+                group.stream()
+                        .flatMap(tl -> tl.line().fragments().stream())
+                        .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        Bounds mergedBounds =
+                group.stream()
+                        .map(tl -> tl.line().bounds())
+                        .reduce(Bounds::merge)
+                        .orElse(group.get(0).line().bounds());
+
+        RawLine mergedLine =
+                new RawLine(
+                        group.get(0).line().lineId(),
+                        mergedFragments,
+                        mergedBounds,
+                        group.get(0).line().pageNumber());
+
+        return tokenize(mergedLine);
+    }
+
+    // ── tokenisation ─────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Splits fragments into word-level tokens; x-positions are estimated linearly within each
+     * fragment.
+     */
+    TokenizedLine tokenize(RawLine line) {
+        List<LineToken> tokens = new ArrayList<>();
+        for (TextFragment frag : line.fragments()) {
+            tokens.addAll(tokensFromFragment(frag));
+        }
+        List<LineToken> numeric = tokens.stream().filter(LineToken::numeric).toList();
+        return new TokenizedLine(line, tokens, numeric);
+    }
+
+    private List<LineToken> tokensFromFragment(TextFragment frag) {
+        String raw = frag.text();
+        if (raw == null || raw.isBlank()) return List.of();
+
+        float fragX = frag.bounds().x();
+        float fragWidth = frag.bounds().width();
+        int rawLen = raw.length();
+
+        List<LineToken> result = new ArrayList<>();
+        int offset = 0;
+        for (String part : raw.split("\\s+")) {
+            if (part.isEmpty()) {
+                offset++;
+                continue;
+            }
+            int idx = raw.indexOf(part, offset);
+            if (idx < 0) idx = offset;
+
+            float tokenX = rawLen > 0 ? fragX + ((float) idx / rawLen) * fragWidth : fragX;
+            float tokenRight =
+                    rawLen > 0
+                            ? fragX + ((float) (idx + part.length()) / rawLen) * fragWidth
+                            : fragX + fragWidth;
+
+            result.add(new LineToken(part, tokenX, tokenRight, NUMERIC.matcher(part).matches()));
+            offset = idx + part.length();
+        }
+        return result;
+    }
+
+    // ── column grid ──────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns confirmed column right-edge positions — those appearing on ≥ {@value
+     * #COLUMN_MIN_FREQUENCY} × N anchor lines.
+     */
+    private List<Float> buildColumnGrid(List<TokenizedLine> anchors) {
+        // bucket → set of line indices that contributed a numeric token to that bucket
+        Map<Integer, List<Integer>> bucketLines = new HashMap<>();
+        for (int i = 0; i < anchors.size(); i++) {
+            for (LineToken t : anchors.get(i).numeric()) {
+                int bucket = bucket(t.right());
+                bucketLines.computeIfAbsent(bucket, k -> new ArrayList<>()).add(i);
+            }
+        }
+
+        int minHits =
+                Math.max(MIN_TABLE_ROWS, (int) Math.ceil(anchors.size() * COLUMN_MIN_FREQUENCY));
+
+        // Confirmed buckets → average right-edge for that bucket
+        TreeMap<Integer, Float> confirmed = new TreeMap<>();
+        for (Map.Entry<Integer, List<Integer>> entry : bucketLines.entrySet()) {
+            // Count distinct lines
+            long distinctLines = entry.getValue().stream().distinct().count();
+            if (distinctLines >= minHits) {
+                double avg =
+                        entry.getValue().stream()
+                                .distinct() // weight each line equally regardless of token count
+                                .mapToDouble(
+                                        lineIdx ->
+                                                avgRightEdgeForBucket(
+                                                        anchors, lineIdx, entry.getKey()))
+                                .average()
+                                .orElse(entry.getKey() * (double) COLUMN_BUCKET_PT);
+                confirmed.put(entry.getKey(), (float) avg);
+            }
+        }
+
+        return new ArrayList<>(confirmed.values()); // already sorted by bucket (left to right)
+    }
+
+    /**
+     * Returns the average right-edge position of tokens in {@code line} whose bucket matches {@code
+     * targetBucket}, falling back to the bucket's nominal centre when no tokens match.
+     */
+    private double avgRightEdgeForBucket(
+            List<TokenizedLine> anchors, int lineIdx, int targetBucket) {
+        return anchors.get(lineIdx).numeric().stream()
+                .filter(t -> bucket(t.right()) == targetBucket)
+                .mapToDouble(LineToken::right)
+                .average()
+                .orElse(targetBucket * (double) COLUMN_BUCKET_PT);
+    }
+
+    // ── grouping ─────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Groups anchor lines into table candidates, including adjacent label rows; a gap &gt;
+     * MAX_GAP_FACTOR × modal spacing splits groups.
+     */
+    private List<List<TokenizedLine>> groupRows(
+            List<TokenizedLine> all, List<Float> columnGrid, float modalSpacing) {
+        float maxGap = modalSpacing > 0 ? modalSpacing * MAX_GAP_FACTOR : 30f;
+
+        List<List<TokenizedLine>> groups = new ArrayList<>();
+        List<TokenizedLine> current = new ArrayList<>();
+
+        for (int i = 0; i < all.size(); i++) {
+            TokenizedLine tl = all.get(i);
+            boolean fits = tl.isAnchor() && matchesGrid(tl, columnGrid);
+
+            if (current.isEmpty()) {
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            float gap =
+                    tl.line().bounds().y()
+                            - current.get(current.size() - 1).line().bounds().bottom();
+
+            if (gap > maxGap) {
+                groups.add(current);
+                current = new ArrayList<>();
+                if (fits) current.add(tl);
+                continue;
+            }
+
+            if (fits) {
+                current.add(tl);
+            } else if (!tl.line().text().isBlank()) {
+                // Include non-anchor lines (labels) only if they have text and are within
+                // proximity.
+                current.add(tl);
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+
+        return groups.stream().filter(g -> hasEnoughAnchorRows(g, columnGrid)).toList();
+    }
+
+    private boolean hasEnoughAnchorRows(List<TokenizedLine> group, List<Float> columnGrid) {
+        return group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count()
+                >= MIN_TABLE_ROWS;
+    }
+
+    /** A line "matches" the grid when ≥ 60 % of its numeric tokens land in confirmed columns. */
+    private boolean matchesGrid(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long matches =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) matches / tl.numeric().size() >= 0.60;
+    }
+
+    private boolean hasInconsistentColumnMatch(TokenizedLine tl, List<Float> columnGrid) {
+        if (tl.numeric().isEmpty()) return false;
+        long hits =
+                tl.numeric().stream()
+                        .filter(t -> nearestColumnIndex(t.right(), columnGrid) >= 0)
+                        .count();
+        return (double) hits / tl.numeric().size() < 0.60;
+    }
+
+    // ── fragment assembly ────────────────────────────────────────────────────────────────────────
+
+    private Optional<TableFragment> buildFragment(
+            List<TokenizedLine> group, List<Float> columnGrid, int pageNumber, int tableIndex) {
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        if (anchorCount < MIN_TABLE_ROWS) return Optional.empty();
+
+        List<String> warnings = new ArrayList<>();
+        List<List<String>> rawRows = new ArrayList<>();
+        List<TableRow> rows = new ArrayList<>();
+
+        for (int rowIdx = 0; rowIdx < group.size(); rowIdx++) {
+            TokenizedLine tl = group.get(rowIdx);
+            List<String> rawRow = buildRawRow(tl, columnGrid);
+            rawRows.add(Collections.unmodifiableList(rawRow));
+            rows.add(buildTableRow(rowIdx, tl, rawRow, columnGrid));
+        }
+
+        // Column count = 1 label column + confirmed numeric columns
+        int colCount = columnGrid.size() + 1;
+        Bounds bounds = computeGroupBounds(group);
+        float confidence = computeConfidence(group, columnGrid, warnings);
+
+        return Optional.of(
+                new TableFragment(
+                        "tbl-la-p" + pageNumber + "-" + tableIndex,
+                        pageNumber,
+                        bounds,
+                        List.of(),
+                        Collections.unmodifiableList(rows),
+                        Collections.unmodifiableList(rawRows),
+                        colCount,
+                        confidence,
+                        Collections.unmodifiableList(warnings),
+                        null));
+    }
+
+    /**
+     * Builds a raw row as a list of strings: index 0 = label text, indices 1..N = column values.
+     */
+    private List<String> buildRawRow(TokenizedLine tl, List<Float> columnGrid) {
+        String[] cells = new String[columnGrid.size() + 1];
+        Arrays.fill(cells, "");
+
+        // Separate label tokens (those not landing in any confirmed column) from column tokens.
+        List<String> labelParts = new ArrayList<>();
+        for (LineToken token : tl.all()) {
+            int col = nearestColumnIndex(token.right(), columnGrid);
+            if (col >= 0 && token.numeric()) {
+                int cellIdx = col + 1;
+                cells[cellIdx] =
+                        cells[cellIdx].isEmpty()
+                                ? token.text()
+                                : cells[cellIdx] + " " + token.text();
+            } else {
+                labelParts.add(token.text());
+            }
+        }
+        cells[0] = String.join(" ", labelParts).trim();
+        return Arrays.asList(cells);
+    }
+
+    private TableRow buildTableRow(
+            int rowIdx, TokenizedLine tl, List<String> rawRow, List<Float> columnGrid) {
+        List<TableCell> cells = new ArrayList<>(rawRow.size());
+
+        // Label cell: use the line's full bounds as an approximation.
+        cells.add(TableCell.of(0, rawRow.get(0), tl.line().bounds()));
+
+        for (int col = 0; col < columnGrid.size(); col++) {
+            String text = col + 1 < rawRow.size() ? rawRow.get(col + 1) : "";
+            float right = columnGrid.get(col);
+            float left = col > 0 ? columnGrid.get(col - 1) : right - 50f;
+            Bounds cellBounds =
+                    new Bounds(
+                            left,
+                            tl.line().bounds().y(),
+                            right - left,
+                            tl.line().bounds().height());
+            cells.add(TableCell.of(col + 1, text, cellBounds));
+        }
+        return new TableRow(rowIdx, Collections.unmodifiableList(cells));
+    }
+
+    // ── confidence scoring ───────────────────────────────────────────────────────────────────────
+
+    /**
+     * Heuristic score in [0.0, 0.85] (ceiling keeps results below Tabula lattice which starts at
+     * 1.0). Base 0.70; +0.05/col beyond 2 (max +0.10); +0.05 at ≥5 anchors, +0.05 at ≥8; −0.15 if
+     * &gt;30 % of anchors have inconsistent columns; −0.10 if non-anchors outnumber anchors.
+     */
+    private float computeConfidence(
+            List<TokenizedLine> group, List<Float> columnGrid, List<String> warnings) {
+        float score = 0.70f;
+
+        long anchorCount =
+                group.stream().filter(r -> r.isAnchor() && matchesGrid(r, columnGrid)).count();
+        long totalRows = group.size();
+
+        // More columns
+        int extraCols = Math.min(columnGrid.size() - MIN_COLUMNS, 2);
+        score += extraCols * 0.05f;
+
+        // More anchor rows
+        if (anchorCount >= 5) score += 0.05f;
+        if (anchorCount >= 8) score += 0.05f;
+
+        // Inconsistent column matching
+        long inconsistent =
+                group.stream()
+                        .filter(TokenizedLine::isAnchor)
+                        .filter(tl -> hasInconsistentColumnMatch(tl, columnGrid))
+                        .count();
+        if (inconsistent > anchorCount * 0.30) {
+            score -= 0.15f;
+            warnings.add(
+                    "Column match inconsistent on "
+                            + inconsistent
+                            + "/"
+                            + anchorCount
+                            + " anchor rows");
+        }
+
+        // Label-heavy
+        long nonAnchor = totalRows - anchorCount;
+        if (nonAnchor > anchorCount) {
+            score -= 0.10f;
+            warnings.add(
+                    "Non-anchor rows ("
+                            + nonAnchor
+                            + ") outnumber anchor rows ("
+                            + anchorCount
+                            + ")");
+        }
+
+        return Math.max(0f, Math.min(0.85f, score));
+    }
+
+    // ── utility ──────────────────────────────────────────────────────────────────────────────────
+
+    /**
+     * Returns the grid index nearest to {@code rightEdge}, or -1 if none is within {@value
+     * #COLUMN_MATCH_BUCKETS} buckets.
+     */
+    private int nearestColumnIndex(float rightEdge, List<Float> grid) {
+        int nearest = -1;
+        float minDist = COLUMN_MATCH_BUCKETS * COLUMN_BUCKET_PT + 1f;
+        for (int i = 0; i < grid.size(); i++) {
+            float dist = Math.abs(rightEdge - grid.get(i));
+            if (dist < minDist) {
+                minDist = dist;
+                nearest = i;
+            }
+        }
+        return nearest;
+    }
+
+    private Bounds computeGroupBounds(List<TokenizedLine> group) {
+        return group.stream()
+                .map(tl -> tl.line().bounds())
+                .reduce(Bounds::merge)
+                .orElse(new Bounds(0, 0, 0, 0));
+    }
+
+    /** Modal gap between consecutive line edges, used to calibrate the group-split threshold. */
+    private float computeModalSpacing(List<RawLine> lines) {
+        if (lines.size() < 2) return 0f;
+        Map<Float, Long> freq = new HashMap<>();
+        for (int i = 1; i < lines.size(); i++) {
+            float gap = lines.get(i).bounds().y() - lines.get(i - 1).bounds().bottom();
+            if (gap > 0) freq.merge(Math.round(gap / 2f) * 2f, 1L, Long::sum);
+        }
+        return freq.entrySet().stream()
+                .max(Map.Entry.comparingByValue())
+                .map(Map.Entry::getKey)
+                .orElse(0f);
+    }
+
+    private static int bucket(float x) {
+        return Math.round(x / COLUMN_BUCKET_PT);
+    }
+
+    // ── private data types ───────────────────────────────────────────────────────────────────────
+
+    /** A word-level token with an approximate right-edge x-position. */
+    record LineToken(String text, float x, float right, boolean numeric) {}
+
+    /** A {@link RawLine} with tokens pre-computed; an "anchor" has ≥ 2 numeric tokens. */
+    record TokenizedLine(RawLine line, List<LineToken> all, List<LineToken> numeric) {
+        boolean isAnchor() {
+            return numeric.size() >= 2;
+        }
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/LineBuilder.java

