Stirling-Tools · Frooodle · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026
@@ -8,6 +8,8 @@
 build/
 */build/
 **/build/
+# ...but re-include the Quarkus runner-jar so docker/quarkus/Dockerfile can layer it on the base image
+!app/core/build/*-runner.jar
 out/
 target/
 **/target/

@@ -58,16 +58,18 @@ jobs:
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
+        run: ./gradlew :stirling-pdf:quarkusBuild -PnoSpotless --no-daemon
 
       - name: Locate built JAR
         id: jar
         run: |
-          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
-              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
+          # Quarkus (quarkus.package.jar.type=uber-jar) emits a standalone runnable
+          # jar at app/core/build/<name>-runner.jar, replacing the Spring Boot bootJar
+          # that used to land in app/core/build/libs.
+          jar=$(find app/core/build -maxdepth 1 -name '*-runner.jar' 2>/dev/null | head -n 1)
           if [[ -z "$jar" ]]; then
-            echo "::error::No JAR under app/core/build/libs"
-            ls -lah app/core/build/libs || true
+            echo "::error::No *-runner.jar under app/core/build"
+            ls -lah app/core/build || true
             exit 1
           fi
           # Absolute path - the migration script pushd's into a temp workdir

@@ -42,10 +42,15 @@ SwaggerDoc.json
 # Runtime storage for uploaded files and user data (not Java source code)
 app/core/storage/
 
-# Frontend build artifacts copied to backend static resources
-# These are generated by npm build and should not be committed
-app/core/src/main/resources/static/assets/
+# Frontend build artifacts copied to Quarkus static resources
+# Generated by `npm build` + the copyFrontendAssets/copyFrontendIndexHtml tasks; never committed.
+# The React bundle goes to META-INF/resources/ (Quarkus serves these over HTTP); index.html is the
+# only generated file in static/ (ReactRoutingController serves it). See app/core/build.gradle.
+app/core/src/main/resources/META-INF/resources/
 app/core/src/main/resources/static/index.html
+# Migration cleanup: earlier builds emitted the whole bundle into static/. Keep these ignored so
+# any stale generated assets left in static/ are not accidentally committed.
+app/core/src/main/resources/static/assets/
 # Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
 app/core/src/main/resources/static/*.html
 !app/core/src/main/resources/static/api-landing.html
@@ -66,7 +71,7 @@ app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
 app/core/src/main/resources/static/**/*.gz
 app/core/src/main/resources/static/**/*.br
-# Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.
+# Note: Keep backend-managed files like fonts/, css/, js/, etc.
 
 # Gradle
 .gradle
@@ -280,8 +285,23 @@ docs/type3/signatures/
 
 **/application-dev-local.properties
 
-# Claude
+# AI agent session/local files - may contain tokens and secrets
 .claude/
+.agents/
+.cursor/
+.codex/
+.opencode/
+.copilot/
+.cline/
+.continue/
+.windsurf/
+.junie/
+.pi/
+.roo/
+.augment/
+.aider*
+CLAUDE.local.md
+skills-lock.json
 
 # Playwright MCP screenshots / traces
 .playwright-mcp/

@@ -116,7 +116,7 @@ tasks:
   codespell:
     deps: [install]
     cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
+      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment,vertx --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
 
   toml-sort:
     deps: [install]

@@ -1,5 +1,9 @@
 {
   "allowedLicenses": [
+    {
+      "moduleName": "org.jboss:jboss-transaction-spi",
+      "moduleLicense": "Public Domain"
+    },
     {
       "moduleName": ".*",
       "moduleLicense": "BSD License"

@@ -1,7 +1,4 @@
-// Configure bootRun to disable it or point to a main class
-bootRun {
-    enabled = false
-}
+// REMOVED: bootRun{enabled=false} - Spring Boot plugin task. :common is a Quarkus library module.
 spotless {
     java {
         target 'src/**/java/**/*.java'
@@ -30,8 +27,29 @@ spotless {
 }
 dependencies {
     api 'com.google.guava:guava:33.6.0-jre'
-    api 'org.springframework.boot:spring-boot-starter-webmvc'
-    api 'org.springframework.boot:spring-boot-starter-aspectj'
+
+    // spring-boot-starter-webmvc -> Quarkus REST stack (api-scoped so downstream modules inherit it).
+    api 'io.quarkus:quarkus-rest'
+    api 'io.quarkus:quarkus-rest-jackson'
+    // Servlet bridge: large amounts of controller/filter code use jakarta.servlet (HttpServletRequest,
+    // Filter, etc.). quarkus-undertow provides a servlet container on Quarkus so that API resolves and
+    // runs. TODO: Migration required - longer term, port servlet usage to JAX-RS (ContainerRequestContext)
+    //       and drop quarkus-undertow.
+    api 'io.quarkus:quarkus-undertow'
+    // Bean Validation (was transitively in spring-boot-starter-webmvc).
+    api 'io.quarkus:quarkus-hibernate-validator'
+    // @Scheduled support (was spring-context scheduling). quarkus-scheduler manages its own
+    // executor; the former SchedulingConfig TaskScheduler bean is no longer needed.
+    api 'io.quarkus:quarkus-scheduler'
+    // BCrypt implementation backing the Spring Security PasswordEncoder compatibility shim
+    // (replaces spring-security-crypto's BCryptPasswordEncoder). Standalone, no framework.
+    api 'at.favre.lib:bcrypt:0.10.2'
+    // Swagger/OpenAPI annotations (io.swagger.v3.oas.annotations.*) used by common's API marker
+    // interfaces; was transitive via springdoc. Quarkus' SmallRye OpenAPI also understands these.
+    api 'io.swagger.core.v3:swagger-core-jakarta:2.2.46'
+    // REMOVED: spring-boot-starter-aspectj. Quarkus has no AspectJ weaving; quarkus-arc provides
+    // CDI interceptors (@AroundInvoke / interceptor bindings) instead.
+    // TODO: Migration required - any @Aspect/@Around advice must be rewritten as CDI interceptors.
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
@@ -45,7 +63,8 @@ dependencies {
     api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
-    api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"
+    // springdoc-openapi-starter-webmvc-ui -> SmallRye OpenAPI (schema at /q/openapi, UI at /q/swagger-ui)
+    api 'io.quarkus:quarkus-smallrye-openapi'
     // Simple Java Mail for EML/MSG parsing (replaces direct Angus Mail usage)
     api 'org.simplejavamail:simple-java-mail:8.12.6'
     api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
@@ -78,6 +97,14 @@ dependencies {
         runtimeOnly "com.stirling:jpdfium-natives-${platform}:1.0.2"
     }
 
+    // Jackson 3 (tools.jackson) - retained because ~100 files migrated to the Jackson 3 namespace
+    // under Spring Boot 4. Quarkus integrates Jackson 2 for REST bodies; Jackson 3 coexists here as a
+    // plain library so those files compile and can still build/parse JSON directly.
+    // api-scoped so downstream modules (core, proprietary, saas) that import tools.jackson inherit it.
+    // TODO: Migration required - converge the codebase on a single Jackson major version.
+    api 'tools.jackson.core:jackson-databind:3.0.0'
+    api 'tools.jackson.core:jackson-core:3.0.0'
+
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)
     implementation 'com.bucket4j:bucket4j_jdk17-core:8.19.0'
 

@@ -6,15 +6,16 @@
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.stereotype.Service;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
 
-@Service
+@ApplicationScoped
 @Slf4j
 public class EndpointConfiguration {
 
@@ -52,9 +53,10 @@ public DisableReason getReason() {
     private Map<String, Set<String>> endpointAlternatives = new ConcurrentHashMap<>();
     private final boolean runningProOrHigher;
 
+    @Inject
     public EndpointConfiguration(
             ApplicationProperties applicationProperties,
-            @Qualifier("runningProOrHigher") boolean runningProOrHigher) {
+            @Named("runningProOrHigher") boolean runningProOrHigher) {
         this.applicationProperties = applicationProperties;
         this.runningProOrHigher = runningProOrHigher;
         init();

@@ -9,7 +9,8 @@
 import java.util.List;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
+
+import jakarta.enterprise.context.ApplicationScoped;
 
 import lombok.extern.slf4j.Slf4j;
 
@@ -47,7 +48,7 @@
  *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
  * </ul>
  */
-@Service
+@ApplicationScoped
 @Slf4j
 public class TabulaTableParser implements TableParser {
 

@@ -2,21 +2,27 @@
 
 import java.lang.annotation.*;
 
-import org.springframework.core.annotation.AliasFor;
-import org.springframework.http.MediaType;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-
 import io.swagger.v3.oas.annotations.parameters.RequestBody;
 