@@ -0,0 +1,139 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Groups {@link TextFragment} objects into visual {@link RawLine}s using baseline proximity.
+ *
+ * <p>Fragments are on the same line when their baselines are within a font-size-derived tolerance.
+ * A new line starts whenever the horizontal gap exceeds an adaptive column-gap threshold ({@code
+ * max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT)}), splitting two-column text.
+ */
+@Service
+@Slf4j
+public class LineBuilder {
+
+    /** Baseline tolerance as a fraction of font size; 0.5 keeps mixed-size text on one line. */
+    private static final float BASELINE_TOLERANCE_FACTOR = 0.5f;
+
+    /** Absolute minimum tolerance so tiny font sizes don't collapse multi-line content. */
+    private static final float MIN_BASELINE_TOLERANCE = 2f;
+
+    /**
+     * Column-gap threshold as a fraction of page width; 0.10 clears tab stops but stays below
+     * two-column gutters.
+     */
+    static final float COLUMN_GAP_RATIO = 0.10f;
+
+    /** Floor for the column-gap threshold so narrow pages don't over-split lines. */
+    static final float COLUMN_GAP_MIN_PT = 40f;
+
+    public List<RawLine> build(List<TextFragment> fragments, int pageNumber) {
+        if (fragments.isEmpty()) return List.of();
+
+        float effectiveWidth = inferEffectiveWidth(fragments);
+        float columnGapThreshold = Math.max(effectiveWidth * COLUMN_GAP_RATIO, COLUMN_GAP_MIN_PT);
+        log.debug(
+                "LineBuilder page {}: effectiveWidth={:.1f}pt, columnGapThreshold={:.1f}pt",
+                pageNumber,
+                effectiveWidth,
+                columnGapThreshold);
+
+        // Sort top-to-bottom first, then left-to-right within the same baseline band.
+        List<TextFragment> sorted =
+                fragments.stream()
+                        .sorted(
+                                Comparator.comparingDouble(TextFragment::baseline)
+                                        .thenComparingDouble(f -> f.bounds().x()))
+                        .toList();
+
+        List<List<TextFragment>> groups = groupByBaseline(sorted, columnGapThreshold);
+
+        List<RawLine> lines = new ArrayList<>(groups.size());
+        for (int i = 0; i < groups.size(); i++) {
+            List<TextFragment> group =
+                    groups.get(i).stream()
+                            .sorted(Comparator.comparingDouble(f -> f.bounds().x()))
+                            .toList();
+
+            Bounds lineBounds =
+                    group.stream()
+                            .map(TextFragment::bounds)
+                            .reduce(Bounds::merge)
+                            .orElse(new Bounds(0, 0, 0, 0));
+
+            lines.add(new RawLine("ln-p" + pageNumber + "-" + i, group, lineBounds, pageNumber));
+        }
+        return lines;
+    }
+
+    private List<List<TextFragment>> groupByBaseline(
+            List<TextFragment> sorted, float columnGapThreshold) {
+        List<List<TextFragment>> groups = new ArrayList<>();
+        List<TextFragment> current = new ArrayList<>();
+        float currentBaseline = Float.NaN;
+
+        for (TextFragment fragment : sorted) {
+            if (current.isEmpty()) {
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+                continue;
+            }
+
+            float maxFontSize =
+                    Math.max(
+                            fragment.fontSize(),
+                            (float)
+                                    current.stream()
+                                            .mapToDouble(TextFragment::fontSize)
+                                            .max()
+                                            .orElse(0));
+            float tolerance =
+                    Math.max(maxFontSize * BASELINE_TOLERANCE_FACTOR, MIN_BASELINE_TOLERANCE);
+
+            boolean sameBaseline = Math.abs(fragment.baseline() - currentBaseline) <= tolerance;
+            boolean columnGap = sameBaseline && hasColumnGap(fragment, current, columnGapThreshold);
+
+            if (sameBaseline && !columnGap) {
+                current.add(fragment);
+                // Anchor to the weighted mean baseline so long lines stay stable.
+                currentBaseline =
+                        (currentBaseline * (current.size() - 1) + fragment.baseline())
+                                / current.size();
+            } else {
+                groups.add(current);
+                current = new ArrayList<>();
+                current.add(fragment);
+                currentBaseline = fragment.baseline();
+            }
+        }
+
+        if (!current.isEmpty()) groups.add(current);
+        return groups;
+    }
+
+    /**
+     * True when the gap from the rightmost fragment in {@code group} to {@code next} exceeds {@code
+     * threshold}.
+     */
+    private static boolean hasColumnGap(
+            TextFragment next, List<TextFragment> group, float threshold) {
+        float lastRight = group.get(group.size() - 1).bounds().right();
+        return next.bounds().x() - lastRight > threshold;
+    }
+
+    /** Infers effective page width from the rightmost fragment right-edge plus a 10 % margin. */
+    private static float inferEffectiveWidth(List<TextFragment> fragments) {
+        double maxRight =
+                fragments.stream().mapToDouble(f -> f.bounds().right()).max().orElse(500.0);
+        return (float) maxRight * 1.10f;
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PageColumnLayout.java

@@ -1,142 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Detects whether a page is one- or two-column from per-line bounding boxes, and classifies an
- * X-span into the column it belongs to. Detection is a midpoint vote at {@code pageWidth / 2}.
- *
- * <p>Capped at two columns by design — sufficient for the redaction target set (single-column
- * documents and IEEE-style two-column papers). 3+ column layouts (newspapers, magazines) and
- * off-centre gutters (asymmetric two-column) would need a histogram or clustering approach to
- * detect the actual gutter X. (future work)
- *
- * <p>Coordinates are PDFTextStripper screen space (top-left origin, Y increases downward).
- */
-public final class PageColumnLayout {
-
-    /**
-     * Slack when checking "crosses a gutter" so single-pixel overshoots don't mark a line as
-     * spanning.
-     */
-    public static final float SPAN_SLACK_PT = 2f;
-
-    /**
-     * Slack on each side of the page midpoint inside which a line is considered "spanning"
-     * (covering both columns) rather than belonging to one side.
-     */
-    private static final float MIDPOINT_SLACK_PT = 30f;
-
-    /**
-     * Minimum line width (points) for a line to count toward the two-column tally. Avoids false
-     * positives where right-aligned dates, page numbers, or short "Link" fragments next to a
-     * heading look like a second column when they're really just inline metadata.
-     */
-    private static final float MIN_COLUMN_LINE_WIDTH_PT = 100f;
-
-    /**
-     * Minimum number of clearly leftish AND clearly rightish lines (each of width &ge; {@link
-     * #MIN_COLUMN_LINE_WIDTH_PT}) required to call the page two-column. Anything below this falls
-     * back to single-column.
-     */
-    private static final int MIN_SIDE_LINES = 3;
-
-    private final List<float[]> columns;
-    private final List<float[]> gutters;
-
-    private PageColumnLayout(List<float[]> columns, List<float[]> gutters) {
-        this.columns = columns;
-        this.gutters = gutters;
-    }
-
-    /**
-     * Determines column layout from per-line bounding boxes ({@code [x1, _, x2, _]}). Counts lines
-     * whose X-midpoint sits clearly left of, or clearly right of, the page midpoint (with {@link
-     * #MIDPOINT_SLACK_PT} slack each side). If both sides have at least {@link #MIN_SIDE_LINES}
-     * lines, the page is treated as two-column with the gutter at the page midpoint. Otherwise it's
-     * single-column.
-     *
-     * <p>Cross-column lines must already be split: callers should feed boxes from a line extractor
-     * that splits same-Y glyphs at large X gaps (see {@code AllTextLineExtractor}). Without that
-     * split, IEEE-style aligned-baseline 2-column PDFs produce one wide merged box per row and the
-     * side tallies all end up classified as "spanning", falling to single-column.
-     */
-    public static PageColumnLayout fromLineBoxes(List<float[]> lineBoxes, float pageWidth) {
-        if (lineBoxes == null || lineBoxes.isEmpty()) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float pageMid = pageWidth / 2f;
-        int left = 0, right = 0;
-        for (float[] lb : lineBoxes) {
-            if (lb == null || lb.length < 3) continue;
-            float width = lb[2] - lb[0];
-            // Skip narrow lines — dates, page numbers, "Link" labels next to a heading should
-            // not, on their own, make a single-column doc look two-column.
-            if (width < MIN_COLUMN_LINE_WIDTH_PT) continue;
-            float mid = (lb[0] + lb[2]) * 0.5f;
-            if (mid < pageMid - MIDPOINT_SLACK_PT) left++;
-            else if (mid > pageMid + MIDPOINT_SLACK_PT) right++;
-        }
-        if (left < MIN_SIDE_LINES || right < MIN_SIDE_LINES) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float gutterL = pageMid - MIDPOINT_SLACK_PT;
-        float gutterR = pageMid + MIDPOINT_SLACK_PT;
-        return new PageColumnLayout(
-                List.of(new float[] {0f, gutterL}, new float[] {gutterR, pageWidth}),
-                List.of(new float[] {gutterL, gutterR}));
-    }
-
-    /** All columns, left-to-right, as {@code [leftX, rightX]} pairs. Never empty. */
-    public List<float[]> columns() {
-        return columns;
-    }
-
-    /** Gutters between columns, left-to-right, as {@code [leftX, rightX]} pairs. */
-    public List<float[]> gutters() {
-        return gutters;
-    }
-
-    public int columnCount() {
-        return columns.size();
-    }
-
-    /**
-     * Returns the column index containing the X-midpoint of {@code [x1, x2]}, falling back to the
-     * closest column if the midpoint sits inside a gutter.
-     */
-    public int columnOf(float x1, float x2) {
-        float mid = (x1 + x2) * 0.5f;
-        int best = 0;
-        float bestDist = Float.MAX_VALUE;
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            if (mid >= c[0] && mid <= c[1]) return i;
-            float dist = mid < c[0] ? c[0] - mid : mid - c[1];
-            if (dist < bestDist) {
-                bestDist = dist;
-                best = i;
-            }
-        }
-        return best;
-    }
-
-    /**
-     * Returns every column index whose X-range overlaps {@code [x1, x2]} with at least {@link
-     * #SPAN_SLACK_PT} of intrusion. A normal in-column line returns one index; a line crossing a
-     * gutter returns two or more.
-     */
-    public int[] columnsCrossing(float x1, float x2) {
-        List<Integer> hits = new ArrayList<>();
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            float overlap = Math.min(x2, c[1]) - Math.max(x1, c[0]);
-            if (overlap > SPAN_SLACK_PT) hits.add(i);
-        }
-        if (hits.isEmpty()) hits.add(columnOf(x1, x2));
-        int[] out = new int[hits.size()];
-        for (int i = 0; i < hits.size(); i++) out[i] = hits.get(i);
-        return out;
-    }
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PageImageLocator.java

@@ -1,133 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.awt.geom.Point2D;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.contentstream.PDFGraphicsStreamEngine;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImage;
-import org.apache.pdfbox.util.Matrix;
-
-/**
- * PDFGraphicsStreamEngine that intercepts {@code drawImage} calls and records each image's bounding
- * box in PDF user-space (origin bottom-left, Y up) by transforming the unit square through the
- * current transformation matrix (CTM).
- *
- * <p>Usage:
- *
- * <pre>{@code
- * PageImageLocator locator = new PageImageLocator(page, pageIndex);
- * locator.processPage(page);
- * List<ImageBox> boxes = locator.getImageBoxes();
- * }</pre>
- *
- * <p>Each {@link ImageBox} carries the 0-based page index and the axis-aligned bounding box {@code
- * (x1, y1, x2, y2)} in PDF user-space coordinates.
- */
-public final class PageImageLocator extends PDFGraphicsStreamEngine {
-
-    /**
-     * Bounding box of a raster or vector image found on a PDF page.
-     *
-     * @param pageIndex 0-based page index
-     * @param x1 left edge in PDF user-space (origin bottom-left)
-     * @param y1 bottom edge in PDF user-space
-     * @param x2 right edge
-     * @param y2 top edge
-     */
-    public record ImageBox(int pageIndex, float x1, float y1, float x2, float y2) {}
-
-    private final int pageIndex;
-    private final List<ImageBox> imageBoxes = new ArrayList<>();
-    private final Point2D.Float currentPoint = new Point2D.Float();
-
-    /**
-     * @param page the PDPage to process
-     * @param pageIndex 0-based index of this page in the document (stored on each returned {@link
-     *     ImageBox})
-     */
-    public PageImageLocator(PDPage page, int pageIndex) {
-        super(page);
-        this.pageIndex = pageIndex;
-    }
-
-    /** Returns all image bounding boxes collected during {@link #processPage}. */
-    public List<ImageBox> getImageBoxes() {
-        return imageBoxes;
-    }
-
-    @Override
-    public void drawImage(PDImage pdImage) throws IOException {
-        Matrix ctm = getGraphicsState().getCurrentTransformationMatrix();
-        // An image occupies the unit square (0,0)→(1,1) in image space.
-        // Transform all four corners through the CTM to get the page-space bounding box.
-        float a = ctm.getScaleX();
-        float b = ctm.getShearY();
-        float c = ctm.getShearX();
-        float d = ctm.getScaleY();
-        float e = ctm.getTranslateX();
-        float f = ctm.getTranslateY();
-        float[] xs = {e, a + e, c + e, a + c + e};
-        float[] ys = {f, b + f, d + f, b + d + f};
-        float x1 = Float.MAX_VALUE, y1 = Float.MAX_VALUE;
-        float x2 = -Float.MAX_VALUE, y2 = -Float.MAX_VALUE;
-        for (float x : xs) {
-            x1 = Math.min(x1, x);
-            x2 = Math.max(x2, x);
-        }
-        for (float y : ys) {
-            y1 = Math.min(y1, y);
-            y2 = Math.max(y2, y);
-        }
-        imageBoxes.add(new ImageBox(pageIndex, x1, y1, x2, y2));
-    }
-
-    // ---------- required abstract methods (no-op for path operations) ----------
-
-    @Override
-    public void appendRectangle(Point2D p0, Point2D p1, Point2D p2, Point2D p3) {}
-
-    @Override
-    public void clip(int windingRule) {}
-
-    @Override
-    public void moveTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void lineTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void curveTo(float x1, float y1, float x2, float y2, float x3, float y3) {
-        currentPoint.setLocation(x3, y3);
-    }
-
-    @Override
-    public Point2D getCurrentPoint() {
-        return currentPoint;
-    }
-
-    @Override
-    public void closePath() {}
-
-    @Override
-    public void endPath() {}
-
-    @Override
-    public void strokePath() {}
-
-    @Override
-    public void fillPath(int windingRule) {}
-
-    @Override
-    public void fillAndStrokePath(int windingRule) {}
-
-    @Override
-    public void shadingFill(COSName shadingName) {}
-}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/PdfIngester.java

@@ -0,0 +1,79 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Runs the per-page ingestion pipeline: {@link WordExtractingStripper} → {@link LineBuilder} →
+ * {@link TableParser}, producing a {@link PdfModels.ParsedPage} per page. The caller owns the
+ * {@link PDDocument} lifecycle.
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class PdfIngester {
+
+    private final LineBuilder lineBuilder;
+    private final TableParser tableParser;
+
+    public List<ParsedPage> parse(PDDocument document) throws IOException {
+        return parse(document, document.getNumberOfPages());
+    }
+
+    public List<ParsedPage> parse(PDDocument document, int maxPages) throws IOException {
+        int pageCount = Math.min(document.getNumberOfPages(), maxPages);
+        List<ParsedPage> pages = new ArrayList<>(pageCount);
+        long fragmentsMs = 0;
+        long tablesMs = 0;
+        long t0 = System.currentTimeMillis();
+
+        for (int p = 1; p <= pageCount; p++) {
+            long ft = System.currentTimeMillis();
+            List<TextFragment> fragments = extractFragments(document, p);
+            fragmentsMs += System.currentTimeMillis() - ft;
+
+            PDPage page = document.getPage(p - 1);
+            PDRectangle mediaBox = page.getMediaBox();
+            List<RawLine> lines = lineBuilder.build(fragments, p);
+            RawPage rawPage = new RawPage(p, mediaBox.getWidth(), mediaBox.getHeight(), lines);
+
+            long tt = System.currentTimeMillis();
+            List<TableFragment> tables = tableParser.parse(document, rawPage);
+            tablesMs += System.currentTimeMillis() - tt;
+
+            log.debug(
+                    "Page {}: {} fragments → {} lines, {} table(s)",
+                    p,
+                    fragments.size(),
+                    lines.size(),
+                    tables.size());
+            pages.add(new ParsedPage(p, mediaBox.getWidth(), mediaBox.getHeight(), tables, lines));
+        }
+
+        log.info(
+                "[timing] parse pages={} total={}ms fragments={}ms tables={}ms",
+                pageCount,
+                System.currentTimeMillis() - t0,
+                fragmentsMs,
+                tablesMs);
+        return pages;
+    }
+
+    private List<TextFragment> extractFragments(PDDocument document, int pageNumber)
+            throws IOException {
+        WordExtractingStripper stripper = new WordExtractingStripper(pageNumber);
+        stripper.getText(document);
+        return stripper.getFragments();
+    }
+}

app/common/src/main/java/stirling/software/SPDF/pdf/parser/TabulaTableParser.java

@@ -9,8 +9,7 @@ import java.util.Collections;
 import java.util.List;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.stereotype.Service;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -48,7 +47,7 @@ import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
  *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
  * </ul>
  */
-@ApplicationScoped
+@Service
 @Slf4j
 public class TabulaTableParser implements TableParser {
 

app/common/src/main/java/stirling/software/SPDF/pdf/parser/WordExtractingStripper.java