+import jakarta.enterprise.util.Nonbinding;
+import jakarta.interceptor.InterceptorBinding;
+import jakarta.ws.rs.core.MediaType;
+
 /**
  * Shortcut for a POST endpoint that is executed through the Stirling "auto‑job" framework.
  *
+ * <p>MIGRATION (Spring -> Quarkus): this was a Spring composed meta-annotation that stamped
+ * {@code @RequestMapping(method=POST)} onto the target via {@code @AliasFor}. JAX-RS does not
+ * honour {@code @Path}/{@code @POST}/{@code @Consumes} through meta-annotations, so this annotation
+ * no longer provides routing. It is now a CDI {@link InterceptorBinding} handled by {@code
+ * AutoJobInterceptor}. <b>Controllers using {@code @AutoJobPostMapping} must additionally declare
+ * their own JAX-RS {@code @POST} + {@code @Path(value)} + {@code @Consumes(consumes)}.</b> The
+ * {@link #value()}/{@link #consumes()} members are retained so a scanner/controller can read the
+ * intended routing.
+ *
  * <p>Behaviour notes:
  *
  * <ul>
- *   <li>The endpoint is registered with {@code POST} and, by default, consumes {@code
- *       multipart/form-data} unless you override {@link #consumes()}.
  *   <li>When the client supplies {@code ?async=true} the call is handed to {@link
  *       stirling.software.common.service.JobExecutorService JobExecutorService} where it may be
  *       queued, retried, tracked and subject to time‑outs. For synchronous (default) invocations
@@ -26,29 +32,34 @@
  *       GET /api/v1/general/job/{id}</code>.
  * </ul>
  *
- * <p>Unless stated otherwise an attribute only affects <em>async</em> execution.
+ * <p>Unless stated otherwise an attribute only affects <em>async</em> execution. All members are
+ * {@code @Nonbinding} so the single {@code AutoJobInterceptor} matches every annotated method; the
+ * interceptor reads the actual values reflectively from the target method.
  */
-@Target(ElementType.METHOD)
+@Target({ElementType.METHOD, ElementType.TYPE})
 @Retention(RetentionPolicy.RUNTIME)
 @Documented
-@RequestMapping(method = RequestMethod.POST)
+@InterceptorBinding
 @RequestBody(required = true)
 public @interface AutoJobPostMapping {
 
-    /** Alias for {@link RequestMapping#value} – the path mapping of the endpoint. */
-    @AliasFor(annotation = RequestMapping.class, attribute = "value")
+    /**
+     * The path mapping of the endpoint (controllers must mirror this on a JAX-RS {@code @Path}).
+     */
+    @Nonbinding
     String[] value() default {};
 
     /** MIME types this endpoint accepts. Defaults to {@code multipart/form-data}. */
-    @AliasFor(annotation = RequestMapping.class, attribute = "consumes")
-    String[] consumes() default {MediaType.MULTIPART_FORM_DATA_VALUE};
+    @Nonbinding
+    String[] consumes() default {MediaType.MULTIPART_FORM_DATA};
 
     /**
      * Maximum execution time in milliseconds before the job is aborted. A negative value means "use
      * the application default".
      *
      * <p>Only honoured when {@code async=true}.
      */
+    @Nonbinding
     long timeout() default -1;
 
     /**
@@ -57,13 +68,15 @@
      *
      * <p>Only honoured when {@code async=true}.
      */
+    @Nonbinding
     int retryCount() default 1;
 
     /**
      * Record percentage / note updates so they can be retrieved via the REST status endpoint.
      *
      * <p>Only honoured when {@code async=true}.
      */
+    @Nonbinding
     boolean trackProgress() default true;
 
     /**
@@ -72,6 +85,7 @@
      *
      * <p>Only honoured when {@code async=true}.
      */
+    @Nonbinding
     boolean queueable() default false;
 
     /**
@@ -82,5 +96,6 @@
      * AutoJobPostMappingWeightTest} fails the build if any endpoint leaves it unset. Runtime
      * readers clamp the value into {@code [1, 100]}.
      */
+    @Nonbinding
     int resourceWeight() default Integer.MIN_VALUE;
 }
@@ -5,9 +5,6 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
@@ -16,8 +13,9 @@
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-@RestController
-@RequestMapping("/api/v1/account")
+// MIGRATION (Spring->JAX-RS): controllers using this annotation must declare
+// @jakarta.ws.rs.Path("/api/v1/account").
+// JAX-RS does not honour @Path via meta-annotations, so the path is not inherited from here.
 @Tag(
         name = "Account Security",
         description =

@@ -5,19 +5,20 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
  * Combined annotation for Admin Settings API controllers.
- * Includes @RestController, @RequestMapping("/api/v1/admin/settings"), and OpenAPI @Tag.
+ *
+ * <p>MIGRATION (Spring -> JAX-RS): JAX-RS/RESTEasy does NOT process {@code @Path} via custom
+ * meta-annotations (Spring honoured composed {@code @RestController}/{@code @RequestMapping}
+ * through {@code @AliasFor}; JAX-RS has no equivalent). This annotation therefore now carries only
+ * the OpenAPI {@code @Tag}. Each controller annotated with {@code @AdminApi} MUST additionally
+ * declare its own {@code @jakarta.ws.rs.Path("/api/v1/admin/settings")} (the path the removed
+ * {@code @RequestMapping} used to supply).
  */
 @Target(ElementType.TYPE)
 @Retention(RetentionPolicy.RUNTIME)
-@RestController
-@RequestMapping("/api/v1/admin/settings")
 @Tag(
         name = "Admin Settings",
         description =