@@ -0,0 +1,113 @@
+package stirling.software.SPDF.pdf.parser;
+
+import static stirling.software.SPDF.pdf.parser.PdfModels.*;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.text.PDFTextStripper;
+import org.apache.pdfbox.text.TextPosition;
+
+/**
+ * Extends {@link PDFTextStripper} to capture per-fragment geometry and font metadata.
+ *
+ * <p>Overrides {@link #writeString} to split each content-stream string into word-level {@link
+ * TextFragment}s with bounding boxes, baseline, font name, and bold flag. Coordinates are in
+ * PDFTextStripper space: (0,0) top-left, Y increases downward, {@code getY()} is the baseline.
+ */
+class WordExtractingStripper extends PDFTextStripper {
+
+    private final int targetPage;
+    private final List<TextFragment> fragments = new ArrayList<>();
+    private int fragmentIndex = 0;
+
+    WordExtractingStripper(int pageNumber) throws IOException {
+        this.targetPage = pageNumber;
+        setStartPage(pageNumber);
+        setEndPage(pageNumber);
+        setSortByPosition(true);
+    }
+
+    @Override
+    protected void startPage(PDPage page) throws IOException {
+        super.startPage(page);
+        fragments.clear();
+        fragmentIndex = 0;
+    }
+
+    @Override
+    protected void writeString(String text, List<TextPosition> textPositions) throws IOException {
+        if (text == null || text.isBlank()) return;
+
+        // Fast path: no whitespace → emit one fragment (most financial PDFs have each
+        // number as its own string operation, so this is the common case).
+        if (text.indexOf(' ') < 0) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Per-word splitting requires 1:1 text-char to TextPosition correspondence.
+        // Fall back to one fragment when sizes differ (ligatures, encoding edge cases).
+        if (textPositions.size() != text.length()) {
+            emitFragment(text, textPositions);
+            return;
+        }
+
+        // Emit one TextFragment per whitespace-delimited word with accurate per-word bounds.
+        int start = 0;
+        for (int i = 0; i <= text.length(); i++) {
+            if (i == text.length() || text.charAt(i) == ' ') {
+                if (start < i) {
+                    emitFragment(text.substring(start, i), textPositions.subList(start, i));
+                }
+                start = i + 1;
+            }
+        }
+    }
+
+    private void emitFragment(String text, List<TextPosition> positions) {
+        if (positions.isEmpty()) return;
+
+        float minX = Float.MAX_VALUE;
+        float minY = Float.MAX_VALUE;
+        float maxRight = -Float.MAX_VALUE;
+        float maxBaseline = -Float.MAX_VALUE;
+        TextPosition first = null;
+
+        for (TextPosition tp : positions) {
+            if (tp == null) continue;
+            if (first == null) first = tp;
+
+            float x = tp.getX();
+            // getY() is the baseline; top of character = getY() - getHeight().
+            float top = tp.getY() - tp.getHeight();
+            float right = x + tp.getWidth();
+            float baseline = tp.getY();
+
+            minX = Math.min(minX, x);
+            minY = Math.min(minY, top);
+            maxRight = Math.max(maxRight, right);
+            maxBaseline = Math.max(maxBaseline, baseline);
+        }
+
+        if (first == null) return;
+
+        PDFont font = first.getFont();
+        String fontName = font != null ? font.getName() : "";
+        boolean bold = fontName != null && fontName.toLowerCase().contains("bold");
+        // getHeight() gives the rendered glyph height, which is the most reliable visual size.
+        float fontSize = first.getHeight();
+
+        Bounds bounds = new Bounds(minX, minY, maxRight - minX, maxBaseline - minY);
+        String id = "tf-p" + targetPage + "-" + fragmentIndex++;
+        fragments.add(new TextFragment(id, text, bounds, maxBaseline, fontSize, fontName, bold));
+    }
+
+    List<TextFragment> getFragments() {
+        return Collections.unmodifiableList(fragments);
+    }
+}

app/common/src/main/java/stirling/software/common/annotations/AutoJobPostMapping.java

@@ -2,27 +2,21 @@ package stirling.software.common.annotations;
 
 import java.lang.annotation.*;
 
-import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import org.springframework.core.annotation.AliasFor;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 
-import jakarta.enterprise.util.Nonbinding;
-import jakarta.interceptor.InterceptorBinding;
-import jakarta.ws.rs.core.MediaType;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
 
 /**
  * Shortcut for a POST endpoint that is executed through the Stirling "auto‑job" framework.
  *
- * <p>MIGRATION (Spring -> Quarkus): this was a Spring composed meta-annotation that stamped
- * {@code @RequestMapping(method=POST)} onto the target via {@code @AliasFor}. JAX-RS does not
- * honour {@code @Path}/{@code @POST}/{@code @Consumes} through meta-annotations, so this annotation
- * no longer provides routing. It is now a CDI {@link InterceptorBinding} handled by {@code
- * AutoJobInterceptor}. <b>Controllers using {@code @AutoJobPostMapping} must additionally declare
- * their own JAX-RS {@code @POST} + {@code @Path(value)} + {@code @Consumes(consumes)}.</b> The
- * {@link #value()}/{@link #consumes()} members are retained so a scanner/controller can read the
- * intended routing.
- *
  * <p>Behaviour notes:
  *
  * <ul>
+ *   <li>The endpoint is registered with {@code POST} and, by default, consumes {@code
+ *       multipart/form-data} unless you override {@link #consumes()}.
  *   <li>When the client supplies {@code ?async=true} the call is handed to {@link
  *       stirling.software.common.service.JobExecutorService JobExecutorService} where it may be
  *       queued, retried, tracked and subject to time‑outs. For synchronous (default) invocations
@@ -32,26 +26,22 @@ import jakarta.ws.rs.core.MediaType;
  *       GET /api/v1/general/job/{id}</code>.
  * </ul>
  *
- * <p>Unless stated otherwise an attribute only affects <em>async</em> execution. All members are
- * {@code @Nonbinding} so the single {@code AutoJobInterceptor} matches every annotated method; the
- * interceptor reads the actual values reflectively from the target method.
+ * <p>Unless stated otherwise an attribute only affects <em>async</em> execution.
  */
-@Target({ElementType.METHOD, ElementType.TYPE})
+@Target(ElementType.METHOD)
 @Retention(RetentionPolicy.RUNTIME)
 @Documented
-@InterceptorBinding
+@RequestMapping(method = RequestMethod.POST)
 @RequestBody(required = true)
 public @interface AutoJobPostMapping {
 
-    /**
-     * The path mapping of the endpoint (controllers must mirror this on a JAX-RS {@code @Path}).
-     */
-    @Nonbinding
+    /** Alias for {@link RequestMapping#value} – the path mapping of the endpoint. */
+    @AliasFor(annotation = RequestMapping.class, attribute = "value")
     String[] value() default {};
 
     /** MIME types this endpoint accepts. Defaults to {@code multipart/form-data}. */
-    @Nonbinding
-    String[] consumes() default {MediaType.MULTIPART_FORM_DATA};
+    @AliasFor(annotation = RequestMapping.class, attribute = "consumes")
+    String[] consumes() default {MediaType.MULTIPART_FORM_DATA_VALUE};
 
     /**
      * Maximum execution time in milliseconds before the job is aborted. A negative value means "use
@@ -59,7 +49,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     long timeout() default -1;
 
     /**
@@ -68,7 +57,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     int retryCount() default 1;
 
     /**
@@ -76,7 +64,6 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     boolean trackProgress() default true;
 
     /**
@@ -85,17 +72,11 @@ public @interface AutoJobPostMapping {
      *
      * <p>Only honoured when {@code async=true}.
      */
-    @Nonbinding
     boolean queueable() default false;
 
     /**
      * Relative resource weight (1-100). See {@link
      * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
-     *
-     * <p>The default is a sentinel ({@link Integer#MIN_VALUE}); {@code
-     * AutoJobPostMappingWeightTest} fails the build if any endpoint leaves it unset. Runtime
-     * readers clamp the value into {@code [1, 100]}.
      */
-    @Nonbinding
-    int resourceWeight() default Integer.MIN_VALUE;
+    int resourceWeight() default 1;
 }

app/common/src/main/java/stirling/software/common/annotations/api/AccountSecurityApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/account").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/account")
 @Tag(
         name = "Account Security",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/AdminApi.java

@@ -5,20 +5,19 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
  * Combined annotation for Admin Settings API controllers.
- *
- * <p>MIGRATION (Spring -> JAX-RS): JAX-RS/RESTEasy does NOT process {@code @Path} via custom
- * meta-annotations (Spring honoured composed {@code @RestController}/{@code @RequestMapping}
- * through {@code @AliasFor}; JAX-RS has no equivalent). This annotation therefore now carries only
- * the OpenAPI {@code @Tag}. Each controller annotated with {@code @AdminApi} MUST additionally
- * declare its own {@code @jakarta.ws.rs.Path("/api/v1/admin/settings")} (the path the removed
- * {@code @RequestMapping} used to supply).
+ * Includes @RestController, @RequestMapping("/api/v1/admin/settings"), and OpenAPI @Tag.
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
+@RestController
+@RequestMapping("/api/v1/admin/settings")
 @Tag(
         name = "Admin Settings",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/AdminServerCertificateApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/admin/server-certificate").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/admin/server-certificate")
 @Tag(
         name = "Admin - Server Certificate",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/AnalysisApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/analysis").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/analysis")
 @Tag(
         name = "Analysis",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/ConfigApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/config").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/config")
 @Tag(
         name = "Config",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/ConvertApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/convert").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/convert")
 @Tag(
         name = "Convert",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/DatabaseApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/database").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/database")
 @Tag(
         name = "Database",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/DatabaseManagementApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/admin/database").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/admin/database")
 @Tag(
         name = "Database Management",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/FilterApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/filter").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/filter")
 @Tag(
         name = "Filter",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/GeneralApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/general").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/general")
 @Tag(
         name = "General",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/InfoApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/info").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/info")
 @Tag(
         name = "Info",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/InviteApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/invite").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/invite")
 @Tag(
         name = "Invite",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/MiscApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/misc").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/misc")
 @Tag(
         name = "Misc",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/PipelineApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/pipeline").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/pipeline")
 @Tag(
         name = "Pipeline",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/ProprietaryUiDataApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -14,9 +17,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/proprietary/ui-data").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/proprietary/ui-data")
 @Tag(
         name = "Proprietary UI Data",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/SecurityApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/security").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/security")
 @Tag(
         name = "Security",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/SettingsApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/settings").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/settings")
 @Tag(
         name = "Settings",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/TeamApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/team").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/team")
 @Tag(
         name = "Team",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/UiDataApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/ui-data").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/ui-data")
 @Tag(
         name = "UI Data",
         description =

app/common/src/main/java/stirling/software/common/annotations/api/UserApi.java

@@ -5,6 +5,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -13,9 +16,8 @@ import io.swagger.v3.oas.annotations.tags.Tag;
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
-// @jakarta.ws.rs.Path("/api/v1/user").
-// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
+@RestController
+@RequestMapping("/api/v1/user")
 @Tag(
         name = "User",
         description =

app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java

@@ -7,101 +7,46 @@ import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.*;
 import org.slf4j.MDC;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.multipart.MultipartFile;
 
-import io.quarkus.vertx.http.runtime.CurrentVertxRequest;
-
-import jakarta.annotation.Priority;
-import jakarta.inject.Inject;
-import jakarta.interceptor.AroundInvoke;
-import jakarta.interceptor.Interceptor;
-import jakarta.interceptor.InvocationContext;
+import jakarta.servlet.http.HttpServletRequest;
 
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.annotations.AutoJobPostMapping;
-import stirling.software.common.model.MultipartFile;
 import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.FileStorage;
 import stirling.software.common.service.JobExecutorService;
 
-/**
- * MIGRATION (Spring AOP -> CDI interceptor): was an {@code @Aspect} with {@code @Around} advice on
- * {@code @AutoJobPostMapping}. Reworked into a CDI {@link Interceptor} bound by the
- * {@code @AutoJobPostMapping} {@code @InterceptorBinding}; {@code @Around}/{@code
- * ProceedingJoinPoint} became {@code @AroundInvoke}/{@link InvocationContext}.
- * {@code @Priority(20)} now meaningfully orders this interceptor (runs after lower-priority audit
- * interceptors populate MDC).
- */
-@Interceptor
-@AutoJobPostMapping
-@Priority(20)
+@Aspect
+@Component
+@RequiredArgsConstructor
 @Slf4j
+@Order(20) // Lower precedence - executes AFTER audit aspects populate MDC
 public class AutoJobAspect {
 
     private static final Duration RETRY_BASE_DELAY = Duration.ofMillis(100);
 
     private final JobExecutorService jobExecutorService;
-    // Reactive-safe access to the current request. The undertow HttpServletRequest proxy throws
-    // UT000048 ("No request is currently active") on RESTEasy Reactive worker threads, so query
-    // params / method / path / attributes are read from the Vert.x request instead, degrading to
-    // null/empty when no request is active.
-    private final CurrentVertxRequest currentVertxRequest;
+    private final HttpServletRequest request;
     private final FileStorage fileStorage;
 
-    @Inject
-    public AutoJobAspect(
-            JobExecutorService jobExecutorService,
-            CurrentVertxRequest currentVertxRequest,
-            FileStorage fileStorage) {
-        this.jobExecutorService = jobExecutorService;
-        this.currentVertxRequest = currentVertxRequest;
-        this.fileStorage = fileStorage;
-    }
-
-    private io.vertx.core.http.HttpServerRequest vertxRequest() {
-        try {
-            var current = currentVertxRequest.getCurrent();
-            return current != null ? current.request() : null;
-        } catch (RuntimeException e) {
-            return null;
-        }
-    }
-
-    private String requestParam(String name) {
-        io.vertx.core.http.HttpServerRequest req = vertxRequest();
-        return req != null ? req.getParam(name) : null;
-    }
-
-    private String requestMethod() {
-        io.vertx.core.http.HttpServerRequest req = vertxRequest();
-        return req != null ? req.method().name() : "";
-    }
-
-    private String requestUri() {
-        io.vertx.core.http.HttpServerRequest req = vertxRequest();
-        return req != null ? req.path() : "";
-    }
-
-    private Object requestAttribute(String name) {
-        try {
-            var current = currentVertxRequest.getCurrent();
-            return current != null ? current.get(name) : null;
-        } catch (RuntimeException e) {
-            return null;
-        }
-    }
-
-    @AroundInvoke
-    public Object wrapWithJobExecution(InvocationContext ctx) throws Exception {
-        AutoJobPostMapping autoJobPostMapping =
-                ctx.getMethod().getAnnotation(AutoJobPostMapping.class);
+    @Around("@annotation(autoJobPostMapping)")
+    public Object wrapWithJobExecution(
+            ProceedingJoinPoint joinPoint, AutoJobPostMapping autoJobPostMapping) throws Exception {
+        // This aspect will run before any audit aspects due to @Order(0)
         // Extract parameters from the request and annotation
-        boolean async = Boolean.parseBoolean(requestParam("async"));
+        boolean async = Boolean.parseBoolean(request.getParameter("async"));
         log.debug(
                 "AutoJobAspect: Processing {} {} with async={}",
-                requestMethod(),
-                requestUri(),
+                request.getMethod(),
+                request.getRequestURI(),
                 async);
         long timeout = autoJobPostMapping.timeout();
         int retryCount = autoJobPostMapping.retryCount();
@@ -116,8 +61,7 @@ public class AutoJobAspect {
                 trackProgress);
 
         // Process arguments in-place to avoid type mismatch issues
-        Object[] args = processArgsInPlace(ctx.getParameters(), async);
-        ctx.setParameters(args);
+        Object[] args = processArgsInPlace(joinPoint.getArgs(), async);
 
         // Extract queueable and resourceWeight parameters and validate
         boolean queueable = autoJobPostMapping.queueable();
@@ -136,7 +80,7 @@ public class AutoJobAspect {
                                     // The trackProgress flag controls whether detailed progress is
                                     // stored
                                     // for REST API queries, not WebSocket notifications
-                                    return ctx.proceed();
+                                    return joinPoint.proceed(args);
                                 } catch (Throwable ex) {
                                     log.error(
                                             "AutoJobAspect caught exception during job execution: {}",
@@ -157,7 +101,7 @@ public class AutoJobAspect {
         } else {
             // Use retry logic
             return executeWithRetries(
-                    ctx,
+                    joinPoint,
                     args,
                     async,
                     timeout,
@@ -169,7 +113,7 @@ public class AutoJobAspect {
     }
 
     private Object executeWithRetries(
-            InvocationContext ctx,
+            ProceedingJoinPoint joinPoint,
             Object[] args,
             boolean async,
             long timeout,
@@ -214,7 +158,7 @@ public class AutoJobAspect {
                                     }
 
                                     // Attempt to execute the operation
-                                    return ctx.proceed();
+                                    return joinPoint.proceed(args);
 
                                 } catch (Throwable ex) {
                                     lastException = ex;
@@ -348,7 +292,7 @@ public class AutoJobAspect {
 
     private String getJobIdFromContext() {
         try {
-            return (String) requestAttribute("jobId");
+            return (String) request.getAttribute("jobId");
         } catch (Exception e) {
             log.debug("Could not retrieve job ID from context: {}", e.getMessage());
             return null;

app/common/src/main/java/stirling/software/common/cluster/ClusterConfig.java

@@ -1,7 +1,8 @@
 package stirling.software.common.cluster;
 
+import org.springframework.context.annotation.Configuration;
+
 import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -18,7 +19,7 @@ import stirling.software.common.model.ApplicationProperties.Cluster;
  * single-instance install needs no new config.
  */
 @Slf4j
-@ApplicationScoped
+@Configuration
 @RequiredArgsConstructor
 public class ClusterConfig {
 
@@ -46,7 +47,7 @@ public class ClusterConfig {
                             + " JVM is coordinated. Cross-node lookups and the file proxy will fail."
                             + " Use backplane=valkey for real multi-node deployments.");
         } else {
-            // Fail fast on typos like "valky" so CDI doesn't later report a cryptic
+            // Fail fast on typos like "valky" so Spring doesn't later report a cryptic
             // "no ClusterBackplane bean" - the operator-facing error names the bad value.
             throw new IllegalStateException(
                     "cluster.enabled=true with unknown backplane '"

app/common/src/main/java/stirling/software/common/cluster/FileStore.java

@@ -11,37 +11,21 @@ public interface FileStore {
     /** Stored file record. */
     record Stored(String fileId, long size) {}
 
-    /**
-     * Store the given stream and return a generated file id and total bytes written. {@code owner}
-     * may be null to indicate the file has no associated user (anonymous / desktop / async job with
-     * no propagated security context); a non-null value is persisted alongside the data so {@link
-     * #getOwner(String)} can return it later for authorization checks.
-     */
-    Stored store(InputStream in, String originalName, String owner) throws IOException;
-
-    /** Store with no owner. Equivalent to {@link #store(InputStream, String, String)} with null. */
-    default Stored store(InputStream in, String originalName) throws IOException {
-        return store(in, originalName, null);
-    }
+    /** Store the given stream and return a generated file id and total bytes written. */
+    Stored store(InputStream in, String originalName) throws IOException;
 
     /**
      * Store the file at {@code source} and return a generated file id and total bytes written.
      *
      * <p>Default implementation opens {@code source} as a stream and delegates to {@link
-     * #store(InputStream, String, String)}. Local-disk implementations should override to use a
-     * direct file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on
-     * Linux), which avoids the two-memory-copy hit of streaming a disk-backed upload through the
-     * JVM heap.
+     * #store(InputStream, String)}. Local-disk implementations should override to use a direct
+     * file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on Linux),
+     * which avoids the two-memory-copy hit of streaming a disk-backed upload through the JVM heap.
      */
-    default Stored store(Path source, String originalName, String owner) throws IOException {
-        try (InputStream in = Files.newInputStream(source)) {
-            return store(in, originalName, owner);
-        }
-    }
-
-    /** Store with no owner. Equivalent to {@link #store(Path, String, String)} with null. */
     default Stored store(Path source, String originalName) throws IOException {
-        return store(source, originalName, null);
+        try (InputStream in = Files.newInputStream(source)) {
+            return store(in, originalName);
+        }
     }
 
     /** Open the stored file for streaming reads. Caller closes. */
@@ -58,12 +42,4 @@ public interface FileStore {
 
     /** Whether the file id exists in the store. */
     boolean exists(String fileId);
-
-    /**
-     * Returns the owner identifier recorded at store time, or {@code null} if the file does not
-     * exist or was stored without an owner. Implementations must not throw when the file is missing
-     * or when the owner record is absent; they should return null so callers can treat "no owner"
-     * as a non-authoritative case.
-     */
-    String getOwner(String fileId) throws IOException;
 }

app/common/src/main/java/stirling/software/common/cluster/RateLimitStore.java

@@ -2,13 +2,7 @@ package stirling.software.common.cluster;
 
 import java.time.Duration;
 
-/**
- * Token-bucket rate limiting backed by the cluster backplane.
- *
- * <p>In-process implementations enforce a per-JVM limit; distributed implementations enforce a
- * single global limit across every node. Both use a Bucket4j greedy-refill token bucket so the
- * semantics match across single-node and cluster deployments.
- */
+/** Token-bucket rate limiting backed by the cluster backplane. */
 public interface RateLimitStore {
 
     /**

app/common/src/main/java/stirling/software/common/cluster/inprocess/InProcessClusterConfiguration.java

@@ -1,9 +1,9 @@
 package stirling.software.common.cluster.inprocess;
 
-import io.quarkus.arc.DefaultBean;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Produces;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -19,58 +19,46 @@ import stirling.software.common.model.ApplicationProperties;
  * Default cluster backplane wiring: every interface gets an {@code InProcess*} bean. Active when
  * cluster mode is off or {@code cluster.backplane=inprocess}.
  */
-// TODO: Migration required - the original @ConditionalOnExpression
-// ("!${cluster.enabled:false} || '${cluster.backplane:inprocess}'.equalsIgnoreCase('inprocess')")
-// gated activation of this whole configuration on a SpEL expression over two config properties.
-// Quarkus/CDI has no direct equivalent for conditionally registering a producer set based on a
-// SpEL boolean. The @DefaultBean producers below now always provide the in-process implementations
-// unless another bean of the same type is present. If a non-inprocess backplane is added, ensure
-// it is NOT a @DefaultBean so it wins, and consider gating with
-// @io.quarkus.arc.lookup.LookupIfProperty
-// / @io.quarkus.arc.lookup.LookupUnlessProperty or a build-time @IfBuildProperty per producer.
 @Slf4j
-@ApplicationScoped
+@Configuration
+@ConditionalOnExpression(
+        "!${cluster.enabled:false} ||"
+                + " '${cluster.backplane:inprocess}'.equalsIgnoreCase('inprocess')")
 public class InProcessClusterConfiguration {
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public ClusterBackplane clusterBackplane(ApplicationProperties applicationProperties) {
         log.info("Cluster backplane: in-process (single node)");
         return new InProcessClusterBackplane(applicationProperties);
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public JobStore jobStore() {
         return new InProcessJobStore();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public RateLimitStore rateLimitStore() {
         return new InProcessRateLimitStore();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public DistributedLock distributedLock() {
         return new InProcessDistributedLock();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public KeyValueCache keyValueCache() {
         return new InProcessKeyValueCache();
     }
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
+    @Bean
+    @ConditionalOnMissingBean
     public InstanceRegistry instanceRegistry() {
         return new InProcessInstanceRegistry();
     }

app/common/src/main/java/stirling/software/common/cluster/inprocess/LocalDiskFileStore.java

@@ -3,12 +3,9 @@ package stirling.software.common.cluster.inprocess;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.UUID;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.regex.Pattern;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -18,47 +15,33 @@ import stirling.software.common.cluster.FileStore;
 @Slf4j
 public class LocalDiskFileStore implements FileStore {
 
-    private static final String OWNER_SUFFIX = ".owner";
-
-    // File ids are generated as random UUIDs; reject anything else so a tainted id can never reach
-    // Files.* APIs (defence in depth on top of the resolve() prefix check, and silences CodeQL's
-    // path-injection finding on the resolveOwner sidecar lookup).
-    private static final Pattern UUID_PATTERN =
-            Pattern.compile(
-                    "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$");
-
     private final String baseDirPath;
-    // Fixed-size lock stripes so concurrent store/delete on the same (or colliding) fileId
-    // serialise the data-file + owner-sidecar pair as one critical section. Striped (not
-    // per-id) so the map never has to be cleaned up; collisions across unrelated ids are
-    // harmless contention.
-    private static final int LOCK_STRIPES = 64;
-    private final ReentrantLock[] stripes = new ReentrantLock[LOCK_STRIPES];
 
     public LocalDiskFileStore(String baseDirPath) {
         this.baseDirPath = baseDirPath;
-        for (int i = 0; i < LOCK_STRIPES; i++) {
-            stripes[i] = new ReentrantLock();
-        }
     }
 
     @Override
-    public Stored store(InputStream in, String originalName, String owner) throws IOException {
+    public Stored store(InputStream in, String originalName) throws IOException {
         String fileId = UUID.randomUUID().toString();
         Path filePath = resolve(fileId);
         Files.createDirectories(filePath.getParent());
-        ReentrantLock lock = acquire(fileId);
         boolean success = false;
         try {
             long size = Files.copy(in, filePath);
-            writeOwner(fileId, owner);
             success = true;
             return new Stored(fileId, size);
         } finally {
             if (!success) {
-                cleanupAfterFailedStore(fileId, filePath);
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
             }
-            release(fileId, lock);
         }
     }
 
@@ -69,44 +52,27 @@ public class LocalDiskFileStore implements FileStore {
      * the source size before copying so the post-copy stat is unnecessary.
      */
     @Override
-    public Stored store(Path source, String originalName, String owner) throws IOException {
+    public Stored store(Path source, String originalName) throws IOException {
         String fileId = UUID.randomUUID().toString();
         Path filePath = resolve(fileId);
         Files.createDirectories(filePath.getParent());
         long size = Files.size(source);
-        ReentrantLock lock = acquire(fileId);
         boolean success = false;
         try {
             Files.copy(source, filePath);
-            writeOwner(fileId, owner);
             success = true;
             return new Stored(fileId, size);
         } finally {
             if (!success) {
-                cleanupAfterFailedStore(fileId, filePath);
+                try {
+                    Files.deleteIfExists(filePath);
+                } catch (IOException cleanupEx) {
+                    log.warn(
+                            "Failed to clean up partial file {} after store failure",
+                            filePath,
+                            cleanupEx);
+                }
             }
-            release(fileId, lock);
-        }
-    }
-
-    private void writeOwner(String fileId, String owner) throws IOException {
-        if (owner == null || owner.isBlank()) {
-            return;
-        }
-        Path ownerPath = resolveOwner(fileId);
-        Files.write(ownerPath, owner.getBytes(StandardCharsets.UTF_8));
-    }
-
-    private void cleanupAfterFailedStore(String fileId, Path filePath) {
-        try {
-            Files.deleteIfExists(filePath);
-        } catch (IOException cleanupEx) {
-            log.warn("Failed to clean up partial file {} after store failure", filePath, cleanupEx);
-        }
-        try {
-            Files.deleteIfExists(resolveOwner(fileId));
-        } catch (IOException cleanupEx) {
-            log.warn("Failed to clean up owner sidecar for {} after store failure", fileId);
         }
     }
 
@@ -135,26 +101,11 @@ public class LocalDiskFileStore implements FileStore {
 
     @Override
     public boolean delete(String fileId) {
-        ReentrantLock lock = acquire(fileId);
         try {
-            // Data first, owner second: a concurrent retrieve that observes the transient
-            // (data-gone, owner-still-present) window simply fails with IOException; the inverse
-            // order would briefly look like an unowned file and could grant cross-user access.
-            boolean removed;
-            try {
-                removed = Files.deleteIfExists(resolve(fileId));
-            } catch (IOException e) {
-                log.error("Error deleting file with ID: {}", fileId, e);
-                return false;
-            }
-            try {
-                Files.deleteIfExists(resolveOwner(fileId));
-            } catch (IOException e) {
-                log.warn("Error deleting owner sidecar for file ID: {}", fileId, e);
-            }
-            return removed;
-        } finally {
-            release(fileId, lock);
+            return Files.deleteIfExists(resolve(fileId));
+        } catch (IOException e) {
+            log.error("Error deleting file with ID: {}", fileId, e);
+            return false;
         }
     }
 
@@ -163,21 +114,8 @@ public class LocalDiskFileStore implements FileStore {
         return Files.exists(resolve(fileId));
     }
 
-    @Override
-    public String getOwner(String fileId) throws IOException {
-        Path ownerPath = resolveOwner(fileId);
-        if (!Files.exists(ownerPath)) {
-            return null;
-        }
-        byte[] bytes = Files.readAllBytes(ownerPath);
-        if (bytes.length == 0) {
-            return null;
-        }
-        return new String(bytes, StandardCharsets.UTF_8);
-    }
-
     public Path resolve(String fileId) {
-        if (fileId == null || !UUID_PATTERN.matcher(fileId).matches()) {
+        if (fileId.contains("..") || fileId.contains("/") || fileId.contains("\\")) {
             throw new IllegalArgumentException("Invalid file ID");
         }
         Path basePath = Path.of(baseDirPath).normalize().toAbsolutePath();
@@ -187,19 +125,4 @@ public class LocalDiskFileStore implements FileStore {
         }
         return resolvedPath;
     }
-
-    private Path resolveOwner(String fileId) {
-        Path data = resolve(fileId);
-        return data.resolveSibling(data.getFileName().toString() + OWNER_SUFFIX);
-    }
-
-    private ReentrantLock acquire(String fileId) {
-        ReentrantLock lock = stripes[(fileId.hashCode() & Integer.MAX_VALUE) % LOCK_STRIPES];
-        lock.lock();
-        return lock;
-    }
-
-    private void release(String fileId, ReentrantLock lock) {
-        lock.unlock();
-    }
 }

app/common/src/main/java/stirling/software/common/cluster/inprocess/LocalDiskFileStoreConfiguration.java

@@ -1,11 +1,10 @@
 package stirling.software.common.cluster.inprocess;
 
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-
-import io.quarkus.arc.DefaultBean;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Produces;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 
 import stirling.software.common.cluster.FileStore;
 
@@ -14,23 +13,17 @@ import stirling.software.common.cluster.FileStore;
  * cluster.artifactStore=local} (the default; {@code matchIfMissing=true}). The S3 artifact-store
  * supplies its own bean when {@code cluster.artifactStore=s3}.
  */
-// TODO: Migration required - the original class was guarded by Spring's
-// @ConditionalOnProperty(prefix="cluster", name="artifactStore", havingValue="local",
-// matchIfMissing=true). Quarkus has no runtime equivalent: @io.quarkus.arc.profile.IfBuildProperty
-// is build-time only and does not support matchIfMissing semantics. The producer below is now
-// unconditional. The "local is the default; S3 supplies its own bean" behavior is preserved via
-// @DefaultBean (the S3 artifact-store bean, if present, wins over this default). If a true
-// runtime toggle on cluster.artifactStore is needed, gate the producer body on the config value
-// and return/short-circuit accordingly.
-@ApplicationScoped
+@Configuration
+@ConditionalOnProperty(
+        prefix = "cluster",
+        name = "artifactStore",
+        havingValue = "local",
+        matchIfMissing = true)
 public class LocalDiskFileStoreConfiguration {
 
-    @Produces
-    @DefaultBean
-    @ApplicationScoped
-    public FileStore fileStore(
-            @ConfigProperty(name = "stirling.tempDir", defaultValue = "/tmp/stirling-files")
-                    String tempDir) {
+    @Bean
+    @ConditionalOnMissingBean
+    public FileStore fileStore(@Value("${stirling.tempDir:/tmp/stirling-files}") String tempDir) {
         return new LocalDiskFileStore(tempDir);
     }
 }

app/common/src/main/java/stirling/software/common/config/TempFileConfiguration.java

@@ -3,29 +3,37 @@ package stirling.software.common.config;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
 import jakarta.annotation.PostConstruct;
-import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.TempFileRegistry;
 
 /**
  * Configuration for the temporary file management system. Sets up the necessary beans and
  * configures system properties.
  */
 @Slf4j
-@ApplicationScoped
+@Configuration
 @RequiredArgsConstructor
 public class TempFileConfiguration {
 
     private final ApplicationProperties applicationProperties;
 
-    // MIGRATION: the @Produces TempFileRegistry producer was removed. TempFileRegistry is already
-    // an
-    // @ApplicationScoped CDI bean with a no-arg constructor, so the producer was a redundant second
-    // @Default bean of the same type and made every injection point ambiguous.
+    /**
+     * Create the TempFileRegistry bean.
+     *
+     * @return A new TempFileRegistry instance
+     */
+    @Bean
+    public TempFileRegistry tempFileRegistry() {
+        return new TempFileRegistry();
+    }
 
     @PostConstruct
     public void initTempFileConfig() {

app/common/src/main/java/stirling/software/common/config/TempFileShutdownHook.java

@@ -5,8 +5,8 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Set;
 
-import jakarta.annotation.PreDestroy;
-import jakarta.enterprise.context.ApplicationScoped;
+import org.springframework.beans.factory.DisposableBean;
+import org.springframework.stereotype.Component;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -14,12 +14,12 @@ import stirling.software.common.util.GeneralUtils;
 import stirling.software.common.util.TempFileRegistry;
 
 /**
- * Handles cleanup of temporary files on application shutdown. Uses a CDI {@code @PreDestroy} method
- * (migrated from Spring's {@code DisposableBean}) to ensure cleanup happens during normal shutdown.
+ * Handles cleanup of temporary files on application shutdown. Implements Spring's DisposableBean
+ * interface to ensure cleanup happens during normal application shutdown.
  */
 @Slf4j
-@ApplicationScoped
-public class TempFileShutdownHook {
+@Component
+public class TempFileShutdownHook implements DisposableBean {
 
     private final TempFileRegistry registry;
 
@@ -31,8 +31,8 @@ public class TempFileShutdownHook {
         Runtime.getRuntime().addShutdownHook(new Thread(this::cleanupTempFiles));
     }
 
-    /** CDI pre-destroy callback (was DisposableBean#destroy). Called during normal shutdown. */
-    @PreDestroy
+    /** Spring's DisposableBean interface method. Called during normal application shutdown. */
+    @Override
     public void destroy() {
         log.info("Application shutting down, cleaning up temporary files");
         cleanupTempFiles();

app/common/src/main/java/stirling/software/common/configuration/AppConfig.java

@@ -3,75 +3,47 @@ package stirling.software.common.configuration;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.List;
 import java.util.Locale;
 import java.util.Properties;
 import java.util.function.Predicate;
 import java.util.stream.Stream;
 
-import org.eclipse.microprofile.config.Config;
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-
-import io.quarkus.arc.profile.IfBuildProfile;
-
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.context.Dependent;
-import jakarta.enterprise.inject.Produces;
-import jakarta.inject.Inject;
-import jakarta.inject.Named;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.context.annotation.Profile;
+import org.springframework.context.annotation.Scope;
+import org.springframework.core.env.Environment;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.util.ClassUtils;
 
 import lombok.Getter;
+import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 
-/**
- * Central CDI producer hub (migrated from a Spring {@code @Configuration} class).
- *
- * <p>MIGRATION NOTES (Spring -> Quarkus CDI):
- *
- * <ul>
- *   <li>{@code @Bean} -> {@code @Produces}; {@code @Bean(name="x")} ->
- *       {@code @Produces @Named("x")}.
- *   <li>{@code @Value} -> {@code @ConfigProperty}; Spring {@code Environment} -> MicroProfile
- *       {@code Config}.
- *   <li>{@code @Profile("default")} flavor-default beans -> {@code @DefaultBean}: the :proprietary
- *       / :saas modules provide the "real" producer and automatically win when present, exactly
- *       like the old profile override (this is the Quarkus idiom for "default unless overridden").
- *   <li>{@code @Scope("request")} on {@code boolean} producers -> {@code @Dependent}. CDI normal
- *       scopes (e.g. {@code @RequestScoped}) require a client proxy, which is impossible for
- *       primitives/finals, so Spring's request-scoped primitive beans cannot be reproduced
- *       directly. {@code @Dependent} recomputes the value at each injection point, which is the
- *       closest behaviour. TODO: Migration required - if true per-HTTP-request semantics are
- *       needed, wrap the value in a {@code @RequestScoped} holder object instead of producing a
- *       bare boolean.
- *   <li>{@code @Lazy} dropped - CDI beans are initialised lazily by default.
- * </ul>
- */
+@Lazy
 @Slf4j
-@ApplicationScoped
+@Configuration
+@RequiredArgsConstructor
 public class AppConfig {
 
-    private final Config config;
+    private final Environment env;
 
     private final ApplicationProperties applicationProperties;
 
     @Getter
-    @ConfigProperty(name = "server.servlet.context-path", defaultValue = "/")
-    String contextPath;
+    @Value("${server.servlet.context-path:/}")
+    private String contextPath;
 
     @Getter
-    @ConfigProperty(name = "quarkus.http.port", defaultValue = "8080")
-    String serverPort;
-
-    @ConfigProperty(name = "v2")
-    boolean v2Enabled;
-
-    @Inject
-    public AppConfig(Config config, ApplicationProperties applicationProperties) {
-        this.config = config;
-        this.applicationProperties = applicationProperties;
-    }
+    @Value("${server.port:8080}")
+    private String serverPort;
 
     /**
      * Get the backend URL from system configuration. Falls back to http://localhost if not
@@ -84,118 +56,83 @@ public class AppConfig {
         return (backendUrl != null && !backendUrl.isBlank()) ? backendUrl : "http://localhost";
     }
 
-    @Produces
-    @Named("v2Enabled")
+    @Value("${v2}")
+    public boolean v2Enabled;
+
+    @Bean
     public boolean v2Enabled() {
         return v2Enabled;
     }
 
-    // MIGRATION: many beans inject tools.jackson.databind.ObjectMapper (Jackson 3, inherited from
-    // Spring Boot 4). Quarkus' container only produces a com.fasterxml.jackson (Jackson 2)
-    // ObjectMapper for REST (de)serialization, so the Jackson 3 type is an unsatisfied CDI
-    // dependency. This producer supplies a single application-scoped Jackson 3 mapper built the
-    // same
-    // way the codebase builds them ad hoc (JsonMapper.builder().build()). REST bodies still go
-    // through Quarkus' Jackson 2 mapper; this is only for code that uses the Jackson 3 API
-    // directly.
-    // TODO: Migration required - converge the codebase on one Jackson line (drop Jackson 3) later.
-    @Produces
-    @ApplicationScoped
-    public tools.jackson.databind.ObjectMapper jackson3ObjectMapper() {
-        return tools.jackson.databind.json.JsonMapper.builder().build();
-    }
-
-    @Produces
-    @Named("contextPath")
-    public String contextPathBean() {
-        return contextPath;
-    }
-
-    @Produces
-    @Named("loginEnabled")
+    @Bean(name = "loginEnabled")
     public boolean loginEnabled() {
         return applicationProperties.getSecurity().isEnableLogin();
     }
 
-    // MIGRATION: CDI has no producer for the nested ApplicationProperties.Security.SAML2 config
-    // object, so beans that inject it directly (e.g. CustomSaml2AuthenticationSuccessHandler) were
-    // unsatisfied. Expose it from the already-injected ApplicationProperties. May be null/disabled;
-    // that is fine for injection.
-    @Produces
-    public ApplicationProperties.Security.SAML2 saml2Config() {
-        return applicationProperties.getSecurity().getSaml2();
-    }
-
-    @Produces
-    @Named("appName")
+    @Bean(name = "appName")
     public String appName() {
         return "Stirling PDF";
     }
 
-    @Produces
-    @Named("appVersion")
+    @Bean(name = "appVersion")
     public String appVersion() {
-        // MIGRATION: Spring ClassPathResource -> plain classloader resource lookup.
+        Resource resource = new ClassPathResource("version.properties");
         Properties props = new Properties();
-        try (var in = getClass().getClassLoader().getResourceAsStream("version.properties")) {
-            if (in != null) {
-                props.load(in);
-                return props.getProperty("version");
-            }
+        try {
+            props.load(resource.getInputStream());
+            return props.getProperty("version");
         } catch (IOException e) {
             log.error("exception", e);
         }
         return "0.0.0";
     }
 
-    @Produces
-    @Named("homeText")
+    @Bean(name = "homeText")
     public String homeText() {
         return "null";
     }
 
-    @Produces
-    @Named("languages")
+    @Bean(name = "languages")
     public List<String> languages() {
         return applicationProperties.getUi().getLanguages();
     }
 
-    @Produces
-    @Named("navBarText")
+    @Bean
+    public String contextPath(@Value("${server.servlet.context-path}") String contextPath) {
+        return contextPath;
+    }
+
+    @Bean(name = "navBarText")
     public String navBarText() {
         String navBar = applicationProperties.getUi().getAppNameNavbar();
         return (navBar != null) ? navBar : "Stirling PDF";
     }
 
-    @Produces
-    @Named("enableAlphaFunctionality")
+    @Bean(name = "enableAlphaFunctionality")
     public boolean enableAlphaFunctionality() {
         return applicationProperties.getSystem().isEnableAlphaFunctionality();
     }
 
-    @Produces
-    @Named("rateLimit")
+    @Bean(name = "rateLimit")
     public boolean rateLimit() {
         String rateLimit = System.getProperty("rateLimit");
         if (rateLimit == null) rateLimit = System.getenv("rateLimit");
         return Boolean.parseBoolean(rateLimit);
     }
 
-    @Produces
-    @Named("RunningInDocker")
+    @Bean(name = "RunningInDocker")
     public boolean runningInDocker() {
-        return Files.exists(Path.of("/.dockerenv"));
+        return Files.exists(Paths.get("/.dockerenv"));
     }
 
-    @Produces
-    @Named("configDirMounted")
+    @Bean(name = "configDirMounted")
     public boolean isRunningInDockerWithConfig() {
-        Path dockerEnv = Path.of("/.dockerenv");
+        Path dockerEnv = Paths.get("/.dockerenv");
         // default to true if not docker
         if (!Files.exists(dockerEnv)) {
             return true;
         }
-        Path mountInfo = Path.of("/proc/1/mountinfo");
+        Path mountInfo = Paths.get("/proc/1/mountinfo");
         // this should always exist, if not some unknown usecase
         if (!Files.exists(mountInfo)) {
             return true;
@@ -207,23 +144,14 @@ public class AppConfig {
         }
     }
 
-    @Produces
-    @Named("activeSecurity")
+    @Bean(name = "activeSecurity")
     public boolean missingActiveSecurity() {
-        // MIGRATION: Spring ClassUtils.isPresent -> manual Class.forName presence check.
-        try {
-            Class.forName(
-                    "stirling.software.proprietary.security.configuration.SecurityConfiguration",
-                    false,
-                    this.getClass().getClassLoader());
-            return true;
-        } catch (ClassNotFoundException e) {
-            return false;
-        }
+        return ClassUtils.isPresent(
+                "stirling.software.proprietary.security.configuration.SecurityConfiguration",
+                this.getClass().getClassLoader());
     }
 
-    @Produces
-    @Named("directoryFilter")
+    @Bean(name = "directoryFilter")
     public Predicate<Path> processOnlyFiles() {
         return path -> {
             if (Files.isDirectory(path)) {
@@ -234,138 +162,113 @@ public class AppConfig {
         };
     }
 
-    @Produces
-    @Named("termsAndConditions")
+    @Bean(name = "termsAndConditions")
     public String termsAndConditions() {
         return applicationProperties.getLegal().getTermsAndConditions();
     }
 
-    @Produces
-    @Named("privacyPolicy")
+    @Bean(name = "privacyPolicy")
     public String privacyPolicy() {
         return applicationProperties.getLegal().getPrivacyPolicy();
     }
 
-    @Produces
-    @Named("cookiePolicy")
+    @Bean(name = "cookiePolicy")
     public String cookiePolicy() {
         return applicationProperties.getLegal().getCookiePolicy();
     }
 
-    @Produces
-    @Named("impressum")
+    @Bean(name = "impressum")
     public String impressum() {
         return applicationProperties.getLegal().getImpressum();
     }
 
-    @Produces
-    @Named("accessibilityStatement")
+    @Bean(name = "accessibilityStatement")
     public String accessibilityStatement() {
         return applicationProperties.getLegal().getAccessibilityStatement();
     }
 
-    @Produces
-    @Dependent
-    @Named("analyticsPrompt")
+    @Bean(name = "analyticsPrompt")
+    @Scope("request")
     public boolean analyticsPrompt() {
         return applicationProperties.getSystem().getEnableAnalytics() == null;
     }
 
-    @Produces
-    @Dependent
-    @Named("analyticsEnabled")
+    @Bean(name = "analyticsEnabled")
+    @Scope("request")
     public boolean analyticsEnabled() {
         if (applicationProperties.getPremium().isEnabled()) return true;
         return applicationProperties.getSystem().isAnalyticsEnabled();
     }
 
-    @Produces
-    @Named("StirlingPDFLabel")
+    @Bean(name = "StirlingPDFLabel")
     public String stirlingPDFLabel() {
         return "Stirling-PDF" + " v" + appVersion();
     }
 
-    @Produces
-    @Named("UUID")
+    @Bean(name = "UUID")
     public String uuid() {
         return applicationProperties.getAutomaticallyGenerated().getUUID();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Security security() {
         return applicationProperties.getSecurity();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Security.OAUTH2 oAuth2() {
         return applicationProperties.getSecurity().getOauth2();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Premium premium() {
         return applicationProperties.getPremium();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.System system() {
         return applicationProperties.getSystem();
     }
 
-    @Produces
+    @Bean
     public ApplicationProperties.Datasource datasource() {
         return applicationProperties.getSystem().getDatasource();
     }
 
-    // @IfBuildProfile("core"): these NORMAL/default license @Named beans apply only to the core
-    // flavor. In proprietary EEAppConfig provides them (security profile) and in saas
-    // SaasLicenseOverride does (saas profile); registering this producer alongside those trips
-    // Qute's named-bean validation ("Duplicate key runningEE"), which does not honour @DefaultBean
-    // suppression - so gate to core outright. (In core, EEAppConfig/SaasLicenseOverride are not
-    // even on the classpath.)
-    @Produces
-    @IfBuildProfile("core")
-    @Named("runningProOrHigher")
+    @Bean(name = "runningProOrHigher")
+    @Profile("default")
     public boolean runningProOrHigher() {
         return false;
     }
 
-    @Produces
-    @IfBuildProfile("core")
-    @Named("runningEE")
+    @Bean(name = "runningEE")
+    @Profile("default")
     public boolean runningEnterprise() {
         return false;
     }
 
-    @Produces
-    @IfBuildProfile("core")
-    @Named("license")
+    @Bean(name = "license")
+    @Profile("default")
     public String licenseType() {
         return "NORMAL";
     }
 
-    @Produces
-    @Named("scarfEnabled")
+    @Bean(name = "scarfEnabled")
     public boolean scarfEnabled() {
         return applicationProperties.getSystem().isScarfEnabled();
     }
 
-    @Produces
-    @Named("posthogEnabled")
+    @Bean(name = "posthogEnabled")
     public boolean posthogEnabled() {
         return applicationProperties.getSystem().isPosthogEnabled();
     }
 
-    @Produces
-    @Named("machineType")
+    @Bean(name = "machineType")
     public String determineMachineType() {
         try {
             boolean isDocker = runningInDocker();
             boolean isKubernetes = System.getenv("KUBERNETES_SERVICE_HOST") != null;
-            boolean isBrowserOpen =
-                    "true"
-                            .equalsIgnoreCase(
-                                    config.getOptionalValue("BROWSER_OPEN", String.class)
-                                            .orElse(null));
+            boolean isBrowserOpen = "true".equalsIgnoreCase(env.getProperty("BROWSER_OPEN"));
 
             if (isKubernetes) {
                 return "Kubernetes";

app/common/src/main/java/stirling/software/common/configuration/ApplicationPropertiesConfigOverlay.java

@@ -1,193 +0,0 @@
-package stirling.software.common.configuration;
-
-import java.lang.reflect.Field;
-import java.lang.reflect.Modifier;
-import java.lang.reflect.ParameterizedType;
-import java.lang.reflect.Type;
-import java.util.List;
-
-import org.eclipse.microprofile.config.Config;
-import org.eclipse.microprofile.config.ConfigProvider;
-
-import io.quarkus.arc.ClientProxy;
-import io.quarkus.runtime.StartupEvent;
-
-import jakarta.annotation.Priority;
-import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.event.Observes;
-import jakarta.inject.Inject;
-import jakarta.interceptor.Interceptor;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.ApplicationProperties;
-
-/**
- * Binds MicroProfile/Quarkus config (env vars, {@code settings.yml} via {@link
- * SettingsYamlConfigSource}, {@code application.properties}, system properties) onto the mutable
- * {@link ApplicationProperties} bean at startup - the Quarkus replacement for the Spring
- * {@code @ConfigurationProperties(prefix = "")} relaxed binding that was lost in the migration.
- *
- * <p>Rather than hand-listing each property, this walks the whole {@code ApplicationProperties}
- * object graph by reflection and, for every scalar / enum / scalar-list field, applies the value
- * from config when one is present (so unset fields keep their Java default). The dotted key for a
- * field mirrors its path in the tree ({@code security.oauth2.client.keycloak.clientId}, {@code
- * endpoints.toRemove}, ...); SmallRye then resolves it from any source - e.g. env var {@code
- * SECURITY_OAUTH2_CLIENT_KEYCLOAK_CLIENTID} or the same key in {@code settings.yml} - with the
- * usual precedence (sys props &gt; env &gt; settings.yml &gt; application.properties).
- *
- * <p>This is the behaviour Spring had: every settings.yml / {@code SECURITY_*}/{@code STORAGE_*}
- * /{@code PREMIUM_*} value is honoured, fixing the whole {@code maxDPI=0} / {@code enableLogin}
- * /{@code endpoints.toRemove} / premium-license class of "ignored config" bugs at once.
- *
- * <p>Runs with {@code @Priority(APPLICATION)} so it completes before startup consumers read the
- * bean: {@code InitialSecuritySetup} (enableLogin / customGlobalAPIKey), {@code
- * EndpointConfiguration} (endpoints.toRemove), and {@code LicenseKeyChecker.onApplicationReady}
- * (premium.enabled / premium.key, which has the lower default observer priority 2500).
- *
- * <p>Values are never logged - only key names at DEBUG and a total at INFO - because the tree
- * carries secrets (premium key, client secrets, initial-login password, SMTP/Telegram tokens).
- */
-@Slf4j
-@ApplicationScoped
-public class ApplicationPropertiesConfigOverlay {
-
-    private static final int MAX_DEPTH = 20;
-
-    @Inject ApplicationProperties applicationProperties;
-
-    void onStart(@Observes @Priority(Interceptor.Priority.APPLICATION) StartupEvent event) {
-        Config config = ConfigProvider.getConfig();
-        // ApplicationProperties is @ApplicationScoped, so the injected reference is a client proxy;
-        // reflect over the real contextual instance (its getters delegate, but getDeclaredFields()
-        // on the proxy would not see the model fields).
-        Object root = applicationProperties;
-        if (root instanceof ClientProxy proxy) {
-            root = proxy.arc_contextualInstance();
-        }
-        int[] applied = {0};
-        bind(root, "", config, 0, applied);
-        log.info(
-                "Applied {} configuration override(s) onto ApplicationProperties"
-                        + " (settings.yml + environment)",
-                applied[0]);
-    }
-
-    private void bind(Object node, String prefix, Config config, int depth, int[] applied) {
-        if (node == null || depth > MAX_DEPTH) {
-            return;
-        }
-        for (Field field : node.getClass().getDeclaredFields()) {
-            int mods = field.getModifiers();
-            if (Modifier.isStatic(mods) || field.isSynthetic()) {
-                continue;
-            }
-            String key = prefix.isEmpty() ? field.getName() : prefix + "." + field.getName();
-            Class<?> type = field.getType();
-            try {
-                field.setAccessible(true);
-                if (isModelType(type)) {
-                    Object child = field.get(node);
-                    if (child == null) {
-                        child = instantiate(type);
-                        if (child != null) {
-                            field.set(node, child);
-                        }
-                    }
-                    bind(child, key, config, depth + 1, applied);
-                } else if (List.class.isAssignableFrom(type)) {
-                    Class<?> element = listElementType(field);
-                    if (element != null && isLeaf(element)) {
-                        config.getOptionalValues(key, element)
-                                .ifPresent(value -> apply(field, node, value, key, applied));
-                    }
-                    // List<model-type> has no flat scalar representation here - skip.
-                } else if (isLeaf(type)) {
-                    config.getOptionalValue(key, box(type))
-                            .ifPresent(value -> apply(field, node, value, key, applied));
-                }
-                // Maps and other container/unsupported types are left to their Java defaults.
-            } catch (Exception ex) {
-                // Per-field best effort: an unconvertible value or inaccessible field must not
-                // abort
-                // the whole overlay. Never include the value (may be a secret).
-                log.debug("Skipped config binding for {} ({})", key, ex.toString());
-            }
-        }
-    }
-
-    private void apply(Field field, Object node, Object value, String key, int[] applied) {
-        try {
-            field.set(node, value);
-            applied[0]++;
-            // Key name only - the value may be a secret (license key, password, client secret).
-            log.debug("Applied config override: {}", key);
-        } catch (Exception ex) {
-            log.debug("Failed to set {} ({})", key, ex.toString());
-        }
-    }
-
-    private static boolean isModelType(Class<?> type) {
-        return type.getName().startsWith("stirling.software") && !type.isEnum();
-    }
-
-    private static boolean isLeaf(Class<?> type) {
-        return type == String.class
-                || type.isEnum()
-                || type.isPrimitive()
-                || type == Boolean.class
-                || type == Integer.class
-                || type == Long.class
-                || type == Double.class
-                || type == Float.class
-                || type == Short.class
-                || type == Byte.class;
-    }
-
-    private static Class<?> box(Class<?> type) {
-        if (!type.isPrimitive()) {
-            return type;
-        }
-        if (type == boolean.class) {
-            return Boolean.class;
-        }
-        if (type == int.class) {
-            return Integer.class;
-        }
-        if (type == long.class) {
-            return Long.class;
-        }
-        if (type == double.class) {
-            return Double.class;
-        }
-        if (type == float.class) {
-            return Float.class;
-        }
-        if (type == short.class) {
-            return Short.class;
-        }
-        if (type == byte.class) {
-            return Byte.class;
-        }
-        return type;
-    }
-
-    private static Class<?> listElementType(Field field) {
-        Type generic = field.getGenericType();
-        if (generic instanceof ParameterizedType parameterized) {
-            Type[] args = parameterized.getActualTypeArguments();
-            if (args.length == 1 && args[0] instanceof Class<?> element) {
-                return element;
-            }
-        }
-        return null;
-    }
-
-    private static Object instantiate(Class<?> type) {
-        try {
-            return type.getDeclaredConstructor().newInstance();
-        } catch (Exception ex) {
-            return null;
-        }
-    }
-}